6 ms·

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recom

by mey 11y ago

I keep asking this question and Mac people keep looking at me like I'm an alien, so I guess I'll turn to the HN community for this questions. What do you recommend as security software for OSX currently? How do you help secure your devices from public wifi and the internet in general? Especially for novice users?

andykellr 11y ago
On public wifi, I use https://www.getcloak.com https://www.getcloak.com I also uninstalled Flash.
- 13 11y ago
  Why do you trust Amazon AWS and this company more than your own connection?
  - MaulingMonkey 11y ago
    "Public wifi", not "your own connection". You have two options for who you decide to trust: 1) A VPN company, who you've had the opportunity to research, who's primary business and reputation is based on handling your traffic. 2) Each and every WAP you connect to, in many cases with no real means to verify it's actually e.g. the official WAP of the hotel you're staying at, for something that likely costs the owners money rather than being seen as a profit center in and of itself. Their primary business and reputation is staked on something completely different than their handling of your traffic (be it their coffee, their accommodations, whatever.) If you trust #2, statistics eventually comes into play - you will trust someone who shouldn't have been trusted. This also ignores that "public wifi" frequently performs MITM attacks for the... not entirely unreasonable purpose of providing login gateways, terms of use, etc. when you initially open up your web browser. But if you're already MITM traffic, it's not as big a stretch to substitute your own (poorly vetted) advertisements and affiliate links for a little extra revenue. Even if you don't do that, there's no guarantees your MITM tech isn't accidentally weakening security ala Superfish.
    - 13 11y ago
      I think you put far too much trust in one of thousands of clone VPN services. There's no reputation to taint, there's stock standard scripts running on commodity VPS boxes they rented from somewhere else. I would be shocked if at least some of the most commonly used ones weren't run by people looking to sniff credentials. You're paying to pipe all of your sensitive information through some random persons box, which is just ludicrous.
      - MaulingMonkey 11y ago
        Oh, wait. Were you suggesting VPNing into your home connection or similar instead?
        pyvpx 11y ago
        you should trust your end points. assuming you trust the machine you are using, the other end of the tunnel should be just as trustworthy. that's great if you trust a company; but what incentive do you have to trust them?
  - davepeck 11y ago
    We're a well-known company with an earned reputation for doing the right thing. Not everyone can set up their own VPN endpoint. For those who can, and are willing to maintain it, great! More: https://blog.getcloak.com/2013/03/04/why-trust-matters-when-choosing-vpn/ https://blog.getcloak.com/2013/03/04/why-trust-matters-when-... (And what does AWS have to do with anything?)
jdunck 11y ago
As a general rule, I don't use public wifi and council people to use VPN if they must. No flash, disable java in the browser, prefer chrome to safari, AdBlock and NoScript if you don't need JS.
- 72deluxe 11y ago
  I have removed Flash from my machines but using Chrome over Safari is like kissing your battery goodbye. It does not put the CPU to sleep properly for some tabs. It is sad.
frio 11y ago
Little Snitch (https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html) is excellent.
- noondip 11y ago
  So excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...). However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.
- rosser 11y ago
  As a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now?!" saturation. My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...
  - danudey 11y ago
    I really wish Little Snitch could generate aggregate rules for apps. I keep having situations where an app starts making requests over and over until I realize that the developer is using https requests to cdn###.somehost.com where ### is apparently a dozen or more different hosts, and the only option I have is to just allow all https traffic rather than more granular by-host rules.
- reubenmorais 11y ago
  Although be aware that it can be quite daunting for a novice user. If you're installing for a friend or family member, you should go through all of this apps to whitelist requests and maybe teach them how to identify bad requests, but it's non-trivial. The UI doesn't interact very well with CDNs, for example, sometimes telling you that "App Store" is trying to access "arstechnica.com" because they use the same CDN provider.
superuser2 11y ago
Security software is a band-aid on vulnerable software and users installing things they shouldn't. Part of the OSX security strategy is to minimize users installing things they shouldn't by making it difficult (enforced code signing, confirmations when opening an unsigned or new application). The other side is minimizing attack surface for exploits by staying up-to-date, not shipping crap like Java unless the user explicitly needs it, and (increasingly) sandboxing applications to user-approved subsets of the filesystem. Bolt-on detection and resolution of malware infections is just not a part of the OSX security ecosystem like it is with Windows. Little Snitch can help give you a picture of what's going on with regard to your network card, but at the end of the day malware can usually hide its traffic in an otherwise-trusted application to avoid that sort of detection.
- mey 11y ago
  I believe in defense in depth. There is always going to be an escape. Within the last month there has been several different privilege escalations possible in OSX. While I appreciate OSX having a strong security model, secondary solutions are desirable too me.
  - AdieuToLogic 11y ago
    > I believe in defense in depth. ... While I appreciate OSX having a strong security model, secondary solutions are desirable too me. You might want to check out mtree(8) then. It's serves well as the FreeBSD/OS-X Tripwire[1] equivalent. 1 - http://www.tripwire.com http://www.tripwire.com
r618 11y ago
for preventive and (post)forensic measures see https://objective-see.com/ https://objective-see.com/
code_sterling 11y ago
Remove/Do not install Flash and Java, and make sure that Gatekeeper is at the middle setting. Turn your Firewall on regardless, and/or monitor your network activity. If you know what a packet is, then Little Snitch, if you don't Radio Silence is what I set my parents up with.
georgerobinson 11y ago
It still pains me that OSX ships with the firewall disabled by default. I don't think its reasonable to presume that every OSX device will be on a private network behind a NAT, and that everyone else will know to turn their firewall on. However, this appears to be the assumption Apple are making! You can do better!
donkeyd 11y ago
Eset now has security software for Mac. They were always my go to products on Windows.
- noondip 11y ago
  There really is no good anti-virus software for Macs at the moment. Have a look at recent vulnerabilities in ESET and Sophos, for example: http://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html http://googleprojectzero.blogspot.com/2015/06/analysis-and-e... https://lock.cmpxchg8b.com/sophailv2.pdf https://lock.cmpxchg8b.com/sophailv2.pdf
j-pb 11y ago
Security software (virus scanners e.t.c.) is snake oil. The code required for them to do their thing is so intrusive into the operating system that it has serious effects on stability. And they are not that effective anyhow. Since they won't be able to detect exploits in existing programs over authorised channels.
arca_vorago 11y ago
After spending quite some time deliberating on this, and not wanting my users in the wild without something, I finally settled on Bitdefender. I control clients from the cloud console, can push policies, run scans, updates, all without user interaction. Right now I'm only using the AV part for most devices though, as enabling the full package of internet firewall and website scanning was eating up lots of resources. The two follow up contenders were ESET and Kaspersky.
JonnieCache 11y ago
TCPBlock is a free version of little snitch. It's apparently abandoned, but it doesn't need any more features. http://www.macupdate.com/app/mac/35914/tcpblock http://www.macupdate.com/app/mac/35914/tcpblock You can set it up to disallow all network traffic until you whitelist the binary. Not sure if it's actually hashing them or just checking the path though.

