9 ms·

How do you know when macOS detects and remediates malware?

175 points by zdw 4y ago

post_break 4y ago
It makes me think of the Invincible meme, "that's the neat thing, you don't" with an asterisk. Kidding aside if you're somewhat competent with macs and you can read, little snitch should be the first piece of software you install on any mac. It's not malware protection but it does at least make you aware of stuff wanting to do weird crap on your computer.
- FatActor 4y ago
  I ran little snitch for about a week years ago and there were hundreds of thousands of requests just from typical apple services so trying to curate that list was an exercise in futility. It's a nice GUI but not a useful tool. Plus the knowledge it takes to use LN ends up pointing you to using the more effective tcpdump+bintools and modifying your mac's packetfilter config file.
  - pilsetnieks 4y ago
    They have a curated list of rules for builtin system services now, so you don't have to bother with that (if you don't want to). Also, I'd argue, there's still a wide gap in knowledge requirement, as well as ease of use between LS and some homebrew tcpdump based solution.
    - eep_social 4y ago
      Is Pihole a reasonably friendly tool with an easy on-ramp or is LS doing more than that?
      - thewataccount 4y ago
        Pihole just gives tells you what computer made DNS queries and to where. Littlesnitch/tcpdump/wireshark/glasswire(I think?)/opensnitch are system level tools that attempt to monitor the individual connections - which processes made them, where they were too, and tcpdump/wireshark will also show you the content of the connection. If malware uses ip addresses or it's own dns server then Pihole will never see it. Snort and Suricata are more likely what you're looking for as an IDS for something network wide, they analyze network wide the individual connections and can do pattern matching with known malware lists. They can't tell you what process made the request. A pihole certainly wouldn't hurt and is very easy to use, it's not really made to be an IDS AFAIK.
      - pbhjpbhj 4y ago
        I've only used OpenSnitch, a Linux equivalent of LS. Pihole operates at domain/subdomain level. So it won't resolve domains that are in your blacklist. *Snitch operates at packet level, so whilst you can block a domain, you can also block an app's access to a particular domain but allow another app access, maybe only by one user and to a specific port. Snitch takes much more setup and will annoy you until you've worked through all the usual traffic. It reminds me of the Proxomitron back in the day (https://en.wikipedia.org/wiki/Proxomitron https://en.wikipedia.org/wiki/Proxomitron).
    - FatActor 4y ago
      I didn't know that. Maybe I was too hasty, and this was a looooong time ago. Curated lists would be helpful.
  - lapcat 4y ago
    > I ran little snitch for about a week years ago and there were hundreds of thousands of requests just from typical apple services so trying to curate that list was an exercise in futility. It is difficult to set up, but it's still possible. One of the main reasons I use Little Snitch is to stop Apple from phoning home to Cupertino so much, to take some control back for myself. There are a ton of background processes on the Mac that can be blocked with no negative consequences AFAICT. Occasionally I trip myself up, but I'm willing to accept that consequence. I've sometimes thought of publishing my Little Snitch setup, but the problem is that I'm typically 1 major macOS version behind, including now. A lot tends to change from version to version.
- rekoil 4y ago
  I've actually been having all sorts of weird issues with LittleSnitch after upgrading to Ventura. For instance it was blocking requests from Python started by Sublime Text without prompting me about it (and there was no reject/drop rule in place that matched, it just didn't prompt), really annoying. Anyone experienced similar problems using LS on Ventura?
bobse 4y ago
You don't. It's proprietary software.
- CharlesW 4y ago
  According to TFA, you do. Methods are listed at the end, and the author created XProCheck¹ to make it easier. ¹ https://eclecticlight.co/consolation-t2m2-and-log-utilities/ https://eclecticlight.co/consolation-t2m2-and-log-utilities/
  - msla 4y ago
    What the poster you're replying to means is, "You know what Apple allows you to know, but you don't have the source, so you can't verify that Apple isn't lying to you."
    - CharlesW 4y ago
      The article seems to definitively answer that you can. But yes — if the theory is that Apple is pretending to log malware detection and remediation, one would have to disassemble the relevant parts of the OS to prove that.
    - saagarjha 4y ago
      If you are so inclined, which the article author is not but many others are, you can look at the binaries and reverse them to verify things yourself.
CharlesW 4y ago
> "As a result, the great majority of users are oblivious of the detection and remediation of malware on their Macs, which occurs in complete secrecy." Great! This is how consumer products should work. If I were to see "hey a thing happened but I resolved it" alerts from the 500+ currently-running processes on my computer, I'd throw it out the window.
- akersten 4y ago
