Official antivirus, malware, and firewall FAQ

[Mad_Man]

After reading the initial post regarding the Security Alert Topic here on the forum, as well as the replies that followed.. Rather than add-on other threats to OS X in that thread, I came to this thread to ask the following....

Many still believe OSX is (let's call it) untouchable against viruses, trojans, etc. So I have to ask here.. Can someone please explain the viruses, trojans and such reported vulnerabilities against OSX in the following links? And for that matter, why Apple finds vulnerabilities and patches them, not to mention add's Malware to a OS that supposedly "doesn't get PC viruses"?

Pwn2Own Winner.

Mac Botnet: iWork Installer.

SC Magazine - Security Flaw in Snow Leopard

And I have to wonder, why would Apple do this?
zdnet - Apple adds Malware Blocker in Snow Leopard
If you bother with this link, be sure to read the comments section.

And if you're clinking the links, this is very interesting read..
Gigaom - Antivirus Software On Your Mac: Yes or No?

So if anyone (actually knowledgeble) can tell me why some will insist I have nothing (and have never had anything) to worry about, I will appreciate it. Sincerely.

 

[cwa107]

Many still believe OSX is (let's call it) untouchable against viruses, trojans, etc. So I have to ask here.. Can someone please explain the viruses, trojans and such reported vulnerabilities against OSX in the following links? And for that matter, why Apple finds vulnerabilities and patches them, not to mention add's Malware to a OS that supposedly "doesn't get PC viruses"?

No OS is immune to malware (which is a broader category of malicious software that includes Spyware, Adware, Viruses and Trojans - each of which is not the same thing and varies in its severity). OS X has had a handful of trojans thrown at it in the past few years. Trojans effect any platform as they are simply undesirable software that are masked to look like desirable software. They essentially play on the ignorance of a user, as opposed to actually using clever programming to co-opt a system.

I think the reason that the Mac has gotten a reputation for being free of these maladies (aside from Apple marketing) is that while OS X has had a half dozen or so trojans, their overall effect is relatively minor and their number is dwarfed by the hundreds of thousands of maladies that are Windows-specific.

But again, you will never buy a computer that is absolutely impervious to security threats. It doesn't exist, and will never exist as long as imperfect humans are creating computers and other malicious humans are writing software for them.

Pwn2Own Winner.

Charlie Miller is very talented, indeed. Unfortunately, about the only way he can "pwn" a system is to coerce or be allowed to direct a user into visiting a very specifically coded webpage that he has prepared in advance over weeks or months of research trying to find the tiniest of bugs.

Should this be of concern to the average user? Sure, but just as an unseen asteroid could impact the Earth tomorrow ending life as we know it, the likelihood that you would run into a site like this under casual browsing is slim to none. And if you do, the likelihood that an AV product would stop you from visiting it is even slimmer.

Mac Botnet: iWork Installer.

This is a trojan bundled with a pirated copy of iWork. Don't pirate software and you have nothing to worry about. Always be cautious about where you get your software from, particularly if it requires an admin password to install it.

SC Magazine - Security Flaw in Snow Leopard

Again, as long as software is made by humans, they will have bugs that lead to exploits. Same goes for any complex creation. Fortunately this is one that was found and patched. The moral of this story? Keep your software updated.

And I have to wonder, why would Apple do this?
zdnet - Apple adds Malware Blocker in Snow Leopard

I have to wonder why Apple would block one of these trojans too, especially since one of the patched-for maladies is the one that's included with pirated copies of iWork (seeing as you'd think they'd want pirates to get their just desserts ).

But seriously, the two most actively distributed trojans are this one and the one that comes from porn video sites. It basically tries to convince you that you need to download a "codec" to view a video. And of course you need to enter your admin password through the process, which should throw up red flags for any relatively savvy Mac user.

Moral of this story? Again, don't pirate. And if you're on a seedy site, I probably wouldn't trust its recommendation of codecs.

If you bother with this link, be sure to read the comments section.

And if you're clinking the links, this is very interesting read..
Gigaom - Antivirus Software On Your Mac: Yes or No?

So if anyone (actually knowledgeble) can tell me why some will insist I have nothing (and have never had anything) to worry about, I will appreciate it. Sincerely.

Put simply... because at this point in time, the threats are so few and far between, the severity of those threats is so low, and avoiding those threats is so simple, that it's just not warranted. In most cases, they are more trouble than they're worth.

