4 ms·

Malware writers will just get free ids and sign their malware. Will all of these OSX devices be regularly polling Apple to get a list of revoked certs? Yes, th

by batista 15y ago

Malware writers will just get free ids and sign their malware. Will all of these OSX devices be regularly polling Apple to get a list of revoked certs? Yes, the first problem will be to create some malware from OS X first. You know, the biggest success so far had been that Mac Defender, that was: a) a trojan (you had to install it yourself) and b) only affected like 10 users

mike-cardwell 15y ago
If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else? The current app eco-system doesn't allow them to just switch off the ability for people to install arbitrary apps. They need to get themselves into a situation where the vast majority of apps are signed first. Then it will be a lot easier for them to require apps to be signed. For your own protection of course. EDIT: After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed?
- ugh 15y ago
  They don’t want to be forced to play catch up like Microsoft had to. It’s not that hard to figure out.
  - deleted 15y ago
    [deleted]
- rbehrends 15y ago
  > If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Presumably, in order to keep the problem small. If OS X grows in marketshare, it will become an increasingly attractive target for malware developers. If the default is that the majority of Apple users only run signed applications (this also means that the certificate wasn't revoked), then the number of possible "users" for your malware is greatly reduced, making OS X a much less attractive target platform for malware developers. > After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed? If you are a legitimate developer, then there's no reason not to (assuming it actually is free and easy, which isn't clear). As a malware developer, there's little point; as soon as the developer ID is being used for malware, Apple will revoke the corresponding certificate, and your malware won't run.
- batista 15y ago
  If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else? I don't understand the question. Apple has been improving OS X security mechanisms in every OS X update. From "address space layout randomization" to the "first run warning". This is another step in the same direction. Are you implying that Apple should only do something about OS X security AFTER malware on OS X get's to be a problem? Because, I'd rather they do it BEFORE. And I fail to see how pro-actively making an OS more secure is "security theater". Then it will be a lot easier for them to require apps to be signed. For your own protection of course. Of course. I miss the irony here. Signed applications are touted by security experts as a highly successful security measure. Are you suggesting it is otherwise or are you just confusing the potential of misuse of that feature with that feature being meaningless? * After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed?* Yeah, why? Surely not for the $100 it takes. SSL certificates cost money too, but I don't see anybody suggesting running your web app in plain HTTP is better, or that paid certificates hamper secure web application development.
  - mike-cardwell 15y ago
    I stated what malware writers will do. You then replied by being sarcastic about how malware isn't really a problem. I then asked a rhetorical question about why would they be doing this if not to defend against malware. Now you're ranting about how malware could become a problem as if this is somehow news to me. I'm sure you had a point.
  - batista 15y ago
    I stated what malware writers will do. No, you stated what you THINK they will do. For one, most Macs are updated very often, what with Software Update and Mac Store updates. So updating a black list of applications wouldn't be a problem. Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away? Third, even if they somehow get through the second caveat above, revocation would just be a step away. I then asked a rhetorical question about why would they be doing this if not to defend against malware. No, you said that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it. As if defending against POSSIBLE FUTURE malware is a "security theater" or a strange notion.
- rsynnott 15y ago
  > If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Because they're not thinking about their current problems, they're thinking about their upcoming problems.
DanBC 15y ago
Depending what you call malware - some people feel that an application which silently uploads your address book is functionally equivalent, and there have been plenty of these available on all platforms.
mike-cardwell 15y ago
I discovered where your confusion came from: "I guess this would be useful to prevent malware being installed, but it's not going to be massively useful to remove already installed malware. Especially if that malware can interrupt the polling." You mistakenly read that as if I wasn't talking about malware that exists today. No. There are two situations: 1.) revocation cert issued before malware installed 2.) malware installed before revocation cert issued I was talking about situation 2 occurring in N years time. You can tell this by the way I wrote "Especially if that malware can interrupt the polling." Which of course, isn't a feature of any malware that exists today, because the polling method doesn't exist yet.

