8 ms·

I use a Mac for work and personal, and I feel like I take the reasonable precautions to avoid malware/ransomware/spyware/*ware (ex. prefer the App Store when po

I use a Mac for work and personal, and I feel like I take the reasonable precautions to avoid malware/ransomware/spyware/*ware (ex. prefer the App Store when possible, only download stuff from trusted sources, etc.) What more can I do to be safe? In 2017, is it recommended to use some kind of antivirus on a Mac? I've always been told it's unnecessary, but it seems like nefarious software is becoming more commonplace on the Mac.

cuckcuckspruce 9y ago
Regular backups with the drive disconnected from your machine when you're not backing up or restoring and a second (or more if you're paranoid) drive somewhere else entirely in case your house burns down. The best free options here are jwz's method[1] and Time Machine. Ransomware can't encrypt files that it can't access because the drive is disconnected, and by having a spare somewhere else (updated once a month or so) you prevent yourself from losing everything if you don't notice the malware and it eats your local backup drive. I use Little Snitch configured in Silent mode to Deny All and then I allow only the things I want to go outbound out of my machine (though I do let my machine talk to my home network freely). You might want to consider that. I also use Avast's free antivirus for the Mac, but with the Email and Web shields off. I find that overkill when I have the File shield (real-time protection on file access) already enabled. [1] http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html (Edit: fixed the referrer to the jwz page)
- sbov 9y ago
  Note that links to jwz.org from HN results in a not very nice, not safe for work, image.
  - cuckcuckspruce 9y ago
    Thanks. I have fixed that.
- Symbiote 9y ago
  Your link redirects to a picture of a scrotum in an eggcup. Try this instead: http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html
  - geekamongus 9y ago
    I wish I had read this before I clicked that link. Fuck.
  - cuckcuckspruce 9y ago
    Sorry, I was not aware that happened. I'd like to say that it was completely unexpected, but I guess I can understand that that as a result of jwz's accounts of working at Netscape being flogged by VCs as way of duping young and naive engineers into sacrificing their youth and hard work on the altar of uncertain reward.
    - digi_owl 9y ago
      He seems to have a strong dislike for HN in general...
mtkd 9y ago
we've an air gapped one for the kids every month I have to go in and clean it up - Malwarebytes gets rid of most of the browser trub - to the point Chrome is usable again they are casual browsers - something is very wrong when kids can render a Chrome install unusable after an hour or so of clicking flashy things
- _jtrig 9y ago
  Why not just wipe the comp/reinstall the browser? Seems easier and safer. Also get them on ublock so they cant click dangerous ads..
- fredsir 9y ago
  Tried using Safari instead? Might make a difference?
- pmontra 9y ago
  Out of curiosity, do you ever browse with your kids and keep teaching them what to click, what not and why? I assume that it can't make them completely safe, but it should eventually bring them near to it. If you're doing it, what's your experience with that and where do you think the malware is still coming from?
  - mtkd 9y ago
    it comes, mostly, from the online game sites and other shiny honeypots for kids - google "X game" click top link - the game sites themselves override Chrome search bar and home page etc. - they click yes and put an email in to every single prompt to get to the game it's completely and utterly broken
- cuckcuckspruce 9y ago
  How is a machine with a network connection 'airgapped'?
  - jakeva 9y ago
    Not op but my reading was that it is airgapped from the other machines in the household, possibly on a secondary network interface. ¯\_(ツ)_/¯
DINKDINK 9y ago
>In 2017, is it recommended to use some kind of antivirus on a Mac?I've always been told it's unnecessary AV-Comparatives[1] puts out a pretty comprehensive, quantifiedm real world benchmark of antivirus comparisons that they update every month for Windows (a more dynamic threat environment) and once a year for Mac[2]. Let's take a best case scenario (which isn't likely) that there are _no_ security vulnerabilities in any software on macOS. You still have the issue of being an accessory to spread malware to Windows machines if you aren't screening for them. "Oh hey boss, include this file in the Windows deployment of our software". A biological equivalent would be, even if you are an asymptomatic carrier[3] (macOS claim) you can still transmit the disease to someone else, therefore should limit transmission through condom use, gloves, general precautions (run an antivirus) A final point to add is one regarding risk engineering. The decision to increase the robustness of a design is not governed by the probability of the event (Mac's hardly ever get infected!), it is governed by the magnitude of the effect of the event. Even if the probability of malware on a Mac is low[4] if the effect of the infection is catastrophic (your entire business is destroyed) you should be increase the systems robustness to threats. [1] https://www.av-comparatives.org/about-us/ https://www.av-comparatives.org/about-us/ AV-Comparatives is an independent organization offering systematic testing that checks whether security software, such as PC/Mac-based antivirus products and mobile security solutions, lives up to its promises. Using one of the largest sample collections worldwide, it creates a real-world environment for truly accurate testing. AV-Comparatives offers freely accessible results to individuals, news organizations and scientific institutions. Certification by AV-Comparatives provides an official seal of approval for software