7 ms·

This might be a good place to ask: I have Malwarebytes installed but aside from that nothing really. What's the recommended software stack to stay as protected

by snehk 4y ago

This might be a good place to ask: I have Malwarebytes installed but aside from that nothing really. What's the recommended software stack to stay as protected as possible?

mwint 4y ago
On a Mac, just keep up with software updates and think really hard before overriding security warnings. Also, don’t irritate any nation states.
- kitsunesoba 4y ago
  > On a Mac, just keep up with software updates and think really hard before overriding security warnings. Also, while SIP wouldn't have helped in this particular situation, consider if it's really necessary to disable it. Living with SIP on is occasionally cumbersome, but I don't trust myself enough to run without it on, even as someone who's been a technically-minded computer user for coming up on a quarter of a century and a dev for over half of that. If disabling SIP is ever truly necessary for me I think I'd do it in a VM. Especially on M-series machines virtualization of macOS has gotten quite good.
  - olliej 4y ago
    I've literally never had a need to disable SIP. About the only reason you could possibly need to is if you're doing particularly weird kernel driver development, and I'm not sure that's needed even then.
    - kitsunesoba 4y ago
      I think the most common cited reason to disable it that I've seen is the ability to attach a debugger to any program, even those using the hardened runtime, which isn't something I've needed thus far.
    - saagarjha 4y ago
      That’s not true, debugging system components is an important use case.
  - josephcsible 4y ago
    Do you trust yourself to use Linux, even though it has no equivalent to SIP?
    - kitsunesoba 4y ago
      As things stand currently, sure. Nothing critical or tied to my livelihood is done on my gaming tower's dual booted Fedora install, it's mainly there to scratch tinkering itches. Similarly that tower's Windows install is used only for games and MS platform tinkering. If Linux were to become my daily driver OS I'd probably enforce a greater degree of separation between machines, with e.g. one Linux box exclusively for work things, another for finance, etc which is pretty easy to do with cheap old laptops. This limits the potential blast radius and reduces chances of getting hit in the first place, with e.g. how there's no good reason to run random untrusted binaries on the finance laptop.
- mortenjorck 4y ago
  This is really the only Mac security advice anyone needs. There are two categories of Mac malware: Ones where you have to enter your admin password into something that should have already raised several red flags by the time you see the prompt, or zero-days that are so stratospherically expensive that if you are an individual who would be targeted by one, malware is only one part of your overall threat model.
GTP 4y ago
Being careful about what you're doing is the best antimalware, regardless of which OS you're using.
ikekkdcjkfke 4y ago
If you really want to go the distance, Remote Browser Isolation
the_third_wave 4y ago
Linux. It has been "ready for the desktop" for more than a decade but it is not yet targeted by this type of malware. If it ends up being popular enough that will change but for now it is spared this disease. The advent of immutable distributions makes for a harder target for malware if and when this becomes a problem.
- isthiseasymode 4y ago
  I know I’ll ruffle some feathers on HN, but macOs is fine and probably the best OS for Mac (especially m1) hardware. No reason to make your life harder unless you’re doing it for your own enjoyment.
- microtonal 4y ago
  Most Linux distribution do still not have a properly verified boot chain, even something at the core of system boot like initrd is unsigned (which asks your LUKS password). There are immutable distributions, but they don't use sealed, cryptographically verified volumes. It is still trivial to modify the store in most immutable distributions to inject malware. User applications have no isolation at all, every app that parses untrusted input and does network access can read/write your whole home directory, including private keys, AWS credentials, etc. (most people don't use smartcards). Browsers only have some security because the browser developers have built their own sandboxes, but a determined actor can probably break it without too much issue through hardware acceleration APIs, etc. macOS as many times more secure than the Linux desktop. The only reason Linux is not a malwarefest is because the market share is so small that it is not that interesting. [1] https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html
  - aborsy 4y ago
    On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.
    - microtonal 4y ago
cj 4y ago
Enable Lockdown Mode if you’re truly paranoid (will degrade UX since lockdown disables certain OS features to reduce attack surface). For the less paranoid, Mac malware is still incredibly rare if you only download and execute files from trusted sources (preferably the Mac App Store) And keep all software/OS up to date. PS - slightly unrelated but I’ve always been so confused as to why Mac comes with the firewall disabled by default.
meindnoch 4y ago
Don't enter your password into random dialogs?
- olliej 4y ago
  Honestly though, in my experience macOS especially has a habit of presenting legitimate password dialogs completely out of the blue. It clearly trains users to enter their password into random dialogs that appear at random times. This is something that hasn't been fixed despite years of complaints from the security community for exactly this reason. It's especially annoying as touchid provides a standard authentication mechanism on macOS, that doesn't provide reusable credentials to anything.
  - atty 4y ago
    Agreed. I am so trained by macOS that it needs my iCloud password or account password randomly that I don’t even think about it anymore. I like to consider myself a savvy computer user, but I frankly only give myself a 50% chance at best of identifying a malicious password prompt at this point.
rickette 4y ago
Use an outbound firewall like LuLu https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html. It won't necessarily stop an infection but almost all malware wants to phone home. Explicitly approving every outbound request blocks this.
mac-chaffee 4y ago
The advice you are getting so far sucks. The default security settings on macOS are easy to bypass: https://www.macchaffee.com/blog/2023/hacking-myself/ https://www.macchaffee.com/blog/2023/hacking-myself/ Unfortunately these are design weaknesses, so any "software stack" would just be a bandaid.

