Slashdot Mirror


Report That OS X Snow Leopard May Include Antivirus

File this firmly in the "rumor" category for now. the JoshMeister writes (in the third person) "Mac antivirus company Intego broke the story this morning that Apple is apparently including antivirus functionality in its upcoming operating system, Snow Leopard. But which antivirus engine is Apple using? Security researcher Joshua Long discusses the likely candidates."

39 of 335 comments (clear)

  1. Virus on MAC ? by Anonymous Coward · · Score: 4, Funny

    bah, what respectful virus author targets anything but the Microsoft OS ?

    1. Re:Virus on MAC ? by gad_zuki! · · Score: 5, Insightful

      >It's a trojan that only installs if you're stupid enough to download a program from a dodgy source

      Err, thats pretty much the biggest vector for malware. Pick any popular app for Windows, go to pirate bay, download it, run it, and guess what? You have an infection.

      Storm botnet was built by people double-clicking greetingcard.exe.

      Dont underestimate people's abilities to go out of their way to find malware to run. You'll find tha you dont need to exploit any vulnerability other than ignorant on the user's part to root the machine.

    2. Re:Virus on MAC ? by eldavojohn · · Score: 5, Insightful

      The "virus"mentioned in the screen shot isn't much of a virus. It's a trojan that only installs if you're stupid enough ...

      I could put Ubuntu on a netbook and give it to my sister and she'd have no clue how to use it. But you can bet every last cent that if the source code to a virus was presented to her she would have it compiled (with all the right flags set to target her correct OSX version) and installed in a few minutes. It's borderline magic. Did you know they have LimeWire on Macs now? She managed to find that, install it and learn how to use it on her own but didn't have a clue as to how to move pictures from her old Windows machine to her MacBook. If only curing cancer compromised your computer, she'd have that done in a heart beat.

      I knew she would be better off with a mac but your statement of "anybody who uses a Mac knows" makes me cringe. Bottom line: do not underestimate stupidity.

      --
      My work here is dung.
    3. Re:Virus on MAC ? by Yvan256 · · Score: 3, Funny

      I thought that Trojans were made to prevent the replication of those huge two-legged viruses.

    4. Re:Virus on MAC ? by IntlHarvester · · Score: 5, Insightful

      I wouldn't put too much faith in "drag to install", because most malware doesn't actually need system privledges.

      Also, reportedly websites have figured out how to make Safari automatically download this trojan and then launch the installer program. Users still need to enter their password, but having the dialog automatically popup makes the social engineering step that much easier.

      --
      Business. Numbers. Money. People. Computer World.
    5. Re:Virus on MAC ? by jocknerd · · Score: 3, Insightful

      Yet, the technical or sophisticated user tends to go with a Mac. Why is that? Don't believe me? Visit a developer's conference.

    6. Re:Virus on MAC ? by K.+S.+Kyosuke · · Score: 3, Funny

      I.e., "Beware of the Snow Leopard"?

      --
      Ezekiel 23:20
    7. Re:Virus on MAC ? by MBGMorden · · Score: 4, Insightful

      Have you seen the obscene amount of Mac shareware out there? Don't get me wrong a lot of stuff does "just work" on the Mac, but a lot of niches aren't filled, and it seems like while on Windows you're likely to find spyware infested free programs, and on Linux you're likely to find reputable OSS programs, on Mac you better be prepared to pay $20 a pop for all those little apps. Maybe I'm just being naive, but it doesn't seem like they'd all be around if some significant chunk of mac users weren't downloading and buying these programs.

      --
      "People who think they know everything are very annoying to those of us who do."-Mark Twain
    8. Re:Virus on MAC ? by tagno25 · · Score: 5, Funny

      I thought that Trojans were made to prevent the replication of those huge two-legged viruses.

      No, that is condoms made by a company called Trojan. The virus trojans are based off of the wooden horse left outside Troy by the Greeks. It looked legitimate, but it was a trap.
      http://en.wikipedia.org/wiki/Trojan_horse_(computing)

    9. Re:Virus on MAC ? by geekboy642 · · Score: 3, Informative

      The mac "culture" is much more willing to purchase a $20 app that fills a tidy hole in their system. This is both an emergent behavior and a forced behavior. Forced because the ecosystem for macs is a fraction of that for windows, the number of cracking or hacking groups targeting pay-for apps is much lower. Emergent because, the already high barrier to entry (iTax) is locking out a large amount of those who are inclined to buy a $300 PC and fill it with warez. Both of these factors also work to suppress the creation of an equivalent to the spyware-infested freeware app "scene" present on Windows.