performance which is globally recognized. Currently, AV-Comparatives' Real-World Protection Test is the most comprehensive and complex test available when it comes to evaluating the real-life protection capabilities of antivirus software. Put simply, the test framework replicates the scenario of an everyday user in an everyday online environment – the typical situation that most of us experience when using a computer with an Internet connection. AV-Comparatives works closely with several academic institutions, especially the University of Innsbruck’s Department of Computer Science, to provide scientific testing methods. [2] https://www.av-comparatives.org/wp-content/uploads/2016/07/avc_mac_2016_en.pdf https://www.av-comparatives.org/wp-content/uploads/2016/07/a... [3] https://en.wikipedia.org/wiki/Asymptomatic_carrier https://en.wikipedia.org/wiki/Asymptomatic_carrier [4] http://www.thesafemac.com/mmg-catalog/ http://www.thesafemac.com/mmg-catalog/ https://en.wikipedia.org/wiki/MacOS_malware https://en.wikipedia.org/wiki/MacOS_malware
Razengan 9y ago
> What more can I do to be safe? • Work from an standard (non-admin) user account. • Review the settings in System Preferences » Security & Privacy and pick a reasonable ground between convenience and security. • At the very least, "Require an administrator password to access system-wide preferences" (found under the "Advanced..." button.) • Be wary of any third-party app that asks for an administrator password, and try to see if it runs after denying the prompt. Dropbox, for example, seems to work fine even if I cancel its second (after installation) admin prompt. (There were news about it faking the prompt and storing your macOS password [2] for automatic updates...) • You may want to tighten the firewall settings, and/or consider Little Snitch [3]. • If you have to install something from a .pkg file, which can autorun scripts, try to review the .pkg and its scripts with Pacifist [0] first. It may be possible to just extract the payload with Pacifist and run the app just fine without "installing" the .pkg. • Make regular backups. Automatic (e.g. Time Machine) AND manual (of your most important stuff at least.) • Don’t use the same passwords for different things. • Enable multi-factor authentication on as many services as you can. • Visit dodgy websites in private browsing mode, or a secondary, locked-down browser like Tor [1]. • If you can't help downloading pirated/"cracked" apps or games, try to run them from a different user account. • If concerned about outright theft of your Mac, enable FileVault full disk encryption, and set a firmware password. [4] • Whenever you're bored or something is acting janky, check the usual places where third-party processes can install themselves and hook into your system: - System Preferences » Security & Privacy » Privacy » Accessibility - System Preferences » Users & Groups » Login Items - /System/Library/LaunchAgents, /System/Library/LaunchDaemons, /System/Library/StartupItems - /Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems, /Library/Internet Plug-Ins - Check for 3rd-party kernel extensions: kextstat -kl | awk ' !/apple/ { print $6 $7 } ' • Oh and before you paste any command/script (like the above) from the internet into your terminal, see the man page for each command and its arguments first. :) ---- I've used Macs without an antivirus since 2012 and I haven't been hit by malware yet... I think. :) [0] http://www.charlessoft.com http://www.charlessoft.com [1] https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en [2] https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338 (How Dropbox Hacks Your Mac) [3] https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html [4] https://support.apple.com/en-us/HT204455 https://support.apple.com/en-us/HT204455
jorvi 9y ago
If you seek a heuristic way to prevent ransomware on Mac, RansomWhere[1] by Objective-See is awesome and free of charge. It constantly monitors the file system, and if it sees a sudden burst of encryption, will freeze the concerning process. Yes, you'll 'lose' at least a few files, but major loss is prevented. Obviously, you'll need to turn it temporarily off if you want to do any legit encryption. [1] https://objective-see.com/products/ransomwhere.html https://objective-see.com/products/ransomwhere.html
- chmars 9y ago
  I got too many false positives due to backup software and had to remove the tool.
  - jorvi 9y ago
    That's weird, you should only have to `allow` your backup tool once. From the site: * allow Tells RansomWhere it's ok to let the process continue running. This will be persistently remembered; you'll never be alerted about this binary again.
mayoff 9y ago
Use a cloud-based backup service like BackBlaze or CrashPlan that saves old versions of your files. Since these backups are not connected like regular read-write hard drives, there should be no way for the ransomware to encrypt or delete the old versions.
- tomashertus 9y ago
  I really discourage from using CrashPlan. I have had very bad experience with that app. It was constantly crushing and overused HW resources.
  - valuearb 9y ago
    I've used it for years with no problems. But I've never had to restore anything yet, knock on wood.
- y04nn 9y ago
  Hopefully most mac users backup their files with Time Machine, easy to use and that would probably defeat the ransomware.
  - markdown 9y ago
    > probably Not the best attitude to have when it comes to backups.
- ralfd 9y ago
  This is it. The paranoid list/methods in the sibling comment by Razengan is good, but you cripple and annoy yourself (no admin account etc).
- lostlogin 9y ago
  Turn off iCloud storage though. Holy crap it messed with my Back Blaze stuff when the documents folder all went to the cloud and got deleted off the local drive. As easy as that sounds to fix, it isn't. What a terrible default option for an OS update.

