Gasp! A major and unknown threat for OSX

[pm-r]

Hmmm... too many loose cannons here for me with this thread, so please excuse me while I go elsewhere. Thanks.

 

[Randy B. Singer]

The virus versus malware definition threw me at first too.

To make it simple...

Among Macintosh users the term "malware" is used to describe any sort of malicious software. So Worms, Trojan Horses, Viruses, etc. are all malware.

Macintosh users refer to "viruses" to mean self-replicating malware. That is, malware that doesn't require user intervention to spread.

To complicate things, many Windows users use the term "virus" to refer to all malware, no matter what the type. Though the correct technical definition of "virus", even in the Windows world, is the more narrow definition that Mac users use. See:
Computer virus - Wikipedia, the free encyclopedia

So, to further define things, there *is* malware (though a very limited amount) for the Macintosh. Here's a list of all known malware for the Macintosh:
The Safe Mac : Mac Malware Guide

About half of what is in that list is now extinct in that it does not exist in the wild. The other half tend to be extremely rare, and also are not a concern in that updates to OS X, or to Java, or to Flash have provided some degree of inoculation against them. (You can still get them if you haven't updated your software, or if you have turned off certain protections, etc. But since they are currently rare, you still aren't likely to become infected.)

There are only two or three pieces of software in that list that could be technically defined as "viruses" in that they are self replicating. None of these currently exist in the wild. So, anyone who says that there are "no viruses for the Macintosh" is technically correct if they are speaking about self-replicating malware existing in the wild (an admittedly narrow definition), but incorrect if they really mean that "there is no malware for the Macintosh."

There *is* malware for the Macintosh. However, at the present time, there is so little risk posed by malware that the vast majority of Macintosh users don't run anti-virus software. Despite this you just about never hear a believable report of any Mac users becoming infected.

Does that make things clear enough for all?

Finally, since there is so little malware for the Macintosh, and it has all been identified and described (refer to the link I gave to a list of it, above), and any malware encountered can be easily identified by name by a quick run of a free anti-virus program (I gave a list of these in a previous post in this thread), it's natural for Macintosh users to be skeptical, and possibly even derisive, towards anyone who says that they have encountered malware yet they refuse to name it, or worse, describe what it did when there is no malware in existence for the Macintosh known to act in such a way.

Frequent encounters with malware is a fact of life for Windows users. (Compare any month's issues of PC World and Macworld. See how many articles in each refer to malware.) Conversely, for Macintosh users, a lack of malware is one of the main reasons that Mac users use Macs. For Macintosh users its sort of like being the nice girl living in the house next door to the, ahem, House of Ill Repute. (Please forgive any unintended sexism in that statement.) The Macintosh is sometimes accused, but the accusations are usually just baseless slander due to folks inappropriately comparing the Macintosh to Windows. So, without some "proof" (e.g. specificity and maybe even links to authority), many Mac users tend to respond to reports of malware in a knee-jerk fashion. The Macintosh has been falsely accused for a long time. If you are a recent switcher you may want to learn a bit about the Mac before you go around claiming that mailware is common among Mac users.

 

[dhcromer]

Mac viruses are real

Anyone who thinks that OS X doesn't get viruses is wrong.
MAC viruses are here to stay
Known Mac OS X viruses-updated - F-Secure Community - 631

This is about security and antivirus, but since no one is likely to get any usable info from it, I have put it in the lounge.

My physical internet provider has become less than optimum lately, so I have begun to explore other options, one being terrestrial wireless.

I hit a local franchise shop for a wireless company, got the scoop and pricing from the salesman, made notes and prepared to leave. Then he said, "Oh, yes. One other thing. The company requires that you run a current antivirus program."

"No problem," I said. "I run OSX and it is always current. No viruses for it." It went downhill from there.

He immediately came back with some heavy technical info that I was unaware of. (Paraphrased, of course - I didn't make a recording, although I wish I could have) "Sir! You are wrong on that. Apple is based on Linux, and there are far more viruses for Linux than Windows ever had. I know that for a fact - Linux is what we run here and we are always having to update our antivirus."

In vain did I try to point out that OSX is on top of BSD, and BSD is Unix, not Linux, and neither have any actual and active viruses in the wild. Didn't help. If I went with them, an antivirus would have to be installed.

So, as I left (for the last time) to find another dealer, I decided that one of two things were in play here.