      --
      Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
    10. Re:Virus on MAC ? by Savage-Rabbit · · Score: 4, Insightful

      I knew she would be better off with a mac but your statement of "anybody who uses a Mac knows" makes me cringe. Bottom line: do not underestimate stupidity.

      I wouldn't call it stupidity. Just because somebody isn't aware of all possible malware infection routes that doesn't make them stupid, naive is perhaps a better word for it or perhaps just unlucky. Expecting the average user to be aware of every possible way of getting his computer infected is about as realistic as expecting a non-medically educated person to be aware of all possible ways to get a disease. We all know any number of things we can do to avoid getting diseases, some of these behaviors are even hardwired into our DNA but they aren't 100% effective. How many of us are likely to go through life without ever catching a disease like, say, Influenza?

      --
      Only to idiots, are orders laws.
      -- Henning von Tresckow
    11. Re:Virus on MAC ? by risk+one · · Score: 3, Funny

      Snow leopard uses the Symantec A/V engine, so it is 200% slower.

      Snow leopard? More like slow leopard!

      (I had to do it... there was no other way)

    12. Re:Virus on MAC ? by SBrach · · Score: 4, Funny

      Says the guy who can't figure out the difference between "to" and "too."

    13. Re:Virus on MAC ? by indiechild · · Score: 4, Insightful

      Sounds like you haven't seen the Mac warez scene. There's heaps of warez, cracks, serials out there for Mac applications -- you can get them as readily as you can get Windows ones.

      I do think it's true that Mac users are more likely to buy/pay for "shareware" apps though.

      Offtopic, but "shareware" seems like the wrong word for it. Doesn't feel quite right.

      Also, I dispute the notion that there's not much open source/freeware on Mac OS X. There is, but like a lot of open source stuff, they're often not the best-of-breed. I'd rather pay some money and get the best there is, like Transmit (for FTP) and CSSEdit/Espresso (for editing HTML and CSS).

      The open source apps I use the most on OS X are Firefox and VLC.

  2. Snowing ? by HW_Hack · · Score: 5, Funny

    Can we get a weather report from Hell ?

    --
    Its not the years, its the mileage .....
    1. Re:Snowing ? by BollocksToThis · · Score: 5, Funny

      It's currently "SCO is not dead yet", with a 25% chance of "Microsoft acts with integrity".

      --
      This sig is part of your complete breakfast.
  3. Scanning by schmidt349 · · Score: 4, Funny

    At its core a virus scanner is just a wrapper around a multipattern byte matcher, so maybe it's better to ask whether they're using Aho-Corasick or Wu-Manber...

  4. I use ClamXAV by Fallen+Kell · · Score: 4, Informative

    Personally I use ClamXAV and always have. Mainly because I have a tripple boot system (not that I use much more than OS X, but every once in a while I need to use Windows or Linux for testing something). Because of the fact that there are other operating systems on my box, I wanted an anti-virus in case somehow it could affect the other instances on the system.

    --
    We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
  5. Nonsense by TerrenceCoggins · · Score: 5, Funny

    Virus protection? If Mac vs PC guy has taught me anything, it's that MAC'S DON'T GET VIRUSES! Don't lie to me...

    1. Re:Nonsense by tlhIngan · · Score: 3, Informative

      Virus protection? If Mac vs PC guy has taught me anything, it's that MAC'S DON'T GET VIRUSES! Don't lie to me...

      Heck, maybe it's also why Linux virus scanners exist. Besides the oddball Mac trojan, the Mac AV probably keeps up with PC viruses as well. Not because they can run them, but to avoid being a "carrier". If you use the Windows firesharing, many worms seek out the shares. It's possible those worms may find an open Mac share and infect files in there. The Mac won't get infected, but Windows PCs accessing those shares can become infected. Better the Mac catch it and quarantine...

    2. Re:Nonsense by dkf · · Score: 3, Insightful

      I don't understand why you people think that any OS can be imprevious to a trojan?

      Nobody with half a brain thinks that. The only way to make an OS totally proof against trojans is to stop users from installing new apps, and that's something that general desktop computing hasn't gone down the road of.

      What's curious about OSX is that it doesn't have the sort of culture that leads to trojans being a problem. I'm not sure why this is; maybe it is because Mac users are more inclined to buy their software? (Indeed, they buy things that on other platforms would be free...) Accepting (apparently) legitimate payments is not a black hat sort of thing to do, because it is far too easy to trace back to a real identity.

      I suppose it also helps that there aren't that many "usability of security" issues in the supplied OSX core apps, so users are less likely to do something catastrophic by accident.

