4 ms·

On OSX. I don't use an AV. In fact, I've visited known virus sites for the heck of it or plugged in infected USBs from Windows users to help clean it/recove

by pcr0 11y ago

On OSX. I don't use an AV. In fact, I've visited known virus sites for the heck of it or plugged in infected USBs from Windows users to help clean it/recover data. Nothing has happened to me, and it's been 2 years. People keep harping on about the fact that viruses for OSX do exist. I don't dispute that. But realistically, outside of virus labs and white hat conferences, has anyone experienced or witnessed a Mac virus in the wild? Ditto the above question to any other *nix users as well.

zajd 11y ago
Do you use any sort of adblocker?
- pcr0 11y ago
  As far as I can remember, yes. I started out with AdBlock Plus, switched to AdBlock, and now I'm using uBlock. I guess that rules out browser-based exploits doesn't it? Since the browser is one of the few ways where attackers can automatically detect your system and deliver an OS-specific virus.
  - zajd 11y ago
    I'd imagine that using an adblock decreases your chances of being exposed to a virus by an order of magnitude. (That being said, I have never seen an OSX virus in the wild)
    - pcr0 11y ago
      I just googled it, actually. The top result was [Flashback](https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback). Infected 600k at its height, but as of Jan 2014, there were only about 20k infected computers. It redirected users to a compromised site, which used JS to load a Java applet containing an exploit that was already patched in the official Java, but not in the default version that comes pre-installed on Macs. The applet tricked you into installing "Flash" on your system. - Adblock would've stopped the JS from executing in the first place - We'd definitely have the latest Java versions - I uninstalled Flash ages ago, and use Chrome's built in player instead, and certainly wouldn't install it from a site that isn't Adobe Apple themselves have learnt from the incident, and have been speeding up Mac releases of pre-installed software since then. The possible attack vectors against modestly capable Mac users are quite low..I simply don't see it happening. Unless I'm being targeted by institutional/state hackers. In which case I doubt AV would do much good. Social engineering and poor passwords are likely to be a much bigger threat than malware.
teh_klev 11y ago
> Nothing has happened to me, and it's been 2 years. How do you know? Modern day viruses and root kits go out of their way to make things look "business as usual"
- thaumaturgy 11y ago
  That's not true in the majority of cases, although it's possible that our experiences are being distorted by the fact that users don't tend to bring their machines in until they're nearly unusable. But of those infected systems, we see relatively few that have truly sneaky, invisible-to-the-user malware. Far more that's just a gigantic pain in the ass to remove as it's hooked into everything in order to display ads at the user or rewrite links or shoddy code has destroyed one or more browser or OS components.
  - ramtatatam 11y ago
    You have very high regard of yourself (not saying it's wrong :-] ) On my VPS's I always assume I was already compromised. I never trust my system in current state until I do all the checks including analysis of my logs. I have automated this into certain level but you can never know :-) People I work with used to say that it is only a matter of time somebody will try something you have not thought about - to be prepared for such situations is the key. But that's just my private opinion.
thaumaturgy 11y ago
> ...has anyone experienced or witnessed a Mac virus in the wild? Yes, my shop has had several legit malware removals for Macs, most of them were either Mackeeper or Genieo (or its variants), which was probably installed beginning with a malicious ad on some site the user was visiting. (I'm not disputing that the situation for Mac users is still significantly better than for Windows users though.)
- snurk 11y ago
  The question asked about viruses, not malware.
  - thaumaturgy 11y ago
    The two terms are synonymous at this point. If you want to be that pedantic, I think you'd find that a Windows virus hasn't been seen in the wild in a long time either.

by pcr0 11y ago

zajd 11y ago

Do you use any sort of adblocker?

pcr0 11y ago
As far as I can remember, yes. I started out with AdBlock Plus, switched to AdBlock, and now I'm using uBlock. I guess that rules out browser-based exploits doesn't it? Since the browser is one of the few ways where attackers can automatically detect your system and deliver an OS-specific virus.
- zajd 11y ago
  I'd imagine that using an adblock decreases your chances of being exposed to a virus by an order of magnitude. (That being said, I have never seen an OSX virus in the wild)
  - pcr0 11y ago
    I just googled it, actually. The top result was [Flashback](https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback https://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback). Infected 600k at its height, but as of Jan 2014, there were only about 20k infected computers. It redirected users to a compromised site, which used JS to load a Java applet containing an exploit that was already patched in the official Java, but not in the default version that comes pre-installed on Macs. The applet tricked you into installing "Flash" on your system. - Adblock would've stopped the JS from executing in the first place - We'd definitely have the latest Java versions - I uninstalled Flash ages ago, and use Chrome's built in player instead, and certainly wouldn't install it from a site that isn't Adobe Apple themselves have learnt from the incident, and have been speeding up Mac releases of pre-installed software since then. The possible attack vectors against modestly capable Mac users are quite low..I simply don't see it happening. Unless I'm being targeted by institutional/state hackers. In which case I doubt AV would do much good. Social engineering and poor passwords are likely to be a much bigger threat than malware.

teh_klev 11y ago

> Nothing has happened to me, and it's been 2 years. How do you know? Modern day viruses and root kits go out of their way to make things look "business as usual"

thaumaturgy 11y ago
That's not true in the majority of cases, although it's possible that our experiences are being distorted by the fact that users don't tend to bring their machines in until they're nearly unusable. But of those infected systems, we see relatively few that have truly sneaky, invisible-to-the-user malware. Far more that's just a gigantic pain in the ass to remove as it's hooked into everything in order to display ads at the user or rewrite links or shoddy code has destroyed one or more browser or OS components.
- ramtatatam 11y ago
  You have very high regard of yourself (not saying it's wrong :-] ) On my VPS's I always assume I was already compromised. I never trust my system in current state until I do all the checks including analysis of my logs. I have automated this into certain level but you can never know :-) People I work with used to say that it is only a matter of time somebody will try something you have not thought about - to be prepared for such situations is the key. But that's just my private opinion.

thaumaturgy 11y ago

> ...has anyone experienced or witnessed a Mac virus in the wild? Yes, my shop has had several legit malware removals for Macs, most of them were either Mackeeper or Genieo (or its variants), which was probably installed beginning with a malicious ad on some site the user was visiting. (I'm not disputing that the situation for Mac users is still significantly better than for Windows users though.)

snurk 11y ago
The question asked about viruses, not malware.
- thaumaturgy 11y ago
  The two terms are synonymous at this point. If you want to be that pedantic, I think you'd find that a Windows virus hasn't been seen in the wild in a long time either.