Geide said that Macs were particularly affected in this attack because of a vulnerability in the Apple version of Java — the company stopped using Oracle’s releases of Java a couple of years ago, and supports its own versions. Yet while Oracle had patched the problem with Java that caused this problem months ago, Apple had yet to address the problem until April 3, when it issued a patch for the vulnerability. It then released a second patch on April 5.
“Oracle had patched this but Apple didn’t patch it until very recently,” he said. “Exploits were seen in the wild since around early to mid-March. That has been a full month of lead time to do bad stuff.”
Several experts have said that this appears to be one of the largest-ever attacks on Macs.
To improve Mac security in the future, Geide recommends that users keep updated versions of Java as they come and automate their computers to check for security updates regularly.
He also recommended that users who have yet to do so bite the bullet and install some kind of antivirus software on their Mac, which should also clean up any machine that’s been infected. If you want to check if you’ve been infected without downloading anti-virus software, the security firm F-Secure has instructions for a good , if technical, way to do so.
There are, of course, also some practices that users can use to minimize the likelihood of infection. For one, don’t click on links in e-mails that you’re not absolutely sure have come from someone you trust. The same goes for opening attachments. If a URL looks suspect, don’t click on it no matter how “hilarious” a video is said to be. Don’t believe promises from ads that sound too good to be true and don’t agree to download any software that you didn’t specifically set out to find.