NO AV package can possibly protect a computer against the greatest threat to it: *YOU* Nearly every Windows machine that I remove malware from has an active, up-to-date and decent AV package on it. Guess what? These folks still get infected. Why? Because there's no AV package that can defend successfully against the hundreds of thousands of maladies that Windows is susceptible to - especially if the user doesn't apply any common sense in using the machine.

So, what is my recommendation as a seasoned Windows network admin with more than a few years of Mac experience under my belt? Just follow a few simple rules and you have nothing to worry about:

1. Make backups. If something bad happens, you can recover easily using a Time Machine, Carbon Copy Cloner or SuperDuper! backup.

2. Keep your OS up-to-date using Apple's built in Software Update mechanism.

3. Don't pirate software. Furthermore, don't download software from sites you know little to nothing about. Sites like Apple's own public domain download site, MacUpdate, and CNET's Download.com are good sources.

4. Most Mac software does *not* require an admin password to install. If it does, that means it's trying to modify the OS in a significant way. If you're installing software and you're prompted for a password, make sure it passes the following common sense test:

* I know what this software is and what it does.
* I trust the source of this software
* I know why I need it.

If you can't answer those questions "yes", don't install it.

 

[cwa107]

And one more thing...

I think the best op-ed I've ever read on Mac security is as follows... and I think it's worth repeating here, as it explains quite well why the Mac (and Linux) has fared so well in an era of constant security threats to Windows...

I was at DefCon this weekend and there were actually several talks about OS X vulnerabilities. And yes, they are real threats, but media tends to exaggerate them because:

1) Reporters are not engineers and thus, do not fully understand the problem.
2) Their articles get more circulation if they over-hype the problem.

Nobody is saying that OS X is malware-proof. But OSX, BSD, Linux and Unix all have inherent design features which make them more secure than Windows. The biggest and most important is a concept called Discretionary Access Control. Allow me to explain...

Alll *nix-based systems have a user called "root". This is a super user that can control the entire computer. In order to install software, you must first become root. In order to read or change configuration files, you must become root. If you want to modify an executable, add a shared library, modify a device driver, or change anything meaningful, you must first become root. This makes it next to impossible for a regular user to unwittingly install a virus or any piece of malware on his computer because, in order to do so, he would need root permission. This is called "Discretionary Access Control", or DAC for short.

Most Windows users will tell you that this is akin to the "Administrator" account on your PC, but that is not exactly the case. Microsoft has attempted to emulate this technique many times, but always fails miserably in its implementation. On a typical Windows PC, THE DEFAULT USER ACCOUNT has Administrator access! This makes it very easy for users to unwittingly install all kinds of malware on their computer without realizing it. Think about that for a second... why would you ever need to run a word processor or a web browser as a super user? That would mean that Internet Explorer, for example, would have permission to write to your system32 directory! Why would IE ever need to do that? And what person in their right mind would ever allow it to? It's a virus writer's dream come true.

Now let's talk about software vulnerabilities. Try to stay with me here, because this gets complicated. The vast majority of software vulnerabilities (greater than 90&#37 involve buffer overflow attacks. This is an attack, where by a malicious user takes control of a running program and shoe-horns its own malicious code onto the instruction stack. When this happens, the malicious instructions have the same permissions as the program it just took over. And what permissions would those be?... it depends on which user is executing the program. When you run everything as Administrator, as is the default behavior in Windows, EVERY vulnerability becomes a critical vulnerability and EVERY piece of malware can run as a super user.

Let's back up... I'm sure that by now, the Microsoft crowd is saying "Wait a second! You don't have to run everything as Administrator! You can create regular user accounts and restrict their permissions too." And they would be correct. I have never met anyone who does this on their home PC, but the option is certainly there. But even if you do that, you're still screwed because EVERY SINGLE BACKGROUND SERVICE runs as Administrator. Oh, you forgot about the background services, didn't you? Don't feel bad... Microsoft forgot about them too. Right click on "My Computer", select "Manage", and click "Services" if you want to see I'm talking about. There you can see nearly a hundred services, all running as Administrator! Break any one of them and you have Administrator access to the entire computer. Nice, huh?

But wait, you say, doesn't Mac OS have that same problem? Of course not. Only an idiot would run everything as super user. Mac OS comes from the factory with FORTY different user accounts, one for every background service that it runs. (Most flavors of Linux do this as well.) So if you happen to exploit one of them, you can only do what that small, very restricted user account can do... and it isn't much. In fact, when you buy a computer from Apple, they don't even give you the root password! You only have access to your user account... your own little world. And if you mess it up, you're not going to take down the entire computer. You'll only screw up your own account because you don't have the required permissions to screw up the rest of the OS. So the underlying architecture of Mac OS is inherently more secure.

