Report That OS X Snow Leopard May Include Antivirus 335
File this firmly in the "rumor" category for now. the JoshMeister writes (in the third person) "Mac antivirus company Intego broke the story this morning that Apple is apparently including antivirus functionality in its upcoming operating system, Snow Leopard. But which antivirus engine is Apple using? Security researcher Joshua Long discusses the likely candidates."
LIES! (Score:0, Insightful)
My Apple is impervious! I don't need no stinkin' antivirus!
Re:Linked Twitter Feed? Reporting in the Third Per (Score:4, Insightful)
Re:Virus on MAC ? (Score:5, Insightful)
>It's a trojan that only installs if you're stupid enough to download a program from a dodgy source
Err, thats pretty much the biggest vector for malware. Pick any popular app for Windows, go to pirate bay, download it, run it, and guess what? You have an infection.
Storm botnet was built by people double-clicking greetingcard.exe.
Dont underestimate people's abilities to go out of their way to find malware to run. You'll find tha you dont need to exploit any vulnerability other than ignorant on the user's part to root the machine.
good for Apple (Score:4, Insightful)
Re:Virus on MAC ? (Score:3, Insightful)
Re:Nonsense (Score:3, Insightful)
I don't understand why you people think that any OS can be imprevious to a trojan?
As an OS X user, this is great news.
This way I don't have to wonder if my Apple using friends are downloading Photoshop from TPB and getting infected.
But, no, as of yet, there are still no self-propagating viruses or worms for OS X.
Even though my snide Windows friends keep sending me the sky is falling emails every month about OS X being just as vulnerable as Windows.
Re:Virus on MAC ? (Score:5, Insightful)
The "virus"mentioned in the screen shot isn't much of a virus [macworld.com]. It's a trojan that only installs if you're stupid enough ...
I could put Ubuntu on a netbook and give it to my sister and she'd have no clue how to use it. But you can bet every last cent that if the source code to a virus was presented to her she would have it compiled (with all the right flags set to target her correct OSX version) and installed in a few minutes. It's borderline magic. Did you know they have LimeWire on Macs now? She managed to find that, install it and learn how to use it on her own but didn't have a clue as to how to move pictures from her old Windows machine to her MacBook. If only curing cancer compromised your computer, she'd have that done in a heart beat.
I knew she would be better off with a mac but your statement of "anybody who uses a Mac knows" makes me cringe. Bottom line: do not underestimate stupidity.
Security Details (Score:5, Insightful)
Apple has been light on details they have made public about Snow Leopard. We know they implemented a CDSA security architecture, expanded use of the sandboxing, and now there is this report of actual malware scanning, but the info on Apple.com is basically nonexistent. I surmise this is intentional. Security people either have developer accounts or will read up on this stuff in technical papers when NDA's expire next week. For regular users, Apple doesn't even want to bring up security as an issue. They will make blanket marketing statements about it, but they would rather leave all the details to more technical venues. This was their policy for Leopard too, with most users having no clue that a full port of TrustedBSD's mandatory access controls was included and being used to sandbox certain potentially vulnerable services.
Amen (Score:5, Insightful)
Re:Virus on MAC ? (Score:2, Insightful)
Apple needs to stop marketing itself as immune from viruses. They have never been immune, just not targeted and fortunately better built so that only a true idiot user with correct privileges can take down the whole system. Unfortunately their marketing that Macs are immune leads to user complacency and foolhardiness. The OS security is useless when the users circumvent or ignore it, which is what has happened with Mac malware, as well as a lot of newer Windows stuff. An idiot Mac user with admin privileges is just as dangerous as one in Vista or 7.
What they have largely been immune (not always [washingtonpost.com]) to is the worms and remote exploits for which Windows has been vulnerable.
Re:Virus on MAC ? (Score:5, Insightful)
I wouldn't put too much faith in "drag to install", because most malware doesn't actually need system privledges.
Also, reportedly websites have figured out how to make Safari automatically download this trojan and then launch the installer program. Users still need to enter their password, but having the dialog automatically popup makes the social engineering step that much easier.
Re:Virus on MAC ? (Score:3, Insightful)
Yet, the technical or sophisticated user tends to go with a Mac. Why is that? Don't believe me? Visit a developer's conference.
Come the time for rain, it'll pour. (Score:3, Insightful)
Problem with having a single, unified anti-virus (if ever such a thing is reliably possible), programmers will have an easier time guessing what protections they'll face when creating a virus.