cuckcuckspruce 9y ago

Regular backups with the drive disconnected from your machine when you're not backing up or restoring and a second (or more if you're paranoid) drive somewhere else entirely in case your house burns down. The best free options here are jwz's method[1] and Time Machine. Ransomware can't encrypt files that it can't access because the drive is disconnected, and by having a spare somewhere else (updated once a month or so) you prevent yourself from losing everything if you don't notice the malware and it eats your local backup drive. I use Little Snitch configured in Silent mode to Deny All and then I allow only the things I want to go outbound out of my machine (though I do let my machine talk to my home network freely). You might want to consider that. I also use Avast's free antivirus for the Mac, but with the Email and Web shields off. I find that overkill when I have the File shield (real-time protection on file access) already enabled. [1] http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html (Edit: fixed the referrer to the jwz page)

sbov 9y ago
Note that links to jwz.org from HN results in a not very nice, not safe for work, image.
- cuckcuckspruce 9y ago
  Thanks. I have fixed that.
Symbiote 9y ago
Your link redirects to a picture of a scrotum in an eggcup. Try this instead: http://nullrefer.com/?https://www.jwz.org/doc/backups.html http://nullrefer.com/?https://www.jwz.org/doc/backups.html
- geekamongus 9y ago
  I wish I had read this before I clicked that link. Fuck.
- cuckcuckspruce 9y ago
  Sorry, I was not aware that happened. I'd like to say that it was completely unexpected, but I guess I can understand that that as a result of jwz's accounts of working at Netscape being flogged by VCs as way of duping young and naive engineers into sacrificing their youth and hard work on the altar of uncertain reward.
  - digi_owl 9y ago
    He seems to have a strong dislike for HN in general...