by mey 11y ago

andykellr 11y ago

On public wifi, I use https://www.getcloak.com https://www.getcloak.com I also uninstalled Flash.

13 11y ago
Why do you trust Amazon AWS and this company more than your own connection?
- MaulingMonkey 11y ago
  "Public wifi", not "your own connection". You have two options for who you decide to trust: 1) A VPN company, who you've had the opportunity to research, who's primary business and reputation is based on handling your traffic. 2) Each and every WAP you connect to, in many cases with no real means to verify it's actually e.g. the official WAP of the hotel you're staying at, for something that likely costs the owners money rather than being seen as a profit center in and of itself. Their primary business and reputation is staked on something completely different than their handling of your traffic (be it their coffee, their accommodations, whatever.) If you trust #2, statistics eventually comes into play - you will trust someone who shouldn't have been trusted. This also ignores that "public wifi" frequently performs MITM attacks for the... not entirely unreasonable purpose of providing login gateways, terms of use, etc. when you initially open up your web browser. But if you're already MITM traffic, it's not as big a stretch to substitute your own (poorly vetted) advertisements and affiliate links for a little extra revenue. Even if you don't do that, there's no guarantees your MITM tech isn't accidentally weakening security ala Superfish.
  - 13 11y ago
    I think you put far too much trust in one of thousands of clone VPN services. There's no reputation to taint, there's stock standard scripts running on commodity VPS boxes they rented from somewhere else. I would be shocked if at least some of the most commonly used ones weren't run by people looking to sniff credentials. You're paying to pipe all of your sensitive information through some random persons box, which is just ludicrous.
    - MaulingMonkey 11y ago
      Oh, wait. Were you suggesting VPNing into your home connection or similar instead?
      - pyvpx 11y ago
        you should trust your end points. assuming you trust the machine you are using, the other end of the tunnel should be just as trustworthy. that's great if you trust a company; but what incentive do you have to trust them?
- davepeck 11y ago
  We're a well-known company with an earned reputation for doing the right thing. Not everyone can set up their own VPN endpoint. For those who can, and are willing to maintain it, great! More: https://blog.getcloak.com/2013/03/04/why-trust-matters-when-choosing-vpn/ https://blog.getcloak.com/2013/03/04/why-trust-matters-when-... (And what does AWS have to do with anything?)

jdunck 11y ago

As a general rule, I don't use public wifi and council people to use VPN if they must. No flash, disable java in the browser, prefer chrome to safari, AdBlock and NoScript if you don't need JS.

