Slashdot Mirror
Report That OS X Snow Leopard May Include Antivirus
File this firmly in the "rumor" category for now. the JoshMeister writes (in the third person) "Mac antivirus company Intego broke the story this morning that Apple is apparently including antivirus functionality in its upcoming operating system, Snow Leopard. But which antivirus engine is Apple using? Security researcher Joshua Long discusses the likely candidates."
bah, what respectful virus author targets anything but the Microsoft OS ?
Can we get a weather report from Hell ?
Its not the years, its the mileage
laughing @Slashdot eldavojohn watches the last journalistic integrity ebb #apple #mac #antivirus #snowleopard #security
My work here is dung.
At its core a virus scanner is just a wrapper around a multipattern byte matcher, so maybe it's better to ask whether they're using Aho-Corasick or Wu-Manber...
Microsoft is soon to have free-for-consumers anti-virus and anti-malware software as well:
http://www.microsoft.com/security_essentials/
Personally I use ClamXAV and always have. Mainly because I have a tripple boot system (not that I use much more than OS X, but every once in a while I need to use Windows or Linux for testing something). Because of the fact that there are other operating systems on my box, I wanted an anti-virus in case somehow it could affect the other instances on the system.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
Virus protection? If Mac vs PC guy has taught me anything, it's that MAC'S DON'T GET VIRUSES! Don't lie to me...
San Francisco, AP
In response to a sharp rise in popularity in 2014 (the year of the Linux desktop,) the Linux Foundation has announced that antivirus technology from McAffee will be built into all versions of the Linux kernel starting with v 2.6.45. When asked about this latest development, Linus Torvalds said, "I believe that adding 2,476,000 lines of antivirus code in order to protect Linux users is the most effective solution and can only benefit Linux users for years to come."
That'll be the day that hell freezes over.
In their defense, doesn't the submitter get to choose where their name links to? Seems to me that we should all point and laugh at the submitter who thinks we all want to know what he is doing at all times.
Better to get a head start on the AV game now rather than later. If Apple's dream does in fact come true and the majority of desktop users switch to Macs, I'd expect to see a sruge of malware targeted for the Mac platform. Anyone that thinks Macs (or any other platform) is immune to malware is living one helluva naive pipe dream.
As OS X becomes more popular it's pretty much inevitable that people will *want* AV on their computers. Be it from the paranoid to the clueless who "heard from a friend of a friend that Macs are insecure" -- or just someone playing it safe -- a move like this would make sense to ease consumer fears. Yes, they already sell AV products from third-parties, but in the same way Windows has its own set of security tools this is Apple's way of showing that you don't just have to trust them, they're actively involved in proving the safety of their product.
My other sig is an import.
The Linux foundation regrets distributing Mcaffee which is a rootkit whose name looks a lot like McAfee.
Let them run McAfee. Those Macs run too fast as it is, and that should make those shooter games playable by us mere humans.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
It's time we came clean. Macs do get viruses. Actually they get a lot of viruses. Really the OS is basically viruses and itunes. We pretend like we can work on these systems but it's just a screen full of viruses all having sex with eachother. The reason you never heard about it because back in ought 3' we took an oath to never reveal that terrible terrible truth. We relied on Windows users hatred of Macs preventing them from finding out. But, now that it's out in the open I suppose we ought to move forward and try to rebuild, maybe accept the situation and try to secure our OS.
So uhh.. Windows users... How do you make a *shudder* bug fix?
And that was the last Terry Fox run I ever participated in.
Apple has been light on details they have made public about Snow Leopard. We know they implemented a CDSA security architecture, expanded use of the sandboxing, and now there is this report of actual malware scanning, but the info on Apple.com is basically nonexistent. I surmise this is intentional. Security people either have developer accounts or will read up on this stuff in technical papers when NDA's expire next week. For regular users, Apple doesn't even want to bring up security as an issue. They will make blanket marketing statements about it, but they would rather leave all the details to more technical venues. This was their policy for Leopard too, with most users having no clue that a full port of TrustedBSD's mandatory access controls was included and being used to sandbox certain potentially vulnerable services.
