13 ms·
Apple Mac computers targeted by ransomware and spyware
- xutopia 9y agoThis is an argument for only installing things from the App Store. I told my parents only to install from there and we never had a problem.
- lisper 9y agoJust because you never had a problem doesn't mean you never will. Past performance is no guarantee of future results, and in fact it would be trivial to get a malware-infected app into the app store because the review process does not look at the source code (and even if it did it's not hard to obfuscate malware).
- dep_b 9y agoAppStore applications are more sandboxed than regular side loaded applications. You need to request quite a lot of permissions up front before it can actually do some harm and requesting those permissions will lead to more scrutiny on the side of the reviewer. That said it's still easier to get something in the AppStore that really wreaks havoc on your machine compared to the iOS AppStore where developers being used to a completely free reign over the machine never was a thing to begin with.
- stcredzero 9y agoThe problem with the App Store, is that the software most likely to have an issue with the sandboxing is often the software that's more critical in terms of security. Such software may not be security software but still have more stringent needs in terms of security review. For example, layout managers might have hotkey functionality that could disguise key-logging.
- astrodust 9y agoYour typical "parents" are not the sort to need that sort of stuff. Those are profesional tools for people with specialized needs, and they can assess the risks of installing such things.
- zyb09 9y agoyeah very good argument. you never install anything from the command line or what?
- astrodust 9y agoWhat, like via brew?
- waynecochran 9y agoThere is practically zero information in this article.
- RubenSandwich 9y agoAgreed. The researcher's blog post is much more informative: https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-as-a-service https://blog.fortinet.com/2017/06/09/macransom-offered-as-ra....
- jgritty 9y agoThe information is in the links provided: https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service https://www.alienvault.com/blogs/labs-research/macspy-os-x-r... https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-as-a-service https://blog.fortinet.com/2017/06/09/macransom-offered-as-ra...
- thehardsphere 9y agoYeah. The TL;DR is "Two people wrote some ransomware for Mac and put it on _the dark web!_" Well, who really cares about that? That's not an especially novel thing to do. It's basically a drop of spit in the ocean. Someone wake me up when Mac malware goes viral because it's not entirely reliant on users making mistakes. Or if it uses some sort of vulnerability that I need to get patched.
- caseyohara 9y agoI use a Mac for work and personal, and I feel like I take the reasonable precautions to avoid malware/ransomware/spyware/*ware (ex. prefer the App Store when possible, only download stuff from trusted sources, etc.) What more can I do to be safe? In 2017, is it recommended to use some kind of antivirus on a Mac? I've always been told it's unnecessary, but it seems like nefarious software is becoming more commonplace on the Mac.
- cuckcuckspruce 9y agoRegular backups with the drive disconnected from your machine when you're not backing up or restoring and a second (or more if you're paranoid) drive somewhere else entirely in case your house burns down. The best free options here are jwz's method[1] and Time Machine. Ransomware can't encrypt files that it can't access because the drive is disconnected, and by having a spare somewhere else (updated once a month or so) you prevent yourself from losing everything if you don't notice the malware and it eats your local backup drive. I use Little Snitch configured in Silent mode to Deny All and then I allow only the things I want to go outbound out of my machine (though I do let my machine talk to my home network freely). You might want to consider that. I also use Avast's free antivirus for the Mac, but with the Email and Web shields off. I find that overkill when I have the File shield (real-time protection on file access) already enabled. [1] http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html (Edit: fixed the referrer to the jwz page)
- sbov 9y agoNote that links to jwz.org from HN results in a not very nice, not safe for work, image.
- cuckcuckspruce 9y agoThanks. I have fixed that.
- Symbiote 9y agoYour link redirects to a picture of a scrotum in an eggcup. Try this instead: http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html
- deleted 9y ago[deleted]
- admn2 9y agoWhat is the best virus scanner for Mac?