  Eehh... This is more like "you drove through a red light but luckily no one T-boned you;" a cop will rightfully pull you over to let you know "nothing happened." I'd say the driver definitely should be alerted that that PDF they opened was infected. At minimum to alert them to the fact that they should keep their guard up, and that further investigation of potential compromise could be necessary depending on your threat model. Virus almost running on your PC is not a routine product feature that should be swept under the rug - at best it's bad security hygiene, at worst it's symptomatic of a targeted/ongoing compromise.
  - gear54rus 4y ago
    It is typical apple dumbness - form over function. The same dumbness exists on windows where it would silently remove files like keygens with its 'antivirus' making it a mandatory drill to disable it completely (no easy task too) on any new installation. Even worse you would sometimes forget that it does that and then be dumbfounded for about 30 minutes as to why the file is in the archive but not on the filesystem after its extraction.
  - dylan604 4y ago
    >At minimum to alert them to the fact that they should keep their guard up or to not share it with others!
    - TeMPOraL 4y ago
      Or warn the person (friend, coworker, family member) who sent it that they have a malware problem!
cirrus3 4y ago
I would be totally fine if would just remediate silently always... and I certainly don't care what name it gives the malware, I'm surprised they show a name at all. If you are a security researcher, it seems like you have other tools at your disposal.
daveidol 4y ago
But if you open an app whose developer didn't pay Apple $100/year you will be SURE to know how risky that is and that macOS blocked it for you!
- ubermonkey 4y ago
  No?
  - 100721 4y ago
    Yes: https://support.apple.com/en-ca/guide/mac-help/mh40616/mac https://support.apple.com/en-ca/guide/mac-help/mh40616/mac > If you try to open an app that isn’t registered with Apple by an identified developer, you get a warning dialog.
    - nexus7556 4y ago
      A warning dialog is different than being "blocked" as OP suggested
      - ketralnis 4y ago
        It is actually blocked. The program is prevented from launching. You can go into the security settings and approve it and then relaunch it (which last I saw, the error message didn't even tell you how to do anymore), but it's not just a "approve/deny?" skippable screen.
        judge2020 4y ago
        By that same logic, non-hsts SSL certificate expiration warnings are browsers "blocking" you from visiting a website, despite the buttons that allow you to bypass it.
        acchow 4y ago
        They are blocking you. In Chrome, it's even more complicated. You have to click the very small "More/Advanced Settings" text which doesn't even really look like a button. After that, a button allowing you to proceed appears, but upon clicking you are given a very scary warning.
fotta 4y ago
Ha, off-topic but I love that macOS properly calls it Bin when set to British English
- doodpants 4y ago
  My first thought was "why would I want to move a piece of malware to the /bin directory?"
- reaperducer 4y ago
  I love that macOS properly calls it Bin when set to British English macOS has some really exceptional internationalization. I recently discovered that it supports Zuni. There are only a few thousand Zuni-speakers in the world. System Settings → General → Language and Region → Preferred Languages → + → scroll..scroll..scroll → Shiwi'ma/Zuni
  - pklausler 4y ago
    It's System Settings -> Language and Region on my Mac (no General). I may change my Mac to Latin for fun.
    - LoganDark 4y ago
      I believe macOS 10.15 and 11 have two-ish generations of different settings organization compared to 10.14 and earlier.
  - christoph 4y ago
    After reading this I decided to scroll through the available languages and honestly can't believe it has Kernewek (Cornish), a language from the British county of Cornwall. Reading around, estimates put the number of fluent speakers at around 400 and those with basic language skills at around 5,000.
    - bob778 4y ago
      So at least 0.25% of the fluent speakers were involved in translating it, possibly more
sneak 4y ago
I suspect this UI choice is part of Apple's "macs don't get malware" brand narrative.
happyopossum 4y ago
It feels like if Apple went far enough to make this all visible and great, they’d start getting scrutiny for being imperfect, and missing malware. Kinda feels like they want to make a best-effort at preventing malware without making a big deal of it.
- highwaylights 4y ago
  Settings > Malware Remediation > Notify on Detection? Settings > Malware Remediation > Events Not a complicated UI to design. I suspect the other reply that pointed to Apple wanting to sweep Mac malware under the rug is far more likely.
happyopossum 4y ago
Just had a thought - I’d imagine more people are scammed by “You have 3 viruses on computer” pop-ups than would be better off with a visible warning from macOS for background detections. Perhaps apple made the (reasonable) decision to not alert people to background detection/remediations so as to not get users used to such alerts?
- blobster 4y ago
  Good point. There is a cottage industry of scams running fake Windows virus alerts.
  - viraptor 4y ago
