9 ms·
Microsoft Defender Comes to the Mac
- out_of_protocol 8y ago* Will silently install Windows 10 in meantime
- saagarjha 8y agoMac users cringe worldwide as they anticipate overzealous IT departments mandating that they install this on their computers. Serious, though: why does this exist? What does it protect Macs from? There are only a handful of things that actually target macOS, and XProtect flags most of them pretty quickly…
- kiwijamo 8y agoMy ${dayjob}’s IT department installs security software from Symantec onto the Macs in our organisation. If they swap that out for the new Microsoft tool in the article that might be a net benefit.
- qlm 8y agoSame, and Symantec is hot garbage that eats CPU and battery for no real benefit.
- misnome 8y agoOh yes, our IT has mandated it installed on our (oldish) build server. That went about as well as you can imagine, with all the file access.
- swarnie_ 8y agoHaving enacted similar policies before i can say with some certainty your IT department don't actually care. They're most likely trying to fill out a checkbox on some compliance/tender document from a decade ago.
- mey 8y agoIt's useful for enterprise customers. It's more advanced than XProtect.
- jasonvorhe 8y agoHow? XProtect prevents execution of known binaries based on checksums without impacting system performance. How could anything be more effective?
- mey 8y agoMy understanding is XProtect works off signatures and only for data coming in from certain pathways (registered quarantine agents, chrome/safari etc). This doesn't protect against using a vulnerability in an app (chrome/safari) to trigger another process to download a malicious payload. Being signature based instead of behavior based limits it's ability to detect evolving attacks. The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-gatekeeper/ https://www.sentinelone.com/blog/how-malware-bypass-macos-ga...
- llampx 8y agoI've had security software from Bitdefender installed on my office Mac. This would probably be an improvement.
- h2onock 8y agoI run BitDefender on my mac from time to time and it has found and removed files from time-to-time.
- yorwba 8y agoAnd what kind of files were those? Not everything flagged by an antivirus is guaranteed to be malware.
- sofaofthedamned 8y agoProbably EICAR
- spacehunt 8y agoSome cyber-liability insurance policies mandate the use of "industrial-grade" antivirus, whatever that means.
- sjwright 8y agoI've seen some computers used in an industrial setting and their grade of anti-virus was some version of McAfee from 2005.
- rubyfan 8y agoThat was my reaction. Microsoft is smart to capitalize on overzealous IT Security departments though. There’s a lot of money to be made in the gradual extinction of Windows. I’m surprised they didn’t go for Android though.
- paride5745 8y ago> I’m surprised they didn’t go for Android though. Just wait...
- anoncake 8y agoMaybe it exists so people think Mac OS is insecure?
- RobLach 8y agoSome contracts end up having clauses that require anti virus software to be used, sometimes on every networked system, which means that they need to load up /something/ to check that box.
- setquk 8y agoBet it contains telemetry!
- saagarjha 8y ago> Microsoft realized that it could use all of the billions of signals it gets from its users to better help its customers proactively. I mean, I can't think of a different interpretation of this line…
- nindalf 8y agoHow does a forum mostly made of software engineers hate opt-out telemetry so much? How do you know how well your software is doing in the wild without knowing about 1) Crashes with stack traces 2) which features actually get clicked on. How do you make decisions without this information? Example - Mozilla is going to remove support for TLS 1.0 and 1.1 [1]. A good change, we can all agree. But what if half their user base was relying on this feature? Can they still remove it? Should they commission a user survey asking everyday users about TLS? Fortunately, they have telemetry that tells them that only 1.2% of all connections are made with these versions of TLS. Cool, this change can go ahead. If you were in charge at Mozilla and you don't want to collect opt-out telemetry, please tell me how you would have made the TLS decision. Literally what are you scared of that telemetry will send? If you're so concerned about it, why don't you just opt out? [1] - https://blog.mozilla.org/security/2018/10/15/removing-old-versions-of-tls/ https://blog.mozilla.org/security/2018/10/15/removing-old-ve...
- spiderfarmer 8y agoI always thought the fear was mostly that companies were spying on their competitors by using 'telemetry' data that 'accidentally' contains a list of installed apps.
- chronogram 8y ago> How does a forum mostly made of software engineers hate opt-out telemetry so much? Perhaps you’re assuming too much. I’d class this forum more as a “tech enthusiast and startup” forum. A lot of software developers, a lot of hardware developers, and a lot of conscious users of both. I do agree with what you’re saying though. When I was doing open source things, I sometimes joked about how much easier it would be with some telemetry. One time, me and someone else spent a day of testing and not doing anything, while in the back of my mind I just wished I could look at a database to see the results from users. Then we all could’ve just made things better.
- chronogram 8y agoThis makes a lot of sense after putting 365 on the Mac App Store and perhaps builds on this: https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/New-labeling-capabilities-in-Office-apps-helps-you-protect/ba-p/325771 https://techcommunity.microsoft.com/t5/Security-Privacy-and-...
- stakhanov 8y agoGlad someone is finally doing something about there not being enough bloatware on the average Mac!
- SCdF 8y agoAny super smart threat people reading this? Does anti-virus matter anymore? I haven't installed one for years, on Windows, Mac or Linx (decades?), it's unclear if that is a mistake or not.
- h2onock 8y agoNo Anti-Virus on a Windows machine!? Are you a maniac!?
- zingmars 8y agoIt's not the 90's anymore, getting a virus is pretty hard. Hell, it wasn't really all that easy in the first place, unless you pirated or installed shady software from shady ads on shady websites.
- bluedino 8y agoNot really. Still happening every day with home users and corporate america. Botnets still have tens of millions of PC's and CryptoLocker is as common as ever.