72deluxe 11y ago
I have removed Flash from my machines but using Chrome over Safari is like kissing your battery goodbye. It does not put the CPU to sleep properly for some tabs. It is sad.

frio 11y ago

Little Snitch (https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html) is excellent.

noondip 11y ago
So excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...). However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.
rosser 11y ago
As a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now?!" saturation. My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...
- danudey 11y ago
  I really wish Little Snitch could generate aggregate rules for apps. I keep having situations where an app starts making requests over and over until I realize that the developer is using https requests to cdn###.somehost.com where ### is apparently a dozen or more different hosts, and the only option I have is to just allow all https traffic rather than more granular by-host rules.
reubenmorais 11y ago
Although be aware that it can be quite daunting for a novice user. If you're installing for a friend or family member, you should go through all of this apps to whitelist requests and maybe teach them how to identify bad requests, but it's non-trivial. The UI doesn't interact very well with CDNs, for example, sometimes telling you that "App Store" is trying to access "arstechnica.com" because they use the same CDN provider.

superuser2 11y ago

Security software is a band-aid on vulnerable software and users installing things they shouldn't. Part of the OSX security strategy is to minimize users installing things they shouldn't by making it difficult (enforced code signing, confirmations when opening an unsigned or new application). The other side is minimizing attack surface for exploits by staying up-to-date, not shipping crap like Java unless the user explicitly needs it, and (increasingly) sandboxing applications to user-approved subsets of the filesystem. Bolt-on detection and resolution of malware infections is just not a part of the OSX security ecosystem like it is with Windows. Little Snitch can help give you a picture of what's going on with regard to your network card, but at the end of the day malware can usually hide its traffic in an otherwise-trusted application to avoid that sort of detection.

mey 11y ago
I believe in defense in depth. There is always going to be an escape. Within the last month there has been several different privilege escalations possible in OSX. While I appreciate OSX having a strong security model, secondary solutions are desirable too me.
- AdieuToLogic 11y ago
  > I believe in defense in depth. ... While I appreciate OSX having a strong security model, secondary solutions are desirable too me. You might want to check out mtree(8) then. It's serves well as the FreeBSD/OS-X Tripwire[1] equivalent. 1 - http://www.tripwire.com http://www.tripwire.com

r618 11y ago

for preventive and (post)forensic measures see https://objective-see.com/ https://objective-see.com/

code_sterling 11y ago

Remove/Do not install Flash and Java, and make sure that Gatekeeper is at the middle setting. Turn your Firewall on regardless, and/or monitor your network activity. If you know what a packet is, then Little Snitch, if you don't Radio Silence is what I set my parents up with.

georgerobinson 11y ago

It still pains me that OSX ships with the firewall disabled by default. I don't think its reasonable to presume that every OSX device will be on a private network behind a NAT, and that everyone else will know to turn their firewall on. However, this appears to be the assumption Apple are making! You can do better!

donkeyd 11y ago

Eset now has security software for Mac. They were always my go to products on Windows.

noondip 11y ago
There really is no good anti-virus software for Macs at the moment. Have a look at recent vulnerabilities in ESET and Sophos, for example: http://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html http://googleprojectzero.blogspot.com/2015/06/analysis-and-e... https://lock.cmpxchg8b.com/sophailv2.pdf https://lock.cmpxchg8b.com/sophailv2.pdf

j-pb 11y ago

Security software (virus scanners e.t.c.) is snake oil. The code required for them to do their thing is so intrusive into the operating system that it has serious effects on stability. And they are not that effective anyhow. Since they won't be able to detect exploits in existing programs over authorised channels.

arca_vorago 11y ago

After spending quite some time deliberating on this, and not wanting my users in the wild without something, I finally settled on Bitdefender. I control clients from the cloud console, can push policies, run scans, updates, all without user interaction. Right now I'm only using the AV part for most devices though, as enabling the full package of internet firewall and website scanning was eating up lots of resources. The two follow up contenders were ESET and Kaspersky.

JonnieCache 11y ago

TCPBlock is a free version of little snitch. It's apparently abandoned, but it doesn't need any more features. http://www.macupdate.com/app/mac/35914/tcpblock http://www.macupdate.com/app/mac/35914/tcpblock You can set it up to disallow all network traffic until you whitelist the binary. Not sure if it's actually hashing them or just checking the path though.