3 ms·

Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, fo

Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.

js2 9y ago
Which is its own attack vector: https://news.ycombinator.com/item?id=14296959 https://news.ycombinator.com/item?id=14296959
- ecma_horse 9y ago
  The problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing. If the user is about to execute a malicious file anyway, then scanning it before only adds protection.
  - danieldk 9y ago
    The problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.
hRrrm1 9y ago
"scan everything before opening" is not always desirable as it exposes a large attack surface: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- AlexCoventry 9y ago
  "Avoid running your scan with elevated privileges" could have greatly mitigated this failure. > NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.
aeontech 9y ago
There is XProtect that warns people about known malware - https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works/ https://www.howtogeek.com/217043/xprotect-explained-how-your... There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves). There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.
pfranz 9y ago
Mac OS X Snow Leopard and malware detection https://support.apple.com/en-us/HT202234 https://support.apple.com/en-us/HT202234 Surprised I hadn't heard if this kicked in for Handbrake, but Apple maintains a list of malware (I assume by file hash?). I remember when this went into the OS because there were concerns about legit software being blacklisted.
- kalleboo 9y ago
  Yes Apple has blacklisted the new malware in XProtect.

js2 9y ago

Which is its own attack vector: https://news.ycombinator.com/item?id=14296959 https://news.ycombinator.com/item?id=14296959

ecma_horse 9y ago
The problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing. If the user is about to execute a malicious file anyway, then scanning it before only adds protection.
- danieldk 9y ago
  The problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.

hRrrm1 9y ago

"scan everything before opening" is not always desirable as it exposes a large attack surface: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

AlexCoventry 9y ago
"Avoid running your scan with elevated privileges" could have greatly mitigated this failure. > NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.

aeontech 9y ago

There is XProtect that warns people about known malware - https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works/ https://www.howtogeek.com/217043/xprotect-explained-how-your... There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves). There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.

pfranz 9y ago

Mac OS X Snow Leopard and malware detection https://support.apple.com/en-us/HT202234 https://support.apple.com/en-us/HT202234 Surprised I hadn't heard if this kicked in for Handbrake, but Apple maintains a list of malware (I assume by file hash?). I remember when this went into the OS because there were concerns about legit software being blacklisted.

kalleboo 9y ago
Yes Apple has blacklisted the new malware in XProtect.