1. The salesman was blowing false information on purpose. (Anybody ever hear a salesman lie?)

2. The level of his ignorance was such that precluded any sane person from dealing with him.

Anyway, just to be a good netizen and to pass along his warning, be advised that for any of you that are running a Linux based OSX, you are at extreme risk of malware.

 

[MacInWin]

Good summary, Randy! I think for switchers who assert that they have been struck by a "virus" on their new Mac-whatevers the skeptical response may seem derisive, but I don't think we intend it that way. It's just that as a frequent visitor here the cry "I have a virus!" becomes wearying and our responses get shorter. And when someone insists that it MUST be a virus because yadda, yadda, yadda, it generally turns out to be something they allowed to be installed, or something that they did to diminish the built-in security, or something they downloaded from a dodgy site, or a "helper" package they installed that not only doesn't help but brought a host of parasites with it, or even something that is working exactly as advertised but the user didn't expect it to work that way. One user complained that he had a virus in Thunderbird that caused mail to be moved to the junk folder without human intervention.. That's not a virus, that's how Thunderbird works! From Mozilla:

To deal with the large amount of unsolicited email ("spam" or "junk mail") that most people have to cope with, Thunderbird uses an adaptive filter that learns from your actions which messages are legitimate and which are junk.

So when the software did what it was designed to do, that is to move junk mail to the junk mail folder without human intervention, the user was surprised and immediately leapt to the conclusion of "Virus!"

And then you have the category of folks who believe that those of us that choose not to run A/V are too stupid, naive, whatever, to see the risk of that choice. These folks come here and tell us we have our head in the sand, don't know what the real challenges are or that we're mindless fanbois who drink the Apple Kool-aid about OSX.

Here is what I have done for security:

1. No Java, period. No reason to have it, it's carried malware in the past, don't have it installed.
2. No operative Flash, but I do have Click to Flash installed. That way I get to choose what runs, so that I will be responsible for what happens. (And I generally choose NOT to run Flash, unless I know for certain where the file originated and trust the source.) Again, Flash has carried malware and therefore goes into the sin bin.
3. Gatekeeper is always on. Folks who get annoyed by having to acknowledge that the thing they are about to install came from someplace other than Apple and disable Gatekeeper are like folks who get annoyed by having to unlock the front door with a key every time they come home. Leaving the front door unlocked is convenient but NOT smart and will eventually lead to someone coming in that you wouldn't want in.
4. I don't go to sites I don't know. I don't click on links until I get to examine them. I don't respond to things that sound too good to be true. When I get a prompt to update Flash, or some other application, I ignore the prompt and then go directly to the Flash options in System Preferences to see if there really IS a valid update waiting. I don't let Adobe, or anybody else, automatically update anything. I want to KNOW what is going on in my system.
5. I leave my OSX firewall on. Yes, I know my WiFi router has a firewall from my ISP, and it works well, but I also know that there are ways to get to a system through WiFi. If I had Ethernet cable, I would turn off the firewall, but as long as I am on WiFi, the firewall is on. It doesn't cost me anything to have it running, so why not have the extra layer there?
6. In Safari, the "Open safe files..." option is de-selected. As I said, I want to be in control of what opens on my system. Period.
7. My mail is strongly filtered for malware/adware/junk. I use a third-party mail forwarder who has a strong filter to screen my mail and then forward it to my ISP email address. My ISP provider then has their own spam/virus filters that they apply before delivering the email to me. As a result, I get little true junk or spam, and no Windows virus-infected mail.
8. I run Ghostery. I don't run Ad-ware, as Ghostery seems to block most of the annoying stuff. I choose to have Ghostery block EVERYTHING, which does mean that I occasionally can't see a picture, or a video on a site, but the lost of that picture or video is worth it to me to avoid all the other stuff Ghostery blocks.
9. I don't run any "helper" software. No downloaders, no torrents, no cleaners other than Onyx, no "speed up my mac" stuff. I run Onyx about once a year. I run ClamXav also about once a year, just for giggles.
10. I don't use any Google product. Period. Why? Because Google now insists on automatic updates. See my point 4 above. I have uninstalled all Google products from my system and set Bing as my default search engine.
11. I have a Facebook account, very few friends, never click "Like" and I have every security setting set to the highest level.
12. I use a password keeper and my passwords are all generated by the keeper as a minimum 16 digits of letters, numbers, symbols and mixed cases. I change the master password to that keeper frequently. I'm thinking of going to 32 character passwords on the sites that can handle that length. I do use two step verification at every site that supports it.
13. I use Paypal to pay for internet purchases. The Paypal account is linked to a single credit card with fraud insurance. If the seller doesn't take paypal, I only use the same credit card with fraud protection on it for all those purchases. I have the account set to notify me by SMS and email every time the card is used and is not present.
14. I use backups in depth. I have two backup systems to two different external drives with archival copies on each drive going back at least six months. Yes, I'm paranoid about that, and proud to be so. Backups are a better investment than A/V software, as I'll explain next.