    They often show a "Mac version" of those for MacOS users. It doesn't matter much that the warning doesn't exist in the system. They're not targeting people who know that.
- still_grokking 4y ago
  How about this alternative explanation: Apple is very concerned about its perception in public and doesn't want user to see that their OS has quite a malware issue. A lot of Apple users still believe that macOS is superiors when it comes to security. But reality looks more like: https://in.mashable.com/tech/11411/sorry-mac-owners-a-new-report-says-windows-pcs-are-safer-from-malware https://in.mashable.com/tech/11411/sorry-mac-owners-a-new-re... No news: https://www.theguardian.com/technology/blog/2009/mar/20/browser-economics https://www.theguardian.com/technology/blog/2009/mar/20/brow...
saagarjha 4y ago
> Using eslogger isn’t simple either. That tool has to be left running to gather records of events into a text file, which the user has to monitor and maintain. Using the details I published here previously, I gathered those two event types during my tests using malware samples. Each event generates a substantial quantity of JSON data which appears to be undocumented. It's a pretty clear dump of the contents of https://developer.apple.com/documentation/endpointsecurity/e https://developer.apple.com/documentation/endpointsecurity/e..., just like every other endpoint security event. This tool is intended for users who are familiar with the Endpoint Security framework and want quick access to an entitled binary for testing purposes. The author needs to understand that 1. developer APIs exist and are meant for developers, and 2. the OS is never going to be designed to be introspectable to someone like him and his users, because that would be an incredibly stupid way to design an OS. If you want to peek at what is going on, use the existing APIs and package it up as an app for your users to use. Exposing raw events like the author wants is neither useful or actionable for most users.
- lapcat 4y ago
  You seem to be missing the point of the article, which is this: > the great majority of users are oblivious of the detection and remediation of malware on their Macs, which occurs in complete secrecy This is a problem that Apple could solve but chooses not to. Everything the author is doing is admittedly a poor workaround for Apple's lack of user notification.
  - hermitdev 4y ago
    They probably also don't want to expose it to users at all because of marketing. Anyone remember those old ads of PC vs Mac and Mac not getting viruses? Because, I do...
    - rudyfink 4y ago
      Here they are: https://www.youtube.com/watch?v=V0feR5grSa4 https://www.youtube.com/watch?v=V0feR5grSa4 (32 second spot) / https://www.youtube.com/watch?v=VEVjILqU3pU https://www.youtube.com/watch?v=VEVjILqU3pU (apparently the UK version of the same commercial).
unclekev 4y ago
There's commercial/enterprise software available which hooks into XProtect to provide more advanced reporting capabilities. https://www.jamf.com/products/jamf-protect/ https://www.jamf.com/products/jamf-protect/ Doesn't help for the average user, but the software does exist.
- cpressland 4y ago
  We’re a macOS house that uses Jamf for management and Microsoft Defender ATP for Anti-Malware. Defender ATP gives great reporting but the performance impact on endpoints is obscene. During onboarding for Developers we go through the Xcode Command Line Tools and Homebrew installation, if ATP has already been installed it adds somewhere between 20 and 40 minutes to the installation time. I’ll get some pricing for Jamf Protect and if it’s competitively priced I’ll see about moving us over. I’d much rather be using something built-in than a poorly optimised solution.
  - angulardragon03 4y ago
    Protect is much better than ATP, both on the endpoint and the admin console. Crowdstrike is also good, with minimal resource footprint. On my old 16” 2019 MBP, ATP used to legitimately cause a ~10C increase in “idle” temps. Not a huge fan.
404mm 4y ago
I’m curious how good/advanced is this built in malware protection compared to some 3rd part, like Malware Bytes or similar
mproud 4y ago
My suspicion was correct after reading the screenshots: “trash” in USA “bin” in UK
brailsafe 4y ago
As an aside, I've been pleasantly surprised by Firefox's latest privacy additions. Earlier today, while clicking around looking monitors on various sites, I kept running into what looked like a malware alert, suggesting I was being redirected to a possibly malicious website. Turns out that was true, but it wasn't the traditional reason that you'd see in older version of windows, and in rare cases on macOS, where some download would hijack your browser configuration and redirect you to god knows where. Nope, it was just regular ad tracking bs, even on seemingly non-malicious links, such as those that link to Dell's product page from Macrumors. Inspect the link, and it seems to link directly to where the hover effect would have you believe. Right-click and click "copy link" however, and you'd paste into the address bar the obscured redirect url. Since I'd been using a blocker for some time on my other computer, I didn't even realize it had got this bad. Thanks Firefox for enabling this by default, and revealing standard Google search ads to be the malicious crap they are.