mtkd 9y ago

we've an air gapped one for the kids every month I have to go in and clean it up - Malwarebytes gets rid of most of the browser trub - to the point Chrome is usable again they are casual browsers - something is very wrong when kids can render a Chrome install unusable after an hour or so of clicking flashy things

_jtrig 9y ago
Why not just wipe the comp/reinstall the browser? Seems easier and safer. Also get them on ublock so they cant click dangerous ads..
fredsir 9y ago
Tried using Safari instead? Might make a difference?
pmontra 9y ago
Out of curiosity, do you ever browse with your kids and keep teaching them what to click, what not and why? I assume that it can't make them completely safe, but it should eventually bring them near to it. If you're doing it, what's your experience with that and where do you think the malware is still coming from?
- mtkd 9y ago
  it comes, mostly, from the online game sites and other shiny honeypots for kids - google "X game" click top link - the game sites themselves override Chrome search bar and home page etc. - they click yes and put an email in to every single prompt to get to the game it's completely and utterly broken
cuckcuckspruce 9y ago
How is a machine with a network connection 'airgapped'?
- jakeva 9y ago
  Not op but my reading was that it is airgapped from the other machines in the household, possibly on a secondary network interface. ¯\_(ツ)_/¯

DINKDINK 9y ago

>In 2017, is it recommended to use some kind of antivirus on a Mac?I've always been told it's unnecessary AV-Comparatives[1] puts out a pretty comprehensive, quantifiedm real world benchmark of antivirus comparisons that they update every month for Windows (a more dynamic threat environment) and once a year for Mac[2]. Let's take a best case scenario (which isn't likely) that there are _no_ security vulnerabilities in any software on macOS. You still have the issue of being an accessory to spread malware to Windows machines if you aren't screening for them. "Oh hey boss, include this file in the Windows deployment of our software". A biological equivalent would be, even if you are an asymptomatic carrier[3] (macOS claim) you can still transmit the disease to someone else, therefore should limit transmission through condom use, gloves, general precautions (run an antivirus) A final point to add is one regarding risk engineering. The decision to increase the robustness of a design is not governed by the probability of the event (Mac's hardly ever get infected!), it is governed by the magnitude of the effect of the event. Even if the probability of malware on a Mac is low[4] if the effect of the infection is catastrophic (your entire business is destroyed) you should be increase the systems robustness to threats. [1] https://www.av-comparatives.org/about-us/ https://www.av-comparatives.org/about-us/ AV-Comparatives is an independent organization offering systematic testing that checks whether security software, such as PC/Mac-based antivirus products and mobile security solutions, lives up to its promises. Using one of the largest sample collections worldwide, it creates a real-world environment for truly accurate testing. AV-Comparatives offers freely accessible results to individuals, news organizations and scientific institutions. Certification by AV-Comparatives provides an official seal of approval for software performance which is globally recognized. Currently, AV-Comparatives' Real-World Protection Test is the most comprehensive and complex test available when it comes to evaluating the real-life protection capabilities of antivirus software. Put simply, the test framework replicates the scenario of an everyday user in an everyday online environment – the typical situation that most of us experience when using a computer with an Internet connection. AV-Comparatives works closely with several academic institutions, especially the University of Innsbruck’s Department of Computer Science, to provide scientific testing methods. [2] https://www.av-comparatives.org/wp-content/uploads/2016/07/avc_mac_2016_en.pdf https://www.av-comparatives.org/wp-content/uploads/2016/07/a... [3] https://en.wikipedia.org/wiki/Asymptomatic_carrier https://en.wikipedia.org/wiki/Asymptomatic_carrier [4] http://www.thesafemac.com/mmg-catalog/ http://www.thesafemac.com/mmg-catalog/ https://en.wikipedia.org/wiki/MacOS_malware https://en.wikipedia.org/wiki/MacOS_malware

