During the Epic trial, Craig Federighi says malware on macOS has reached an “unacceptable” level and the problem is “significantly larger” than iOS

Apple's head of software engineering, Craig Federighi, said malware on Macs have hit “unacceptable” levels.

CNET 2021-05-20 Ian Sherr

Context & Ripple Effects

Apple's security controls had already shown weak points: Dok used a signed developer certificate to bypass Gatekeeper, and a later-disclosed flaw allowed unnotarized apps to run for months before Big Sur 11.3 patched it. Federighi's testimony puts those incidents in the context of a broader macOS security problem rather than isolated exceptions.

Apple had also revoked developer certificates tied to the Silver Sparrow malware, while subsequent coverage shows it fixing permission abuse in Big Sur 11.4 and eventually increasing the frequency of malware scans. The arc is Apple moving from targeted remediation toward more continuous macOS enforcement.

First-order effects

Apple's macOS security architecture faces public scrutiny in the Epic trial after its software chief characterized the malware problem as materially worse than iOS.
Mac users remain exposed to malware techniques that exploit trusted certificates, app-notarization gaps, or permissions until Apple closes those specific paths.

Second-order effects

Apple has stronger incentive to revoke compromised developer credentials and patch bypasses quickly, increasing the compliance and interruption risk for developers whose distribution credentials are implicated in abuse.
More frequent scanning and stricter enforcement shift more malware detection into Apple's platform layer, reducing the distinction between macOS's protections and commercial anti-malware tools.

Third-order effects

If Apple continues responding through certificate control, notarization, permission fixes, and scanning, macOS distribution will move toward a more actively governed security model, even as the company distinguishes it from iOS.
The Epic trial makes macOS malware prevalence part of the argument over platform security controls, raising the stakes for Apple to show that its enforcement mechanisms work in practice.

The trend: Apple is tightening macOS from episodic malware cleanup toward continuous platform-level enforcement as threats exploit gaps in trusted app distribution and permissions.