175 points by zdw 4y ago

It makes me think of the Invincible meme, "that's the neat thing, you don't" with an asterisk. Kidding aside if you're somewhat competent with macs and you can read, little snitch should be the first piece of software you install on any mac. It's not malware protection but it does at least make you aware of stuff wanting to do weird crap on your computer.

FatActor 4y ago
I ran little snitch for about a week years ago and there were hundreds of thousands of requests just from typical apple services so trying to curate that list was an exercise in futility. It's a nice GUI but not a useful tool. Plus the knowledge it takes to use LN ends up pointing you to using the more effective tcpdump+bintools and modifying your mac's packetfilter config file.
- pilsetnieks 4y ago
  They have a curated list of rules for builtin system services now, so you don't have to bother with that (if you don't want to). Also, I'd argue, there's still a wide gap in knowledge requirement, as well as ease of use between LS and some homebrew tcpdump based solution.
  - eep_social 4y ago
    Is Pihole a reasonably friendly tool with an easy on-ramp or is LS doing more than that?
    - thewataccount 4y ago
      Pihole just gives tells you what computer made DNS queries and to where. Littlesnitch/tcpdump/wireshark/glasswire(I think?)/opensnitch are system level tools that attempt to monitor the individual connections - which processes made them, where they were too, and tcpdump/wireshark will also show you the content of the connection. If malware uses ip addresses or it's own dns server then Pihole will never see it. Snort and Suricata are more likely what you're looking for as an IDS for something network wide, they analyze network wide the individual connections and can do pattern matching with known malware lists. They can't tell you what process made the request. A pihole certainly wouldn't hurt and is very easy to use, it's not really made to be an IDS AFAIK.
    - pbhjpbhj 4y ago
      I've only used OpenSnitch, a Linux equivalent of LS. Pihole operates at domain/subdomain level. So it won't resolve domains that are in your blacklist. *Snitch operates at packet level, so whilst you can block a domain, you can also block an app's access to a particular domain but allow another app access, maybe only by one user and to a specific port. Snitch takes much more setup and will annoy you until you've worked through all the usual traffic. It reminds me of the Proxomitron back in the day (https://en.wikipedia.org/wiki/Proxomitron https://en.wikipedia.org/wiki/Proxomitron).
  - FatActor 4y ago
    I didn't know that. Maybe I was too hasty, and this was a looooong time ago. Curated lists would be helpful.
- lapcat 4y ago
  > I ran little snitch for about a week years ago and there were hundreds of thousands of requests just from typical apple services so trying to curate that list was an exercise in futility. It is difficult to set up, but it's still possible. One of the main reasons I use Little Snitch is to stop Apple from phoning home to Cupertino so much, to take some control back for myself. There are a ton of background processes on the Mac that can be blocked with no negative consequences AFAICT. Occasionally I trip myself up, but I'm willing to accept that consequence. I've sometimes thought of publishing my Little Snitch setup, but the problem is that I'm typically 1 major macOS version behind, including now. A lot tends to change from version to version.
rekoil 4y ago
I've actually been having all sorts of weird issues with LittleSnitch after upgrading to Ventura. For instance it was blocking requests from Python started by Sublime Text without prompting me about it (and there was no reject/drop rule in place that matched, it just didn't prompt), really annoying. Anyone experienced similar problems using LS on Ventura?