Windows might not be the most... or... almost... close to the most stable series of operating systems, but there sure is a fair bit of variety involved in each installation. A vulnerability that can hit any generic OS X installation hard will be able to hit every other generic OS X installation hard.
This'll end in tears if Apple and friends don't keep vigilant on every threat. A problem with the die-hard proprietary and user friendly nature of Apple products is Apple are now the sole caretaker, the mother and father, the reason and the nonsense to every single computer they've made residency in. End users aren't encouraged to practice personal responsibility, they pay and trust... pay for trust...
Think Different, Indeed.
Re:Virus on MAC ? (Score:3, Insightful)
really, it asked for the admin password?
But your point is true.
Re:good for Apple (Score:5, Insightful)
Dunno. While no platform is 100% secure, design does count for a lot. There are a lot of "proof of concept" hacks out there for the Mac, but very, very, very few "in the wild" 'sploits floating around, especially self-replicating ones like viruses and worms. The installed base of Internet-going Macs is a few dozen million at the least, and mostly personal computers with personal info and used to buy stuff online - prime targets for the big-shop black hats. I doubt very much it's not worth their while... I just think they can't go after a system with even a moderate level of security.
I don't think this says something about Apple (see the part above about "proof of concept" hacks), I think this says a ton about Microsoft.
I really don't buy "ecosystem" arguments - why is IIS and MSSQL pwnd on a regular basis by automated attacks, but Apache and MySQL only once in a blue moon (and Oracle almost never)?
Re:Come the time for rain, it'll pour. (Score:5, Insightful)
Problem with having a single, unified anti-virus (if ever such a thing is reliably possible), programmers will have an easier time guessing what protections they'll face when creating a virus.
I agree, to some extent. In terms of attacks on the antivirus system itself a single system may be more vulnerable. In terms of bypassing signatures, however, there is no reason centralized anti-malware cannot draw signatures from disparate feeds, the user subscribes to, be they supplied by Apple, open projects, or commercial companies, for free, or charge.
That said, Apple including malware detection doesn't mean users can't install other malware detection services as well. ClamAV isn't going away just because Apple ships a built in competitor.
End users aren't encouraged to practice personal responsibility, they pay and trust... pay for trust...
From Apple's Snow Leopard Web site:
Security Advice The Mac is designed with built-in technologies that provide protection against malicious software and security threats right out of the box. However, since no system can be 100 percent immune from every threat, antivirus software may offer additional protection. Here are some other ways to help keep your information as safe as possible:
That sounds to me like end users are being encouraged to practice personal responsibility.
Re:AV for consumers will be free (Score:4, Insightful)
Re:Virus on MAC ? (Score:5, Insightful)
Have you seen the obscene amount of Mac shareware out there? Don't get me wrong a lot of stuff does "just work" on the Mac, but a lot of niches aren't filled, and it seems like while on Windows you're likely to find spyware infested free programs, and on Linux you're likely to find reputable OSS programs, on Mac you better be prepared to pay $20 a pop for all those little apps. Maybe I'm just being naive, but it doesn't seem like they'd all be around if some significant chunk of mac users weren't downloading and buying these programs.
Re:good for Apple (Score:4, Insightful)
That has never been a dream of Apple's...
Rubbish. Maximizing profits is the dream of every publicly-held company, whether the founders like it or not. Go out and ask some Apple shareholders...I have a feeling you'll hear a different story.
Apple sees themselves as selling a luxury brand experience. That means it must NEVER become too popular lest it lose it's cache. The success of the iPod and iPhone are already pushing Apple market share to dangerous levels but they are just 'consumer electronics' and not the Mac itself.
The funny thing is that you actually believe that. Yes, Apple is considered a "luxury brand", but to suggest that Apple would prefer not to sell their products that they spend such a large amount of money marketing and advertising in order to preserve their "cache" is one of the most ridiculous things I've heard. Steve Jobs maybe an arrogant elitist, but he's a businessman first and foremost.
Re:Nonsense (Score:4, Insightful)
I don't understand why you people think that any OS can be imprevious to a trojan?
Nobody with half a brain thinks that. The only way to make an OS totally proof against trojans is to stop users from installing new apps, and that's something that general desktop computing hasn't gone down the road of.
What's curious about OSX is that it doesn't have the sort of culture that leads to trojans being a problem. I'm not sure why this is; maybe it is because Mac users are more inclined to buy their software? (Indeed, they buy things that on other platforms would be free...) Accepting (apparently) legitimate payments is not a black hat sort of thing to do, because it is far too easy to trace back to a real identity.
I suppose it also helps that there aren't that many "usability of security" issues in the supplied OSX core apps, so users are less likely to do something catastrophic by accident.
