5 ms·

Snow Leopard contains hidden antivirus application

16 points by e1ven 17y ago

Readmore 17y ago
I don't think this invalidates any of Apple's marketing speak because it still "just works." The fact that this is built into the OS and doesn't have to be separately installed, upgraded, or managed fits in perfectly with what makes OS X a great and easy to use OS.
- daeken 17y ago
  Except that antivirus software is, by definition, always playing catchup. When you hit the point that you need antivirus software, you've already lost.
  - tptacek 17y ago
    OS X is nowhere near needing antivirus software, regardless of what features the OS X security team has managed to get added to the release. Just another example of the difference between "safety" and "security". Houses in Kennilworth, IL need less security than houses in Rogers Park --- there are something like 192 police officers per Kennilworth township block --- and yet Kennilworth houses can be counted on to have state-of-the-art security, because they can, and state-of-the-art security is a selling point.
    - daeken 17y ago
      OS X doesn't need antivirus software, and I didn't say that it did. Not needing it is a selling point, saying "you know, we don't need it, but we threw it in there anyway despite that it's worthless" isn't.
      - tptacek 17y ago
        Not needing and having are two different selling points, both in evidence here.
        daeken 17y ago
        Having it negates the "not needing it" selling point IMO. In addition, it being worthless and taking up space and CPU cycles (however passive it is) is a negative in my book. I don't see how it's a selling point at all.
        tptacek 17y ago
        Most users will see any security feature as a net positive. Note the positive publicity (amongst normal users) for Leopard ASLR, a feature that adds no real security. Adding basic anti-malware features to the OS will not negate any of the security value prop in Snow Leopard. I share your take on antivirus software, but do note that preventing a user from installing something with a known virus on it does not have negative utility.
        arebop 17y ago
        presumably details on why Leopard ASLR "adds no real security" are discussed in http://www.matasano.com/log/986/what-weve-since-learned-about-leopard-security-features/ http://www.matasano.com/log/986/what-weve-since-learned-abou..., which will eventually be reachable again?
        tptacek 17y ago
        Yep. Short answer: Leopard didn't randomize important core libraries.
        bvttf 17y ago
        Is there any confirmation that Snow Leopard has fixed this?
  - SamAtt 17y ago
    If Macs 'needed' antivirus software it would be necessary on all versions. Just because they've decided to proactively include it doesn't mean they need it.
  - joezydeco 17y ago
    If this type of feature can prevent a good portion of users from unknowingly installing malware via random .dmg files loaded from the net, then I'm all for it. So many people these days just install anything without really checking what it is. I don't consider this anti-viral, more like a condom for the lazier users.
pohl 17y ago
The observation is that there is an anti-malware facility. Then there's a leap to the conclusion that it is an anti-virus facility. Did I miss some important detail here? I thought a virus was a very specific type of malware, and there's not enough detail to conclude that it is "anti-virus".
- tptacek 17y ago
  Meh. There's no meaningful difference. Malware's the general term. A virus is malware that spreads passively. A worm is malware that spreads actively. "Trojan" is a bad term for the malware trait (which worms and viruses can have) of allowing unauthorized users access to the infected host. It's probably better not to dignify the "science" of malware by enforcing proper usage of terminology.
  - pohl 17y ago
    The distinction becomes relevant when comparing operating systems and their relative susceptibilities to viruses. That a given operating system is vulnerable to malware in general is not notable, because users will be duped by dancing babies, porn, and infected stolen software. That a given operating system ever allowed unaided self-replication take place is, and this is where Apple's marketing message has been placed.
    - wmf 17y ago
      I see your point that an OS that only gets trojans is better than an OS that gets trojans, viruses, and worms. However, I think it is possible to confine trojans better than we do today and it would be a shame to just give up hope on that front.
    - tptacek 17y ago
      Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. There's no operating system in common use for which malware distinctions are meaningful. They're all equally vulnerable.
e1ven 17y ago
There is independent confirmation of this at the MacRumors forums. http://forums.macrumors.com/showthread.php?t=768932 http://forums.macrumors.com/showthread.php?t=768932
- potatolicious 17y ago
  That thread actually brings up a really good point: we need to train users to update apps only via the official OS-sanctioned update method (Windows Updater, OSX Update, etc), or via the app's built-in update mechanism. The sort of "oh hey, QuickTime needs to update, run this file" should automatically set up alarm bells in everyone's heads. OSX is lucky in this respect - it has Sparkle, which for a large part has become the de facto software updater for OSX. It has a simple UI that users recognize and approaches universal adoption.
  - blasdel 17y ago
    Except that Sparkle is ridiculously terrible for doing security updates. Since it doesn't ship with the OS or even provide a means to have a centralized second-party updater, every app has its own copy in its bundle, and it only gets run when the app is running (and by default only on launch). Vulnerabilities in need of patching for desktop apps generally take the form of accidentally executing malicious input -- with Sparkle in a document-based Cocoa app, that input is already being parsed before Sparkle is loaded. It's even worse for plugins -- if you use ClickToFlash you know exactly what I mean -- as a plugin to a Webkit plugin, Sparkle runs roughshod over the address spaces of every Webkit app. If said Webkit app itself uses Sparkle, you're fucked, especially if it's a different version of Sparkle, or one of it's many forks.
    - wmf 17y ago
      Sparkle seems pretty good to me compared to the Windows world where apps either don't self-update at all or each app has its own updater daemon. Perhaps a single Sparkle daemon would be better, but it's hardly terrible as it is now.
doctorosdeck 17y ago
Apple including antivirus is probably a smart move for the future, but in the short term I hope more mac users start to realize that their computers are still capable of being infected, albeit a lot less likely.