Keep in mind that this *DARN*-poor excuse for a DAC is one of a thousand flaws with Windows. I could go on for days about the absolutely retarded design decisions made by Microsoft. Remember the outbreak of email viruses about 5 years ago? Know why those were such a big problem? Because some genius at Microsoft said, "Hey! Let's invent a scripting language that allows user to embed executable code into email messages and then execute that code automatically when you open the message!" Brilliant, huh? It's like they put that hole there on purpose so that every script kiddie with a copy of Microsoft Word could write CRIPPLING email viruses that took down servers and cost billions of dollars to fix.

The issue is much more fundamental than people think. People who use the "security through obscurity" line clearly do not comprehend the issue.

Link to the story he/she was commenting on.

 

[chas_m]

PS. This latest Trojan does affect Macs ... but is ACTUALLY a Trojan against a vulnerability in *Java*, not actually in OS X itself.

And again, because a lot of people have trouble with this, a Trojan is NOT a virus.

Still no viruses for Mac. Ten years and counting.

 

[schweb]

PS. This latest Trojan does affect Macs ... but is ACTUALLY a Trojan against a vulnerability in *Java*, not actually in OS X itself.

And again, because a lot of people have trouble with this, a Trojan is NOT a virus.

Still no viruses for Mac. Ten years and counting.

Either case, it still doesn't take away from the fact it is a vulnerability that affects people using a Mac. Technically you're right, the Mac is not the issue, but the effect is still the same.

 

[schweb]

NO AV package can possibly protect a computer against the greatest threat to it: *YOU*

Best quote ever.

 

[McBie]

Best quote ever.

Amen.

Security is more about people and their behaviour then it is about machines and their settings, and if people believe that technology will solve their (security) problems, then they don't understand the problem and they don't understand the technology.

Cheers ... McBie

 

[Mad_Man]

Personally, I follow the recommendations (call it common sense) you mention here, as well as stay away from "seedy sites" (to best of my knowledge), so regardless of the fact another so-called Windows / Mac IT professional had told me if I think I am safe using a Mac, "think again", it is somewhat comforting to know as long as I remain a savvy user, I (and my Mac) should be good.

cwa107; I appreciate the time you took addressing my post and will use the Rep System to say thank you.

 

[cwa107]

Personally, I follow the recommendations (call it common sense) you mention here, as well as stay away from "seedy sites" (to best of my knowledge), so regardless of the fact another so-called Windows / Mac IT professional had told me if I think I am safe using a Mac, "think again", it is somewhat comforting to know as long as I remain a savvy user, I (and my Mac) should be good.

cwa107; I appreciate the time you took addressing my post and will use the Rep System to say thank you.

Glad I could help. Believe me, if it were necessary, I'd be running some kind of AV software. I just don't think it's warranted just yet.

 

[loveta521]

A very good post and certainly these are points really useful.

 

[zongamin]

Its equally possible to operate a Windows PC without Anti Virus protection - the same rules of acting sensibly and responsibly apply. Anyone who is relying on software to protect them shouldn't have a computer in the first place.

My girlfriend runs a XP machine which is protected with MSSE, but it has never detected anything untoward. To check its working I run a scan with Malware Bytes and Spybot about once a month - and it has never found anything.

So long as you apply updates promptly, and you don't download 'untrusted' software, or attempt to install cracks, or follow some moronic link to a video that requires you to install a special 'codec' you should be fine.

I'd suggest though, that for peace of mind at least, you install ClamXav on your mac have it do a full scan. It won't find anything, but at least you'll be able to answer those critics who say 'well how do you know'.

Personally I have Clam Folder Sentry monitoring my downloads folder, and my browser cache folders. This is because I share files via dropbox with a number of other people, who mainly have Windows. I don't want to be the one who inadvertently passes on an infected file.

 

[IvanLasston]

Man in the Middle Attacks

I've been following the firesheep discussion and I believe that a "Man in the Middle Attack" warrants at least a bullet point.

What is a MITM Attack
Man in the middle attacks occur when there is someone in between you and the network. These attacks are OS independent and pretty much any OS is susceptible to them, including Macs.