bobse 4y ago

You don't. It's proprietary software.

CharlesW 4y ago
According to TFA, you do. Methods are listed at the end, and the author created XProCheck¹ to make it easier. ¹ https://eclecticlight.co/consolation-t2m2-and-log-utilities/ https://eclecticlight.co/consolation-t2m2-and-log-utilities/
- msla 4y ago
  What the poster you're replying to means is, "You know what Apple allows you to know, but you don't have the source, so you can't verify that Apple isn't lying to you."
  - CharlesW 4y ago
    The article seems to definitively answer that you can. But yes — if the theory is that Apple is pretending to log malware detection and remediation, one would have to disassemble the relevant parts of the OS to prove that.
  - saagarjha 4y ago
    If you are so inclined, which the article author is not but many others are, you can look at the binaries and reverse them to verify things yourself.

CharlesW 4y ago

> "As a result, the great majority of users are oblivious of the detection and remediation of malware on their Macs, which occurs in complete secrecy." Great! This is how consumer products should work. If I were to see "hey a thing happened but I resolved it" alerts from the 500+ currently-running processes on my computer, I'd throw it out the window.

akersten 4y ago
Eehh... This is more like "you drove through a red light but luckily no one T-boned you;" a cop will rightfully pull you over to let you know "nothing happened." I'd say the driver definitely should be alerted that that PDF they opened was infected. At minimum to alert them to the fact that they should keep their guard up, and that further investigation of potential compromise could be necessary depending on your threat model. Virus almost running on your PC is not a routine product feature that should be swept under the rug - at best it's bad security hygiene, at worst it's symptomatic of a targeted/ongoing compromise.
- gear54rus 4y ago
  It is typical apple dumbness - form over function. The same dumbness exists on windows where it would silently remove files like keygens with its 'antivirus' making it a mandatory drill to disable it completely (no easy task too) on any new installation. Even worse you would sometimes forget that it does that and then be dumbfounded for about 30 minutes as to why the file is in the archive but not on the filesystem after its extraction.
- dylan604 4y ago
  >At minimum to alert them to the fact that they should keep their guard up or to not share it with others!
  - TeMPOraL 4y ago
    Or warn the person (friend, coworker, family member) who sent it that they have a malware problem!

cirrus3 4y ago

I would be totally fine if would just remediate silently always... and I certainly don't care what name it gives the malware, I'm surprised they show a name at all. If you are a security researcher, it seems like you have other tools at your disposal.