There was a guy who was studying technical writing at my university. He uninstalled his anti-virus software because it was preventing him from installing some free software he wanted.
apparently 1325 followers do. :-/
Problem with having a single, unified anti-virus (if ever such a thing is reliably possible), programmers will have an easier time guessing what protections they'll face when creating a virus.
Windows might not be the most... or... almost... close to the most stable series of operating systems, but there sure is a fair bit of variety involved in each installation. A vulnerability that can hit any generic OS X installation hard will be able to hit every other generic OS X installation hard.
This'll end in tears if Apple and friends don't keep vigilant on every threat. A problem with the die-hard proprietary and user friendly nature of Apple products is Apple are now the sole caretaker, the mother and father, the reason and the nonsense to every single computer they've made residency in. End users aren't encouraged to practice personal responsibility, they pay and trust... pay for trust...
Think Different, Indeed.
"Most people, I think, don't even know what a rootkit is, so why should they care about it?"
...and no such thing exists there, this would seem to be completely made up bullshit.
I don't know what kind of crack I was on, but I suspect it was decaf.
So, we have a Slashdot story speculating about the outcome of a story on another site which uses unknown, and not necessarily reliable source, about a possible feature in an unreleased OS.
Can we please wait until there is real evidence before shouting that the sky's falling please.
Oh, sorry, this is Slashdot! ;-)
As for the article: *IF* it is true, fine! Who cares what anti-virus engine it uses as long as it works and is ready for any dangerous malware which does come along for MacOS?
(And for those who wish to gloat, no OS is fully immune, especially from the security hole at the keyboard. Why does Linux need an anti-virus product like ClamAV?! Linux doesn't have any viruses.... ;-))
Agrajag: "Oh no, not again!"
Although some Snow Leopard details may not be available yet, most components of the Mac OS X security architecture pre-date Snow Leopard, and details are available, in places like this... Mac OS X Security Architecture
If you mod me down, I shall become more powerful than you could possibly imagine.
FWIW, the file containing virus definitions is located at: /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist
Windows users must have a lot of disposable time if they wish to choose Dell's junkware.
What changed under Obama? Nothing Good
I think this is simply a signature engine built into the Safari downloader. Mozilla Firefox has the exact same thing in version 3.5. After you download a file, it runs a signature scan on it and warns you if it found a virus sig. Nothing really impressive about it, but it is a nice to have feature in Safari.
Leopard users could just use Mozilla Firefox 3.52 and have the same feature, or I imagine Safari 4 would also do this on older versions of OS X.
"When the president does it, that means it's not illegal." - Richard M. Nixon
Does Apple use a UNIX architecture, with privilege separation and a minimal attack surface. Yes, and that's good. Does that help? Not really. Desktop security is a lot more sophisticated today than it was a decade ago. But so are the attackers. First, while Apple has cut down on the 'invisible' attack surface of running, internet exposed services, you've still got a web browser and that's turned into a monstrous attack surface in the past few years. Furthermore, Apple has poor defense in depth. ASLR in OS X is broken and Safari isn't sandboxed. That's why Apple has loses pwn2own, badly.
You complain about the UNIX security systems being useless on one hand, but then complain about lack of defense in depth on the browser... pick one please. And frankly the lack of any external services enabled by default is hugely underrated as the primary reason the system does not have any viruses in the wild to date. To an attacker it's not worth the effort to build attacks against any of the built in services because odds are they will not be running, where on Windows there are a number of services it's worth attacking.
There is actually light sandboxing in that the OS warns you before opening any application downloaded via Safari, and of course there's the natural aspect of the browser only writing to the user directory...
And if you're going to bring up ASLR support, since this is a story about Snow Leopard you could acknowledge they fixed that issue.
Second, and more important: security features aren't worth a damn when the user opens the door, and user-initiated security breaches are by far the most common. Sure, you can keep the malware out of the system files, but malware doesn't need access to the system files to do its job.
That is true enough, that's the biggest point of attack - but there again OS X has chosen possibly the best possible way to address these attacks. Mandatory warning before running new executables, along with an extra note if it's infected. I honestly don't think it's going to get much better than that in terms of processes that protect users from trojans.
"There is more worth loving than we have strength to love." - Brian Jay Stanley