There are two MITM attacks that are pretty common
DNS Hijacking (A specific type of hijacking but other network traffic can be hijacked as well)
When we connect to a network we trust that what we are connecting to is correct. When I type in www.bankofamerica.com I expect it to go Bank of America. If someone is nefarious and sets up an open network - but replaces the DNS resolution with something bogus - they can setup a web server to look exactly like bank websites thus tricking you to enter your credentials. (They can do this with other popular log in sites as well.) This is a pretty sophisticated attack with a lot of hardware and setup time but it is a concern. It can be worth it though in large areas where people log in such as Airports and large wlans - like municipal wifis.

This is also what you hear about when people say they type in a website and get another website. Somehow your DNS has been hijacked such that you redirect to a bogus website.

What can you do? Don't login to secure sites on untrusted networks. Double check that you have a lock icon and that the associated certificate is actually valid - while using https. Know what you are installing - and double check your dns resolution - i.e. registry keys, lmhosts, hosts files etc.

Packet Monitoring
This where you log into an open network and your network traffic is monitored by someone. An example of this is Firesheep. Basically when you connect to an unsecured Wifi, all traffic that isn't encrypted is sent in plain as day packets that can be reconstructed on another computer. Firesheep monitors all packets and once it finds insecure login information it presents it to the user who is sniffing. They can then proceed to log in to that insecure website (like facebook) as you with a click.

What can you do? Don't login to any websites that don't support FULL https throughout the site. (Most banks do this) You can also run your connection through a VPN or Socks proxy.

 

[whitehorse84]

Hey guys!

I'm asking this question because it's been so long since I've had to deal with an anti virus I think I've simply forgot.

In my girlfriends line of work she gets a LOT of excel and word files bouncing back and forth and for the second time she's gotten a spread sheet that was "infected" (she ran clamxav) and it popped up as infected.

So now she can't send this to anyone simply because her @mac account will not send it out to anyone.

What is a way for her to clean these files up? or to simply have something that will not let her get them from other people?

is norton still top of the game? I hear great things about Intego as well.

any help would be greatly appreciated.

 

[schweb]

is norton still top of the game? I hear great things about Intego as well.

any help would be greatly appreciated.

The very first post in this thread lists some great free AV programs.

 

[whitehorse84]

Hey Schweb,

Thanks for the reply

We ran clam but all that can do is report to us what is infected, and we already had an idea (some excel spread sheets from an art directory)..

SO, I did pickup a two licensed copy of virus barrier x6 by intego and it went ahead an found these and repaired them (which was crucial because they were VERY LARGE budget spread sheets and if she was unable to send them to anyone it would have caused quite a head ache).

so far, no slow downs and nothing bad to report about intego.

 

[whitehorse84]

I'm running a full scan now and according to my activity monitor it doesn't' seem to be so much of a "hog"

 

[JIMV]

Their anti-virus programs should catch it if you send anything. I would bother with any anti-virus program especially Norton. I remember that in order to get it off of my windows computer I had to download something else because it would not uninstall.

Norton uses an amazing amount of space in a windows PC and requires a special tool to remove it and even then one has to search for all files with some keywords in it to remove the leftovers one at a time...

In my opinion, almost anything is better then Norton...

 

[s2odin]

Norton uses an amazing amount of space in a windows PC and requires a special tool to remove it and even then one has to search for all files with some keywords in it to remove the leftovers one at a time...

In my opinion, almost anything is better then Norton...

Norton is actually one of the top paid AV's out there.

 

[JIMV]

I don't disagree. I am just noting that in PC's the program uses a vast amount of space, inserts itself all over the PC, slows almost every activity, and is nearly impossible to remove...Considering there are so very many programs out there that do the same thing without the downsides, why use Norton?

 

[Macata]

so true

New here, I just signed up to agree completely about Norton. The worst thing about it is that for years in came preinstalled on windoze machines and left millions of users thinking that it was normal for AV programs to be intrusive and bloated. I switched to Eset NOD about 5 years ago and yes, it was a pain to get Norton off the machine so that a capable AV could be installed.

I'm in the process of switching over to Mac, Vista convinced me to get back to my roots. I took my first classes on Apple and learned a little Apple Basic way back when, but like so many I had to switch due to work environment. First to IBM DOS and then windoze showed up. I don't have an AV installed, I'm pretty careful about what gets visited/clicked/downloaded. I will need to install windoze though and will use Eset to watch out for the unseen.

I've been browsing through here and like the helpful attitude I see.