daveidol 4y ago

But if you open an app whose developer didn't pay Apple $100/year you will be SURE to know how risky that is and that macOS blocked it for you!

ubermonkey 4y ago
No?
- 100721 4y ago
  Yes: https://support.apple.com/en-ca/guide/mac-help/mh40616/mac https://support.apple.com/en-ca/guide/mac-help/mh40616/mac > If you try to open an app that isn’t registered with Apple by an identified developer, you get a warning dialog.
  - nexus7556 4y ago
    A warning dialog is different than being "blocked" as OP suggested
    - ketralnis 4y ago
      It is actually blocked. The program is prevented from launching. You can go into the security settings and approve it and then relaunch it (which last I saw, the error message didn't even tell you how to do anymore), but it's not just a "approve/deny?" skippable screen.
      - judge2020 4y ago
        By that same logic, non-hsts SSL certificate expiration warnings are browsers "blocking" you from visiting a website, despite the buttons that allow you to bypass it.
        acchow 4y ago
        They are blocking you. In Chrome, it's even more complicated. You have to click the very small "More/Advanced Settings" text which doesn't even really look like a button. After that, a button allowing you to proceed appears, but upon clicking you are given a very scary warning.

fotta 4y ago

Ha, off-topic but I love that macOS properly calls it Bin when set to British English

doodpants 4y ago
My first thought was "why would I want to move a piece of malware to the /bin directory?"
reaperducer 4y ago
I love that macOS properly calls it Bin when set to British English macOS has some really exceptional internationalization. I recently discovered that it supports Zuni. There are only a few thousand Zuni-speakers in the world. System Settings → General → Language and Region → Preferred Languages → + → scroll..scroll..scroll → Shiwi'ma/Zuni
- pklausler 4y ago
  It's System Settings -> Language and Region on my Mac (no General). I may change my Mac to Latin for fun.
  - LoganDark 4y ago
    I believe macOS 10.15 and 11 have two-ish generations of different settings organization compared to 10.14 and earlier.
- christoph 4y ago
  After reading this I decided to scroll through the available languages and honestly can't believe it has Kernewek (Cornish), a language from the British county of Cornwall. Reading around, estimates put the number of fluent speakers at around 400 and those with basic language skills at around 5,000.
  - bob778 4y ago
    So at least 0.25% of the fluent speakers were involved in translating it, possibly more

sneak 4y ago

I suspect this UI choice is part of Apple's "macs don't get malware" brand narrative.

happyopossum 4y ago

It feels like if Apple went far enough to make this all visible and great, they’d start getting scrutiny for being imperfect, and missing malware. Kinda feels like they want to make a best-effort at preventing malware without making a big deal of it.

highwaylights 4y ago
Settings > Malware Remediation > Notify on Detection? Settings > Malware Remediation > Events Not a complicated UI to design. I suspect the other reply that pointed to Apple wanting to sweep Mac malware under the rug is far more likely.

happyopossum 4y ago

Just had a thought - I’d imagine more people are scammed by “You have 3 viruses on computer” pop-ups than would be better off with a visible warning from macOS for background detections. Perhaps apple made the (reasonable) decision to not alert people to background detection/remediations so as to not get users used to such alerts?

blobster 4y ago
Good point. There is a cottage industry of scams running fake Windows virus alerts.
- viraptor 4y ago
  They often show a "Mac version" of those for MacOS users. It doesn't matter much that the warning doesn't exist in the system. They're not targeting people who know that.
still_grokking 4y ago
How about this alternative explanation: Apple is very concerned about its perception in public and doesn't want user to see that their OS has quite a malware issue. A lot of Apple users still believe that macOS is superiors when it comes to security. But reality looks more like: https://in.mashable.com/tech/11411/sorry-mac-owners-a-new-report-says-windows-pcs-are-safer-from-malware https://in.mashable.com/tech/11411/sorry-mac-owners-a-new-re... No news: https://www.theguardian.com/technology/blog/2009/mar/20/browser-economics https://www.theguardian.com/technology/blog/2009/mar/20/brow...