Running A/V on OSX is, IMHO, of little value, if any. Any attack on OSX must come from some currently unknown vector, as all the known vectors are pretty well stopped up. So any A/V software can ONLY scan for the known vectors, because that's all they know. But the attack, when it comes, won't come from there, it will come from some unknown weakness or opening. And no A/V software can protect from the unknown unknown.

I was managing a data center when the Morris Worm struck. Popular press at the time claimed that nobody knew about the potential problem until it occurred. Not true. I had a staff member who had been a developer at Bell Labs on the Unix project and he had months earlier plugged every avenue by which the worm attempted to come in. It was at a major university, and we were in the Administrative Data Center. We warned the Engineering school about the weaknesses, but they ignored our warnings because we weren't engineers, just administrators. When the worm hit, every computer at the Engineering school got infected and every one had to be completely purged and reinstalled. On OUR side, however, we had zero infections because we had listened to the sysadmin who knew his business. The lesson we all learned was that prudent computing practices can anticipate attacks through KNOWN weaknesses, but that it's still impossible to know EVERY weakness. That's when we came up with the term "unknown unknown." And you cannot protect against the unknown unknown except by having backups to restore to a time before the unknown unknown hits. I'm hoping six months is far enough back.

I was in the IT business for over 30 years before I retired a few years ago. In that time I learned that security is always a tradeoff of cost/benefits. Each user has to assess his or her own tolerance for risk in terms of what the cost might be if/when security is breached. For me, I've done what I think I need to do to operate at a level of risk that is acceptable to me. So when someone comes along and cries out that I'm being stupid, ignorant or a fanboi because I don't immediately adopt THEIR solution, I guess I do get dismissive at little.

 

[vansmith]

To the admin that replied: I would suggest you get off your high horse.

I think you might want to re-evaluate your original post in which you imply that your experience means that you somehow have a privileged understanding of this.

Viruses are a part of malware. Spyware, trojans, viruses all constitute malware.

"malware
ˈmalwɛː/
noun
noun: malware; plural noun: malwares

software which is specifically designed to disrupt or damage a computer system."

"Short for "malicious software," malware refers to software programs designed to damage or do other unwanted actions on a computer system. In Spanish, "mal" is a prefix that means "bad," making the term "badware," which is a good way to remember it (even if you're not Spanish).

Common examples of malware include viruses, worms, trojan horses, and spyware."

Yes, and a whole host of conditions exist under the umbrella term "disease" and as you very well know, it's possible to have one condition and not another. It's not an all or nothing game and to represent it as such is disingenuous. Given your experience, you must be aware that there is a difference between those categories and that, in some respects, they are mutually exclusive of each other (hence the different naming).

But obviously you know better than anyone else mr so-called administrator

Again, you may want to re-read your original post. Anything "high and mighty" I've done here has also been done by you. And what would anyone expect as a response when their first post paints the entire community as ignorant? Imagine doing that at a party and then telling everyone to get off their high horse when they push back. We encourage people to play nice around here but you can't expect that if you don't respect that yourself.

I may have got the extension (.exe) wrong - it was "junk" something because it had the same extension as the legitimate Thunderbird one and it did move emails to the Thunderbird "Junk" folder every time Thunderbird started - I had several emails in their that had no 'message filters' that sent them there (I have no 'message filters' at all) and I had never seen those emails - as in they never showed up in my Inbox first.

Unless that "junk" was self-propagating, it wasn't a virus.

Call it viruses - call it malware - doesn't matter there certainly are things that can affect the running of the Mac despite Administrator's refusal to admit it and despite Administrator's denying that viruses are indeed 'malware'.

At no point did I deny that malware exists and in fact, I'm often arguing against most people here about the state of malware on OS X. If you read my posts here, you'd see that what you've said here is wrong. I have also, at no point, denied that viruses are malware. I have argued though that OS X is currently susceptible to certain types of malware, viruses not being one of them. So yes, viruses are malware but aren't a type of malware that threatens Macs right now.