by batista 15y ago

mike-cardwell 15y ago

If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else? The current app eco-system doesn't allow them to just switch off the ability for people to install arbitrary apps. They need to get themselves into a situation where the vast majority of apps are signed first. Then it will be a lot easier for them to require apps to be signed. For your own protection of course. EDIT: After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed?

ugh 15y ago
They don’t want to be forced to play catch up like Microsoft had to. It’s not that hard to figure out.
- deleted 15y ago
  [deleted]
rbehrends 15y ago
> If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Presumably, in order to keep the problem small. If OS X grows in marketshare, it will become an increasingly attractive target for malware developers. If the default is that the majority of Apple users only run signed applications (this also means that the certificate wasn't revoked), then the number of possible "users" for your malware is greatly reduced, making OS X a much less attractive target platform for malware developers. > After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed? If you are a legitimate developer, then there's no reason not to (assuming it actually is free and easy, which isn't clear). As a malware developer, there's little point; as soon as the developer ID is being used for malware, Apple will revoke the corresponding certificate, and your malware won't run.
batista 15y ago
If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Is it to wrestle further control of the app eco-system on OSX? Or is it just security theatre? Or both? Something else? I don't understand the question. Apple has been improving OS X security mechanisms in every OS X update. From "address space layout randomization" to the "first run warning". This is another step in the same direction. Are you implying that Apple should only do something about OS X security AFTER malware on OS X get's to be a problem? Because, I'd rather they do it BEFORE. And I fail to see how pro-actively making an OS more secure is "security theater". Then it will be a lot easier for them to require apps to be signed. For your own protection of course. Of course. I miss the irony here. Signed applications are touted by security experts as a highly successful security measure. Are you suggesting it is otherwise or are you just confusing the potential of misuse of that feature with that feature being meaningless? * After all, if developer IDs are so easy and free to get, and will make it easier for people to install your app. Why wouldn't you get it signed?* Yeah, why? Surely not for the $100 it takes. SSL certificates cost money too, but I don't see anybody suggesting running your web app in plain HTTP is better, or that paid certificates hamper secure web application development.
- mike-cardwell 15y ago
  I stated what malware writers will do. You then replied by being sarcastic about how malware isn't really a problem. I then asked a rhetorical question about why would they be doing this if not to defend against malware. Now you're ranting about how malware could become a problem as if this is somehow news to me. I'm sure you had a point.
- batista 15y ago
  I stated what malware writers will do. No, you stated what you THINK they will do. For one, most Macs are updated very often, what with Software Update and Mac Store updates. So updating a black list of applications wouldn't be a problem. Second, they cannot just get a certificate, because they will have to interact with Apple and the developer program. You know many malware writers that want to give their details away? Third, even if they somehow get through the second caveat above, revocation would just be a step away. I then asked a rhetorical question about why would they be doing this if not to defend against malware. No, you said that if they don't do it to defend against ALREADY EXISTING malware then it's either a security theater or a mystery to you why they'd do it. As if defending against POSSIBLE FUTURE malware is a "security theater" or a strange notion.
rsynnott 15y ago
> If malware on OSX is as small a problem as you're suggesting, why is Apple bothering with any of this? Because they're not thinking about their current problems, they're thinking about their upcoming problems.

DanBC 15y ago

Depending what you call malware - some people feel that an application which silently uploads your address book is functionally equivalent, and there have been plenty of these available on all platforms.

mike-cardwell 15y ago

I discovered where your confusion came from: "I guess this would be useful to prevent malware being installed, but it's not going to be massively useful to remove already installed malware. Especially if that malware can interrupt the polling." You mistakenly read that as if I wasn't talking about malware that exists today. No. There are two situations: 1.) revocation cert issued before malware installed 2.) malware installed before revocation cert issued I was talking about situation 2 occurring in N years time. You can tell this by the way I wrote "Especially if that malware can interrupt the polling." Which of course, isn't a feature of any malware that exists today, because the polling method doesn't exist yet.