saagarjha 4y ago

> Using eslogger isn’t simple either. That tool has to be left running to gather records of events into a text file, which the user has to monitor and maintain. Using the details I published here previously, I gathered those two event types during my tests using malware samples. Each event generates a substantial quantity of JSON data which appears to be undocumented. It's a pretty clear dump of the contents of https://developer.apple.com/documentation/endpointsecurity/e https://developer.apple.com/documentation/endpointsecurity/e..., just like every other endpoint security event. This tool is intended for users who are familiar with the Endpoint Security framework and want quick access to an entitled binary for testing purposes. The author needs to understand that 1. developer APIs exist and are meant for developers, and 2. the OS is never going to be designed to be introspectable to someone like him and his users, because that would be an incredibly stupid way to design an OS. If you want to peek at what is going on, use the existing APIs and package it up as an app for your users to use. Exposing raw events like the author wants is neither useful or actionable for most users.

lapcat 4y ago
You seem to be missing the point of the article, which is this: > the great majority of users are oblivious of the detection and remediation of malware on their Macs, which occurs in complete secrecy This is a problem that Apple could solve but chooses not to. Everything the author is doing is admittedly a poor workaround for Apple's lack of user notification.
- hermitdev 4y ago
  They probably also don't want to expose it to users at all because of marketing. Anyone remember those old ads of PC vs Mac and Mac not getting viruses? Because, I do...
  - rudyfink 4y ago
    Here they are: https://www.youtube.com/watch?v=V0feR5grSa4 https://www.youtube.com/watch?v=V0feR5grSa4 (32 second spot) / https://www.youtube.com/watch?v=VEVjILqU3pU https://www.youtube.com/watch?v=VEVjILqU3pU (apparently the UK version of the same commercial).

unclekev 4y ago

There's commercial/enterprise software available which hooks into XProtect to provide more advanced reporting capabilities. https://www.jamf.com/products/jamf-protect/ https://www.jamf.com/products/jamf-protect/ Doesn't help for the average user, but the software does exist.

cpressland 4y ago
We’re a macOS house that uses Jamf for management and Microsoft Defender ATP for Anti-Malware. Defender ATP gives great reporting but the performance impact on endpoints is obscene. During onboarding for Developers we go through the Xcode Command Line Tools and Homebrew installation, if ATP has already been installed it adds somewhere between 20 and 40 minutes to the installation time. I’ll get some pricing for Jamf Protect and if it’s competitively priced I’ll see about moving us over. I’d much rather be using something built-in than a poorly optimised solution.
- angulardragon03 4y ago
  Protect is much better than ATP, both on the endpoint and the admin console. Crowdstrike is also good, with minimal resource footprint. On my old 16” 2019 MBP, ATP used to legitimately cause a ~10C increase in “idle” temps. Not a huge fan.

404mm 4y ago

I’m curious how good/advanced is this built in malware protection compared to some 3rd part, like Malware Bytes or similar

mproud 4y ago

My suspicion was correct after reading the screenshots: “trash” in USA “bin” in UK

brailsafe 4y ago

As an aside, I've been pleasantly surprised by Firefox's latest privacy additions. Earlier today, while clicking around looking monitors on various sites, I kept running into what looked like a malware alert, suggesting I was being redirected to a possibly malicious website. Turns out that was true, but it wasn't the traditional reason that you'd see in older version of windows, and in rare cases on macOS, where some download would hijack your browser configuration and redirect you to god knows where. Nope, it was just regular ad tracking bs, even on seemingly non-malicious links, such as those that link to Dell's product page from Macrumors. Inspect the link, and it seems to link directly to where the hover effect would have you believe. Right-click and click "copy link" however, and you'd paste into the address bar the obscured redirect url. Since I'd been using a blocker for some time on my other computer, I didn't even realize it had got this bad. Thanks Firefox for enabling this by default, and revealing standard Google search ads to be the malicious crap they are.