- rrdharan 9y agomacOS has a builtin malware scanner, XProtect: http://osxdaily.com/2017/05/01/check-xprotect-version-mac/ http://osxdaily.com/2017/05/01/check-xprotect-version-mac/ If you want additional protection, I believe your best option is Avast: http://www.tomsguide.com/us/best-antivirus,review-2588-6.html http://www.tomsguide.com/us/best-antivirus,review-2588-6.htm... https://www.avast.com/free-antivirus-download https://www.avast.com/free-antivirus-download
- DINKDINK 9y agoAV-Comparatives[1] puts out a pretty comprehensive, quantified real world benchmark of antivirus comparisons that they update every month for Windows (a more dynamic threat environment) and once a year for Mac[2]. [1] https://www.av-comparatives.org/about-us/ https://www.av-comparatives.org/about-us/ AV-Comparatives is an independent organization offering systematic testing that checks whether security software, such as PC/Mac-based antivirus products and mobile security solutions, lives up to its promises. Using one of the largest sample collections worldwide, it creates a real-world environment for truly accurate testing. AV-Comparatives offers freely accessible results to individuals, news organizations and scientific institutions. Certification by AV-Comparatives provides an official seal of approval for software performance which is globally recognized. Currently, AV-Comparatives' Real-World Protection Test is the most comprehensive and complex test available when it comes to evaluating the real-life protection capabilities of antivirus software. Put simply, the test framework replicates the scenario of an everyday user in an everyday online environment – the typical situation that most of us experience when using a computer with an Internet connection. AV-Comparatives works closely with several academic institutions, especially the University of Innsbruck’s Department of Computer Science, to provide scientific testing methods. [2] https://www.av-comparatives.org/wp-content/uploads/2016/07/avc_mac_2016_en.pdf https://www.av-comparatives.org/wp-content/uploads/2016/07/a...
- archvile 9y agoCommon Sense 2017. Snarkiness aside, you don't need an antivirus on your Mac. As long as you run as a non-admin user, enable a firmware password, and stay away from Adobe Flash, you are golden.
- metalliqaz 9y agoThat anyone bothered to orchestrate an attack like this on Apple products seems to say good things for Apple's business. Although at that same time it seems to cast doubt on Apple's perceived superiority on the security front. Oh well, I'll keep going with my preferred platform: Windows as a host for my browser and SSH to FreeBSD and Ubuntu servers.
- baldfat 9y ago> Apple's perceived superiority on the security front Still one of the biggest lies that Apple ever told. The very first I'm Mac I'm PC was 100% about how they are virus free OS. https://www.youtube.com/watch?v=qfv6Ah_MVJU https://www.youtube.com/watch?v=qfv6Ah_MVJU
- ralfd 9y agoHow was that a lie when the ad aired? The ad also doesn't make the claim, just that Mac can't get infected by thousands of Windows viruses.
- baldfat 9y agoIt doesn't say that it just says it's not an issue with Mac.
- digi_owl 9y agoFunny thing is that it may have been more true back before OSX than afterwards. According to Woz the early Mac's held so much of the OS in ROM that a malware could not get a solid foothold. That said, i have found Apple to be more of a marketing company dabbling in consumer electronics, than a computer company.
- scottmf 9y agoYou say that as though they don't make some of the best laptops out there.
- 9y ago
- Santosh83 9y agoWhy are we continuing to insist that incredibly complicated and unrestricted computing devices which served well a few million highly technical folk a few decades ago can equally smoothly well serve ~8 billion people of varied capacities and hues? At this point we need to accept that severely locked down and curated devices are the easiest and least painful road ahead for the majority of the world's citizens to participate in digital transactions, while unrestricted computing devices can used by those who are learning or specifically involved in technical tasks or are simply those who agree that they know what they're doing and the tradeoffs involved. Am not saying unrestricted devices should be banned. It's just that they should come with warnings on the box and an advisory to use locked devices if the intent is to simply buy it and mindlessly use it.
- digi_owl 9y agohttp://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html
- lallysingh 9y agoI liked the 'developer mode' switch on chromebooks for this. A switch (maybe a keylock that comes with the machine) that turns on/off admin access.
- btschaegg 9y agoI agree that the idea is really nice. The execution, however, still leaves a lot to be desired. The boot screen coming up each time if I put my machine into dev mode is something that really icks me. At least, I should be able to switch it off (without resorting to EFI hacks). Also, it's really easy to wipe your device on that screen if you accidentally press the space bar. If that one screen was a bit more configurable and the driver situation was a little bit better (less blobs/hacks), my ARM-based chromebook would be my daily driver by now.
- cm2187 9y agoSo what is going to be the unrestricted device? Looks like it won't running on Windows or MacOS which are going very quickly the locked down route. I would be happy if there was a good alternative.
- Medaber 9y agoOne premise of the article is wrong. It says "As Apple Mac Continues to Grow Market Share". In fact, Apple's Mac market share is declining: http://www.businessinsider.com/apple-mac-lost-most-pc-market-share-in-2016-chart-2017-1 http://www.businessinsider.com/apple-mac-lost-most-pc-market...
- mikeash 9y agoThis is an interesting tidbit: > However, they added, any files scrambled with the ransomware would be completely lost because it did a very poor job of handling the decryption keys needed to restore data. In past discussions of ransomware, the question is always asked: if you pay, how can you be sure you'll get your files back? The standard answer seems to be, of course you'll get your files back, the criminals want to keep a good reputation so you'll have the greatest incentive to pay, and they have no reason not to. I guess this shows one potential weakness of that idea. Criminals may not want to destroy your files, but might do so by accident.
- deleted 9y ago[deleted]