Re:Hmm.. Speculation on a rumour from unkown sourc (Score:1, Insightful)
Re:Virus on MAC ? (Score:5, Insightful)
I knew she would be better off with a mac but your statement of "anybody who uses a Mac knows" makes me cringe. Bottom line: do not underestimate stupidity.
I wouldn't call it stupidity. Just because somebody isn't aware of all possible malware infection routes that doesn't make them stupid, naive is perhaps a better word for it or perhaps just unlucky. Expecting the average user to be aware of every possible way of getting his computer infected is about as realistic as expecting a non-medically educated person to be aware of all possible ways to get a disease. We all know any number of things we can do to avoid getting diseases, some of these behaviors are even hardwired into our DNA but they aren't 100% effective. How many of us are likely to go through life without ever catching a disease like, say, Influenza?
Re:Virus on MAC ? (Score:3, Insightful)
Re:Virus on MAC ? (Score:3, Insightful)
Dont underestimate people's abilities to go out of their way to find malware to run. You'll find tha you dont need to exploit any vulnerability other than ignorant on the user's part to root the machine.
That's right. Five years ago, while speaking at a security conference, I offered a bet, that I would take a non-malicious but virus-pattern-matching program, call it "evil.exe" or something, put it up for download with a clearly worded webpage saying "this is malware, do not under any circumstances run it", and I'm sure if I could get the link on /. or something, thousands of people would run it.
Nobody took me up on that bet, everyone nodded in agreement.
Three years later, at the same conference, I told everyone that I've come to the conclusion it's not user stupidity. It's a problem of expectations. From the perspective of your average non-geek computer user, he's being told all the time how great the Internet is, and how easy it is to download and install stuff, and every trustworthy source gives him stuff to download - he really can't see much of a difference between nvidia.com and nudevirgins.com - and quite frankly, why should he? That's just a game of awareness vs. camouflage, another arms race.
But why does the computer give a random program full access to the machine? It shouldn't need it. 90% of available software could run in a sandbox, and communication with other software could go over well-defined APIs that are ACL aware at least, MAC at best.
But - we in the computer industry still believe in the "wiz kid" and the "hero programmer", not in processes and procedures, controls and quality assurance. It "limits our freedom".
We'll learn.
Probably the hard way.
Re:good for Apple (Score:3, Insightful)
when it comes to OSs and security, a lot /.ers (and lots of other people, to be sure) seem to have this enormous blind spot; they simply cannot understand (or bring themselves to acknowledge, as the case may be) that there is, indeed, a difference in how well designed different OSs are to repel attacks. Why is this?
Because a lot of /.ers understand enough about computer security to know that the supposed advantages from Apple's vaunted design are bullshit. Does Apple use a UNIX architecture, with privilege separation and a minimal attack surface. Yes, and that's good. Does that help? Not really. Desktop security is a lot more sophisticated today than it was a decade ago. But so are the attackers.
First, while Apple has cut down on the 'invisible' attack surface of running, internet exposed services, you've still got a web browser and that's turned into a monstrous attack surface in the past few years. Furthermore, Apple has poor defense in depth. ASLR in OS X is broken and Safari isn't sandboxed. That's why Apple has loses pwn2own, badly.
Second, and more important: security features aren't worth a damn when the user opens the door, and user-initiated security breaches are by far the most common. Sure, you can keep the malware out of the system files, but malware doesn't need access to the system files to do its job.
Re:Virus on MAC ? (Score:3, Insightful)
No problem. Just design a new OS from the ground up for the 21st century. In the 20th century things were slow enough without a sandbox.
Re:Virus on MAC ? (Score:5, Insightful)
Sounds like you haven't seen the Mac warez scene. There's heaps of warez, cracks, serials out there for Mac applications -- you can get them as readily as you can get Windows ones.
I do think it's true that Mac users are more likely to buy/pay for "shareware" apps though.
Offtopic, but "shareware" seems like the wrong word for it. Doesn't feel quite right.
Also, I dispute the notion that there's not much open source/freeware on Mac OS X. There is, but like a lot of open source stuff, they're often not the best-of-breed. I'd rather pay some money and get the best there is, like Transmit (for FTP) and CSSEdit/Espresso (for editing HTML and CSS).
The open source apps I use the most on OS X are Firefox and VLC.
Re:mac users are gold (Score:3, Insightful)
Re:Amen (Score:2, Insightful)
There was a guy who was studying technical writing at my university. He uninstalled his anti-virus software because it was preventing him from installing some free software he wanted.
FAIL