Razengan 9y ago

> What more can I do to be safe? • Work from an standard (non-admin) user account. • Review the settings in System Preferences » Security & Privacy and pick a reasonable ground between convenience and security. • At the very least, "Require an administrator password to access system-wide preferences" (found under the "Advanced..." button.) • Be wary of any third-party app that asks for an administrator password, and try to see if it runs after denying the prompt. Dropbox, for example, seems to work fine even if I cancel its second (after installation) admin prompt. (There were news about it faking the prompt and storing your macOS password [2] for automatic updates...) • You may want to tighten the firewall settings, and/or consider Little Snitch [3]. • If you have to install something from a .pkg file, which can autorun scripts, try to review the .pkg and its scripts with Pacifist [0] first. It may be possible to just extract the payload with Pacifist and run the app just fine without "installing" the .pkg. • Make regular backups. Automatic (e.g. Time Machine) AND manual (of your most important stuff at least.) • Don’t use the same passwords for different things. • Enable multi-factor authentication on as many services as you can. • Visit dodgy websites in private browsing mode, or a secondary, locked-down browser like Tor [1]. • If you can't help downloading pirated/"cracked" apps or games, try to run them from a different user account. • If concerned about outright theft of your Mac, enable FileVault full disk encryption, and set a firmware password. [4] • Whenever you're bored or something is acting janky, check the usual places where third-party processes can install themselves and hook into your system: - System Preferences » Security & Privacy » Privacy » Accessibility - System Preferences » Users & Groups » Login Items - /System/Library/LaunchAgents, /System/Library/LaunchDaemons, /System/Library/StartupItems - /Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems, /Library/Internet Plug-Ins - Check for 3rd-party kernel extensions: kextstat -kl | awk ' !/apple/ { print $6 $7 } ' • Oh and before you paste any command/script (like the above) from the internet into your terminal, see the man page for each command and its arguments first. :) ---- I've used Macs without an antivirus since 2012 and I haven't been hit by malware yet... I think. :) [0] http://www.charlessoft.com http://www.charlessoft.com [1] https://www.torproject.org/projects/torbrowser.html.en https://www.torproject.org/projects/torbrowser.html.en [2] https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338 (How Dropbox Hacks Your Mac) [3] https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html [4] https://support.apple.com/en-us/HT204455 https://support.apple.com/en-us/HT204455

jorvi 9y ago

If you seek a heuristic way to prevent ransomware on Mac, RansomWhere[1] by Objective-See is awesome and free of charge. It constantly monitors the file system, and if it sees a sudden burst of encryption, will freeze the concerning process. Yes, you'll 'lose' at least a few files, but major loss is prevented. Obviously, you'll need to turn it temporarily off if you want to do any legit encryption. [1] https://objective-see.com/products/ransomwhere.html https://objective-see.com/products/ransomwhere.html

chmars 9y ago
I got too many false positives due to backup software and had to remove the tool.
- jorvi 9y ago
  That's weird, you should only have to `allow` your backup tool once. From the site: * allow Tells RansomWhere it's ok to let the process continue running. This will be persistently remembered; you'll never be alerted about this binary again.

mayoff 9y ago

Use a cloud-based backup service like BackBlaze or CrashPlan that saves old versions of your files. Since these backups are not connected like regular read-write hard drives, there should be no way for the ransomware to encrypt or delete the old versions.

tomashertus 9y ago
I really discourage from using CrashPlan. I have had very bad experience with that app. It was constantly crushing and overused HW resources.
- valuearb 9y ago
  I've used it for years with no problems. But I've never had to restore anything yet, knock on wood.
y04nn 9y ago
Hopefully most mac users backup their files with Time Machine, easy to use and that would probably defeat the ransomware.
- markdown 9y ago
  > probably Not the best attitude to have when it comes to backups.
ralfd 9y ago
This is it. The paranoid list/methods in the sibling comment by Razengan is good, but you cripple and annoy yourself (no admin account etc).
lostlogin 9y ago
Turn off iCloud storage though. Holy crap it messed with my Back Blaze stuff when the documents folder all went to the cloud and got deleted off the local drive. As easy as that sounds to fix, it isn't. What a terrible default option for an OS update.