And did you suggest to the other Admin that he tones it down and maybe learns his definitions before showing his ignorance?

Learn definitions? Again, point me to something that corresponds with the definition of a virus (and not malware) and I'll happily concede my point. And honestly, if you're going to keep conflating malware and virus, which you've done multiple times, I'd ask that you consider how your argument is any different than what you want people to stop doing here.

 

[Sawday]

To the admin that replied: I would suggest you get off your high horse.

Viruses are a part of malware. Spyware, trojans, viruses all constitute malware.

"malware
ˈmalwɛː/
noun
noun: malware; plural noun: malwares

software which is specifically designed to disrupt or damage a computer system."

"Short for "malicious software," malware refers to software programs designed to damage or do other unwanted actions on a computer system. In Spanish, "mal" is a prefix that means "bad," making the term "badware," which is a good way to remember it (even if you're not Spanish).

Common examples of malware include viruses, worms, trojan horses, and spyware."

Malware Definition

But obviously you know better than anyone else mr so-called administrator

No-one is arguing that Viruses aren't malware in the broadest sense of that word but not all, or any current malware is necessarily a virus. Perhaps it's you that needs to check on your use of definitions.

 

[harryb2448]

How about closing the whole thread? No wonder newbies are getting more confused and throwing good money at Kaspersky and company.

 

[Randy B. Singer]

Anyone who thinks that OS X doesn't get viruses is wrong.

Known Mac OS X viruses-updated - F-Secure Community - 631

Those articles would be convincing if:
1. They weren't referring to a bunch of malware that wasn't either extinct or unknown in the wild. (Both of those articles are outdated. Things change fast in the computer industry.)
2. They weren't from companies that are trying to sell you anti-virus software (i.e. they want to make money off of your paranoia) (Note that all of my citations in this thread came from sources that aren't trying to sell you anti-virus software.)
3. They weren't from companies that have been associated with dubious ethical practices and having a problem with factual situations (i.e. they have been known to be big fat liars.)

Hey, but if you want to go around being paranoid, and if you want to waste your money on anti-virus software, and have it slow down and destabilize your Mac, so be it.

I trust that the citations that I've posted previously in this thread should be sufficient for folks to make up their own mind.

 

[doodle47]

How about closing the whole thread? No wonder newbies are getting more confused and throwing good money at Kaspersky and company.

I don't disagree with you, but I wonder why it is a featured discussion in Mac-Forums Newsletter (sent by Mac-Forums <[email protected]>) detailed header info:
mailed-by: bounce.inetinteractive-email.com
signed-by: inetinteractive-email.com

Links on page go to: PoweredBy
and AdChoices: Learn More About This Ad | LiveIntent

Is this newsletter legit or is it just spam in a creative disguise? There are ads on the page which are blocked by my AdBlock Plus.

 

[johnodd4]

Bull!!! bull!!

Let me explain hackers create viruses on linux they wouldn't infect there own machines to create a virus duh!!!

 

[Rod]

This certainly has turned into a thread of epic proportions. Jake (MacInWin) has probably described almost every precaution one could take to avoid "invasion" by unwanted "code" I hesitate to use the terms virus or malware. Unfortunately there are very few users out there that are likely to go to the extents he describes to protect themselves from "infection".
In my mind there are only two elements that need to be stressed, good protection and good practice. Obviously there are multiple elements to both points and good protection is not sufficient in itself without good practice and vice versa.
Most of us learn this from experience, trial and error.
It is partly the role of this forum to assist people to recover from these errors and learn how to avoid making the same mistakes again.
There is little point in becoming angry, intolerant or condescending to, for example, users who do not have backups, as frustrating as it may be.
If we cant even get that point across what hope do we have of teaching people good practice or what protection is required when we are bombarded by advertising promoting "malicious" software like MacKeeper.
I want to say I have loved reading this thread, obviously there are some conflicting opinions amongst members but on the whole it has been very educational for me.
Some members may have become a little "hot under the collar" but there's nothing wrong with a bit of passion when debating a subject we all obviously feel strongly about.
Keep up the good work guys.

 

[vansmith]

Bull!!! bull!!

Let me explain hackers create viruses on linux they wouldn't infect there own machines to create a virus duh!!!

You're going to need to provide some references for that claim especially since it's a different OS and as such, can't be a development platform for platform-specific malware (it could be a base for cross platform malware but then that could be done on any platform).