- giancarlostoro 8y agoI dont either. As long as you limit what you download to open source and block ads (which were the main way I ever gog malware) you should mostly be safe. On Windows I leave only the default antivirus from Microsoft at least it will catch some stuff. Also with stuff like Steam and only downloading major games I should be fine. Most of my owned games atm are pretty old.
- setquk 8y agoI see it like this. If you're a single user, effective offline backups are probably a better investment. It's not that bad starting from scratch if you have all your data. It takes me about an hour to throw a usable build onto my laptop. However corporate networks where the damage has a big multiplier may benefit from it and you certainly don't want to be asked all sorts of questions about whether or not you had a risk mitigation in place if something does happen.
- bni 8y agoThis will be a great attack vector to get into corporate networks. Thanks! /Bob the evil hacker
- jeroenhd 8y agoIf Microsoft can make the Mac version perform as well as the Windows version, this is good news for Apple users. Apple's current attempt at antiviral software seems to be "prevent infection by making it tough to run malware" combined with a very simple signature based system. This approach works for people who k ow not to click strange links, but as long as people give their life savings away to scammers pretending to be the IRS or Microsoft, people will just open random software from the Internet as long as someone is telling them how to open the relevant executables. Linux is much the same way (are there even antivirus products for Linux other than ClamAV?) despite half the Internet running on mostly-unprotected Linux servers. However, due to the lack of signatures available on macOS viruses, I do wonder how effective MS Defender will be. There's various interpreters and shells available by default which make it easy to write an obfuscated virus script for OSX (python, Ruby, bash, and so on) which is not as relevant ik the Windows world. To the people who complain about "bloatware" being forced onto their machine: you're just as likely to get infected by a virus as the other techie people in your company running Windows or Linux. How can you blame your boss for wanting to prevent getting hacked? Apple's own AV is just not up to the task.
- soraminazuki 8y agoYou seem to assume that AV is a effective cure for people installing random software on the internet, but I have never seen proof that this is the case. Worse, there are many instances of poorly written AVs negatively impacting the security and performance of the system it’s supposed to protect.
- jeroenhd 8y agoIt's true AV software won't fix behaviour. However, plenty of software gets exploited. There was a news item a few years back when pirated versions of Xcode inserted malware into some iOS apps; several big software projects have had their servers hacked, serving malware through official download links. AV won't fix users wanting to launch pirated games or software from sketchy sources for example. However, it can fix malware placed on a system after an exploit. I have more faith into Microsoft and their Defender suite than any commercial AV vendor or Apple itself. Right now, people are using Sophos or McAfee or Bitdefender on corporate Apple devices; none of those have a good reputation with me. I'd strongly prefer Microsoft's AV solution over any existing macOS security suite. As for performance, any AV will cause some performance drops if you enable live scanning or during periodic scans. Having a macbook scan overnight does not cause an issue, having live scanning running during compilation will slaughter performance. The performance impact is up to how the AV is configured.
- Dinux 8y agoWe've used Windows Defender for Linux systems for quite some time (simply by allowing access to the remote filesystems) and we have been positively surprised that threats for Unix/Linux-only systems are caught just as fast, even though there is no official support outside of Windows thus far. However at the time almost all of the malware definitions are from other anti-virus companies and Microsoft happens to ship them via Windows Update. But this could have been changed by now. If Microsoft is serious about the 'user-centric' approach, which it seems more and more the case as opposed to just a cheap PR stunt, it might me a good move to opensource the whole Defender base and include some Linux users while their at it.
- ggm 8y agoMy ICT people made me install sophos on OSX. Even when disabled, the hooks it had into the VM and VFS layers intruided into my life and made other applications I depend on hang. Once I de-installed it, this behaviour stopped. The moral of the story is that an after-market security solution not designed by the core architects is very likely to be buggy. They don't understand things. They make bad assumptions. Windows Defender was designed by people who know windows. It works well on Windows because it respects the core architecture. If this defender is written in native OSX code, and obeys all the documented and un-documented OSX things, and if Apple staff commit to forwarding bug reports to Microsoft, it might work, one day, five or more years in the future. Until then, I suspect like Sophos, its going to crash my Mac. I feel like one of those curmudgeon memes with a "prove me wrong" sign on my desk at school.
- jeroenhd 8y agoBased on what I've read about the native "protection" macOS provides, there's no real alternative way to scan files on-access other than to place hooks. However, if you look at the performance on Windows, Windows Defender is one of the best scanners out there. While some sort of added bottleneck is inevitable (especially during workloads like compiling software or downloading thousands of small files (NPM/Composer/etc)), I wouldn't be surprised if regular users wouldn't notice such an extensive slowdown in their daily work. Perhaps to some extent the Windows and Mac version share a portion of their code, but at kernel level the Windows Defender system is simply incompatible with macOS. A redesign of the performance-limiting features is a necessity in this case, so I strongly doubt the "people who know Windows" were the ones that designed the kernel interface layer. Basically, expect small freezes during compilation, but not crashes.
- simongr3dal 8y agoMaybe it will at least stop normal people from installing mackeeper or similarily FUD-spreading bogus anti-virus software. It's a real pain to try and uninstall completely.
- mark_l_watson 8y agoI am going to try it. I like Office 365 on the macOS (and the web versions of Office apps for Linux) and unless I hear any negative reports I will try it out on my MacBook.
- jeffbax 8y agoMy gut tells me that XProtect, SIP, and only allowing software signed by Apple like is the default should be enough for most users to not worry. "Don't just type in your password" is something everyone using windows or Mac or Linux should be taught. Don't think I'd bother with this, but interested to see it play out. Maybe it'll have positive detection effects that feed back into XProtect
- butz 8y agoHow about just hardening macOS installation? https://blog.bejarano.io/hardening-macos.html https://blog.bejarano.io/hardening-macos.html