by snehk 4y ago

This might be a good place to ask: I have Malwarebytes installed but aside from that nothing really. What's the recommended software stack to stay as protected as possible?

mwint 4y ago

On a Mac, just keep up with software updates and think really hard before overriding security warnings. Also, don’t irritate any nation states.

kitsunesoba 4y ago
> On a Mac, just keep up with software updates and think really hard before overriding security warnings. Also, while SIP wouldn't have helped in this particular situation, consider if it's really necessary to disable it. Living with SIP on is occasionally cumbersome, but I don't trust myself enough to run without it on, even as someone who's been a technically-minded computer user for coming up on a quarter of a century and a dev for over half of that. If disabling SIP is ever truly necessary for me I think I'd do it in a VM. Especially on M-series machines virtualization of macOS has gotten quite good.
- olliej 4y ago
  I've literally never had a need to disable SIP. About the only reason you could possibly need to is if you're doing particularly weird kernel driver development, and I'm not sure that's needed even then.
  - kitsunesoba 4y ago
    I think the most common cited reason to disable it that I've seen is the ability to attach a debugger to any program, even those using the hardened runtime, which isn't something I've needed thus far.
  - saagarjha 4y ago
    That’s not true, debugging system components is an important use case.
- josephcsible 4y ago
  Do you trust yourself to use Linux, even though it has no equivalent to SIP?
  - kitsunesoba 4y ago
    As things stand currently, sure. Nothing critical or tied to my livelihood is done on my gaming tower's dual booted Fedora install, it's mainly there to scratch tinkering itches. Similarly that tower's Windows install is used only for games and MS platform tinkering. If Linux were to become my daily driver OS I'd probably enforce a greater degree of separation between machines, with e.g. one Linux box exclusively for work things, another for finance, etc which is pretty easy to do with cheap old laptops. This limits the potential blast radius and reduces chances of getting hit in the first place, with e.g. how there's no good reason to run random untrusted binaries on the finance laptop.
mortenjorck 4y ago
This is really the only Mac security advice anyone needs. There are two categories of Mac malware: Ones where you have to enter your admin password into something that should have already raised several red flags by the time you see the prompt, or zero-days that are so stratospherically expensive that if you are an individual who would be targeted by one, malware is only one part of your overall threat model.

GTP 4y ago

Being careful about what you're doing is the best antimalware, regardless of which OS you're using.

ikekkdcjkfke 4y ago

If you really want to go the distance, Remote Browser Isolation

the_third_wave 4y ago

Linux. It has been "ready for the desktop" for more than a decade but it is not yet targeted by this type of malware. If it ends up being popular enough that will change but for now it is spared this disease. The advent of immutable distributions makes for a harder target for malware if and when this becomes a problem.

isthiseasymode 4y ago
I know I’ll ruffle some feathers on HN, but macOs is fine and probably the best OS for Mac (especially m1) hardware. No reason to make your life harder unless you’re doing it for your own enjoyment.
microtonal 4y ago
Most Linux distribution do still not have a properly verified boot chain, even something at the core of system boot like initrd is unsigned (which asks your LUKS password). There are immutable distributions, but they don't use sealed, cryptographically verified volumes. It is still trivial to modify the store in most immutable distributions to inject malware. User applications have no isolation at all, every app that parses untrusted input and does network access can read/write your whole home directory, including private keys, AWS credentials, etc. (most people don't use smartcards). Browsers only have some security because the browser developers have built their own sandboxes, but a determined actor can probably break it without too much issue through hardware acceleration APIs, etc. macOS as many times more secure than the Linux desktop. The only reason Linux is not a malwarefest is because the market share is so small that it is not that interesting. [1] https://0pointer.net/blog/brave-new-trusted-boot-world.html https://0pointer.net/blog/brave-new-trusted-boot-world.html
- aborsy 4y ago
  On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.
  - microtonal 4y ago

cj 4y ago

Enable Lockdown Mode if you’re truly paranoid (will degrade UX since lockdown disables certain OS features to reduce attack surface). For the less paranoid, Mac malware is still incredibly rare if you only download and execute files from trusted sources (preferably the Mac App Store) And keep all software/OS up to date. PS - slightly unrelated but I’ve always been so confused as to why Mac comes with the firewall disabled by default.

meindnoch 4y ago

Don't enter your password into random dialogs?

olliej 4y ago
Honestly though, in my experience macOS especially has a habit of presenting legitimate password dialogs completely out of the blue. It clearly trains users to enter their password into random dialogs that appear at random times. This is something that hasn't been fixed despite years of complaints from the security community for exactly this reason. It's especially annoying as touchid provides a standard authentication mechanism on macOS, that doesn't provide reusable credentials to anything.
- atty 4y ago
  Agreed. I am so trained by macOS that it needs my iCloud password or account password randomly that I don’t even think about it anymore. I like to consider myself a savvy computer user, but I frankly only give myself a 50% chance at best of identifying a malicious password prompt at this point.

rickette 4y ago

Use an outbound firewall like LuLu https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html. It won't necessarily stop an infection but almost all malware wants to phone home. Explicitly approving every outbound request blocks this.

mac-chaffee 4y ago

The advice you are getting so far sucks. The default security settings on macOS are easy to bypass: https://www.macchaffee.com/blog/2023/hacking-myself/ https://www.macchaffee.com/blog/2023/hacking-myself/ Unfortunately these are design weaknesses, so any "software stack" would just be a bandaid.