Discussion

@thedextriarchy Adi Robertson on x
Federighi compares the Mac to a car that people have to learn how to drive safely. “With iOS, we were able to create something where children — heck, even infants — are able to operate an iOS device and be safe in doing so. It's really a different product.”
@tomwarren Tom Warren on x
Apple admits it has a malware problem on macOS that isn't “acceptable.” It's a surprise admission after Apple spent years rightfully knocking Windows PCs for malware and virus issues https://twitter.com/...
@leah_nylen @leah_nylen on x
Now reading the last sentence here https://twitter.com/...
@markgurman Mark Gurman on x
Federighi: The Mac's active user base is a tenth the size of the iOS install base.
@markgurman Mark Gurman on x
Federighi walking back his comments on macOS security a bit. Says it's safer than Windows PCs.
@keleftheriou Kosta Eleftheriou on x
When your centralized, money-making app distribution channel relies on you not knowing how to automatically enforce such policies, you have no incentive to even try to learn how to automate these. Particularly if you're only employing 500 human app reviewers, not a big cost! http…
@thedextriarchy Adi Robertson on x
Asking Apple to describe Roblox is like asking an AI in a movie to divide by zero until its logic boards explode.
@markgurman Mark Gurman on x
Craig Federighi has had it with Epic's lawyer. Demeanor, depth, and explanation has completely changed from his responses to Apple's lawyer. Obviously, but humorous to hear.
@hodapp @hodapp on x
Apple's strategy today of making the Mac out to be this malware-ridden war zone to protect the sanctity of the walled garden of iOS seems really odd to me. The Mac is fine. iOS with side loading and payment flexibility will also be fine. The only thing at risk is Apple's profits.
@drbarnard David Barnard on x
This is one of the more frustrating things about App Review. Apple has hamstrung innovation in @LaunchCenterPro many times over the years. Both in rejecting features and in making us scared to even try innovative things that don't fit into Apple's little boxes. https://twitter.co…
@markgurman Mark Gurman on x
You won't hear this at WWDC — Craig Federighi says macOS's security is subpar and allows for malware. His point to the judge: if you side with Epic and allow 3rd party iPhone App Stores, you're going to hurt the security of a billion iPhone users. https://www.bloomberg.com/...
@thedextriarchy Adi Robertson on x
If you want context to Federighi's comments about Macs having an unacceptable amount of malware, @chriswelch has a fuller transcript than my tweets: https://www.theverge.com/...
@thedextriarchy Adi Robertson on x
Interesting to contrast Federighi, who's talking through all this *very* fast, with Mickens, who clearly focused on making the ideas legible to non-infosec people. (I joked that he didn't extend his metaphors enough, but he uses them in legitimately helpful ways.)
@keleftheriou Kosta Eleftheriou on x
There it is. If Apple has their way, we might even have to say goodbye to macOS “sideloading”. A true dystopian future of centralized software distribution, in which Apple only sees upside, no downside. https://twitter.com/...
@hodapp @hodapp on x
For real it really shows you how much is at stake for Apple to maintain the status quo with the App Store that they'd just throw the Mac under the bus like this. For YEARS the Mac has been the computer people recommend to their Windows-using family BECAUSE it has no malware.
@nickstatt Nick Statt on x
Craig Federighi just threw Mac security under the bus. Here's the story on his surprising comments regarding the unacceptable level of malware on macOS and why opening up the iPhone would be a “devastating setback” for iOS. https://www.protocol.com/...
@thedextriarchy Adi Robertson on x
Federighi says Mac users are “typically much more wary of downloading software,” while “iOS users are just accustomed to getting apps all the time.” So attackers can find a much more receptive audience. He cites Apple's “there's an app for that” campaign.
@thedextriarchy Adi Robertson on x
“It's well understood in the security community that Android has a malware problem, and that iOS has succeeded so far in staying ahead of the mwalware problem,” Federighi says.
@nickstatt Nick Statt on x
This is a bold strategy here from Apple, to essentially throw Mac security under the bus to protect the iPhone. Federighi says there's “significantly larger malware problem on the Mac,” calls it unaccpetable. But says it's safe “if operated correctly,” like a car.
@stephennellis Stephen Nellis on x
“The Mac is a car. You can take it off road,” Federighi says. “That's what you wanted to buy. With iOS, you wanted to buy something where children can operate an iOS device and feel safe doing so. It's really a different product.” https://twitter.com/...
@stephennellis Stephen Nellis on x
But Federighi is also positions Mac as a “slide back”, malware wise, from Apple's own iOS, which is a heck of a thing to hear come out of an Apple exec's mouth. But he's aiming to counter the testimony of Epic's cybersecurity expert that Mac is plenty secure w/o a walled garden. …
@stephennellis Stephen Nellis on x
The difference between the iPhone and the Mac, according to Apple software chief Craig Federighi's analogy at the Epic Games antitrust trial. https://twitter.com/...
@joshuatopolsky Joshua Topolsky on x
“You're a stupid baby who doesn't know anything.” -Apple, to every iPhone user https://twitter.com/...
@reckless Nilay Patel on x
This is pretty wow that Apple thinks like this! https://twitter.com/...
@backlon Dieter Bohn on x
Wait I thought it was a truck https://twitter.com/...
@stroughtonsmith Steve Troughton-Smith on x
Currently Craig Federighi is explaining sandboxing, ASLR and NX memory to the court, if you wondered whether you were missing anything 😅
@markgurman Mark Gurman on x
@gruber He declined to say whether it was higher or lower than $200 million. If it was actually near the $100 million, I'd imagine he'd say it was lower than $200 million.
@gruber John Gruber on x
@markgurman SensorTower's numbers are estimates, drawn from algorithms I don't think they explain. Don't you think the Apple exec under oath has the right number and that it goes to show that SensorTower numbers are just hand-wavy?
@markgurman Mark Gurman on x
Apple's head of App Store game business development says Apple generated over $100 million in revenue from Fortnite commissions between its launch in 2018 and removal in 2020. The actual number, according to Sensor Tower, is about $350 million. https://www.bloomberg.com/...
@gibiz GamesIndustry on x
Apple took more than $20 billion from the 30% commission between 2008 and 2017 - but doesn't know if the App Store turns a profit https://www.gamesindustry.biz/ ...
@thedextriarchy Adi Robertson on x
Unlucky Day 13 of Epic v. Apple, starting in 10 minutes. App Store games guy Michael Schmid will return, followed by another big Apple name: Craig Federighi. Then another expert witness, Dominique Hanssens. https://www.theverge.com/... https://twitter.com/...

Chronicles