16 points by e1ven 17y ago

I don't think this invalidates any of Apple's marketing speak because it still "just works." The fact that this is built into the OS and doesn't have to be separately installed, upgraded, or managed fits in perfectly with what makes OS X a great and easy to use OS.

daeken 17y ago
Except that antivirus software is, by definition, always playing catchup. When you hit the point that you need antivirus software, you've already lost.
- tptacek 17y ago
  OS X is nowhere near needing antivirus software, regardless of what features the OS X security team has managed to get added to the release. Just another example of the difference between "safety" and "security". Houses in Kennilworth, IL need less security than houses in Rogers Park --- there are something like 192 police officers per Kennilworth township block --- and yet Kennilworth houses can be counted on to have state-of-the-art security, because they can, and state-of-the-art security is a selling point.
  - daeken 17y ago
    OS X doesn't need antivirus software, and I didn't say that it did. Not needing it is a selling point, saying "you know, we don't need it, but we threw it in there anyway despite that it's worthless" isn't.
    - tptacek 17y ago
      Not needing and having are two different selling points, both in evidence here.
      - daeken 17y ago
        Having it negates the "not needing it" selling point IMO. In addition, it being worthless and taking up space and CPU cycles (however passive it is) is a negative in my book. I don't see how it's a selling point at all.
        tptacek 17y ago
        Most users will see any security feature as a net positive. Note the positive publicity (amongst normal users) for Leopard ASLR, a feature that adds no real security. Adding basic anti-malware features to the OS will not negate any of the security value prop in Snow Leopard. I share your take on antivirus software, but do note that preventing a user from installing something with a known virus on it does not have negative utility.
        arebop 17y ago
        presumably details on why Leopard ASLR "adds no real security" are discussed in http://www.matasano.com/log/986/what-weve-since-learned-about-leopard-security-features/ http://www.matasano.com/log/986/what-weve-since-learned-abou..., which will eventually be reachable again?
        tptacek 17y ago
        Yep. Short answer: Leopard didn't randomize important core libraries.
        bvttf 17y ago
        Is there any confirmation that Snow Leopard has fixed this?
- SamAtt 17y ago
  If Macs 'needed' antivirus software it would be necessary on all versions. Just because they've decided to proactively include it doesn't mean they need it.
- joezydeco 17y ago
  If this type of feature can prevent a good portion of users from unknowingly installing malware via random .dmg files loaded from the net, then I'm all for it. So many people these days just install anything without really checking what it is. I don't consider this anti-viral, more like a condom for the lazier users.

pohl 17y ago

The observation is that there is an anti-malware facility. Then there's a leap to the conclusion that it is an anti-virus facility. Did I miss some important detail here? I thought a virus was a very specific type of malware, and there's not enough detail to conclude that it is "anti-virus".

tptacek 17y ago
Meh. There's no meaningful difference. Malware's the general term. A virus is malware that spreads passively. A worm is malware that spreads actively. "Trojan" is a bad term for the malware trait (which worms and viruses can have) of allowing unauthorized users access to the infected host. It's probably better not to dignify the "science" of malware by enforcing proper usage of terminology.
- pohl 17y ago
  The distinction becomes relevant when comparing operating systems and their relative susceptibilities to viruses. That a given operating system is vulnerable to malware in general is not notable, because users will be duped by dancing babies, porn, and infected stolen software. That a given operating system ever allowed unaided self-replication take place is, and this is where Apple's marketing message has been placed.
  - wmf 17y ago
    I see your point that an OS that only gets trojans is better than an OS that gets trojans, viruses, and worms. However, I think it is possible to confine trojans better than we do today and it would be a shame to just give up hope on that front.
  - tptacek 17y ago
    Huh? There is no feature in OS X that makes it any harder to write self-replicating code ("worms"). Code running in almost any OS X process has full access to all the xnu system calls, and (invariably) to at least one user's home directory and Library/ folder. There's no operating system in common use for which malware distinctions are meaningful. They're all equally vulnerable.

e1ven 17y ago

There is independent confirmation of this at the MacRumors forums. http://forums.macrumors.com/showthread.php?t=768932 http://forums.macrumors.com/showthread.php?t=768932

potatolicious 17y ago
That thread actually brings up a really good point: we need to train users to update apps only via the official OS-sanctioned update method (Windows Updater, OSX Update, etc), or via the app's built-in update mechanism. The sort of "oh hey, QuickTime needs to update, run this file" should automatically set up alarm bells in everyone's heads. OSX is lucky in this respect - it has Sparkle, which for a large part has become the de facto software updater for OSX. It has a simple UI that users recognize and approaches universal adoption.
- blasdel 17y ago
  Except that Sparkle is ridiculously terrible for doing security updates. Since it doesn't ship with the OS or even provide a means to have a centralized second-party updater, every app has its own copy in its bundle, and it only gets run when the app is running (and by default only on launch). Vulnerabilities in need of patching for desktop apps generally take the form of accidentally executing malicious input -- with Sparkle in a document-based Cocoa app, that input is already being parsed before Sparkle is loaded. It's even worse for plugins -- if you use ClickToFlash you know exactly what I mean -- as a plugin to a Webkit plugin, Sparkle runs roughshod over the address spaces of every Webkit app. If said Webkit app itself uses Sparkle, you're fucked, especially if it's a different version of Sparkle, or one of it's many forks.
  - wmf 17y ago
    Sparkle seems pretty good to me compared to the Windows world where apps either don't self-update at all or each app has its own updater daemon. Perhaps a single Sparkle daemon would be better, but it's hardly terrible as it is now.

doctorosdeck 17y ago

Apple including antivirus is probably a smart move for the future, but in the short term I hope more mac users start to realize that their computers are still capable of being infected, albeit a lot less likely.