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
  6. Re:Linked Twitter Feed? Reporting in the Third Per by moderatorrater · · Score: 3, Insightful

    In their defense, doesn't the submitter get to choose where their name links to? Seems to me that we should all point and laugh at the submitter who thinks we all want to know what he is doing at all times.

  7. good for Apple by pak9rabid · · Score: 3, Insightful

    Better to get a head start on the AV game now rather than later. If Apple's dream does in fact come true and the majority of desktop users switch to Macs, I'd expect to see a sruge of malware targeted for the Mac platform. Anyone that thinks Macs (or any other platform) is immune to malware is living one helluva naive pipe dream.

    1. Re:good for Apple by seanadams.com · · Score: 4, Informative

      Immune? No. Reasonably secure by design, yes.

    2. Re:good for Apple by SoupIsGood+Food · · Score: 5, Insightful

      Dunno. While no platform is 100% secure, design does count for a lot. There are a lot of "proof of concept" hacks out there for the Mac, but very, very, very few "in the wild" 'sploits floating around, especially self-replicating ones like viruses and worms. The installed base of Internet-going Macs is a few dozen million at the least, and mostly personal computers with personal info and used to buy stuff online - prime targets for the big-shop black hats. I doubt very much it's not worth their while... I just think they can't go after a system with even a moderate level of security.

      I don't think this says something about Apple (see the part above about "proof of concept" hacks), I think this says a ton about Microsoft.

      I really don't buy "ecosystem" arguments - why is IIS and MSSQL pwnd on a regular basis by automated attacks, but Apache and MySQL only once in a blue moon (and Oracle almost never)?

    3. Re:good for Apple by pak9rabid · · Score: 3, Insightful

      That has never been a dream of Apple's...

      Rubbish. Maximizing profits is the dream of every publicly-held company, whether the founders like it or not. Go out and ask some Apple shareholders...I have a feeling you'll hear a different story.

      Apple sees themselves as selling a luxury brand experience. That means it must NEVER become too popular lest it lose it's cache. The success of the iPod and iPhone are already pushing Apple market share to dangerous levels but they are just 'consumer electronics' and not the Mac itself.

      The funny thing is that you actually believe that. Yes, Apple is considered a "luxury brand", but to suggest that Apple would prefer not to sell their products that they spend such a large amount of money marketing and advertising in order to preserve their "cache" is one of the most ridiculous things I've heard. Steve Jobs maybe an arrogant elitist, but he's a businessman first and foremost.

  8. Re:AV for consumers will be free by megamerican · · Score: 3, Funny

    The most effective thing they give users to protect from malware is a hammer to hit the person in the head each time they install or click on something they don't trust.

    --
    If you have something that you dont want anyone to know, maybe you shouldnt be doing it in the first place -Eric Schmidt
  9. Re:Linux Foundation announces partnership with McA by hodet · · Score: 4, Funny
    ...followed up by

    The Linux foundation regrets distributing Mcaffee which is a rootkit whose name looks a lot like McAfee.

  10. Re:AV for consumers will be free by maxume · · Score: 5, Informative

    I don't think that would help, mad-clickers implicitly trust everything.

    --
    Nerd rage is the funniest rage.
  11. McAfee by SnarfQuest · · Score: 4, Funny

    Let them run McAfee. Those Macs run too fast as it is, and that should make those shooter games playable by us mere humans.

    --
    Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
  12. Our terrible terrible secret... by Garbad+Ropedink · · Score: 5, Funny

    It's time we came clean. Macs do get viruses. Actually they get a lot of viruses. Really the OS is basically viruses and itunes. We pretend like we can work on these systems but it's just a screen full of viruses all having sex with eachother. The reason you never heard about it because back in ought 3' we took an oath to never reveal that terrible terrible truth. We relied on Windows users hatred of Macs preventing them from finding out. But, now that it's out in the open I suppose we ought to move forward and try to rebuild, maybe accept the situation and try to secure our OS.

    So uhh.. Windows users... How do you make a *shudder* bug fix?

    --
    And that was the last Terry Fox run I ever participated in.
  13. Security Details by 99BottlesOfBeerInMyF · · Score: 5, Insightful

    Apple has been light on details they have made public about Snow Leopard. We know they implemented a CDSA security architecture, expanded use of the sandboxing, and now there is this report of actual malware scanning, but the info on Apple.com is basically nonexistent. I surmise this is intentional. Security people either have developer accounts or will read up on this stuff in technical papers when NDA's expire next week. For regular users, Apple doesn't even want to bring up security as an issue. They will make blanket marketing statements about it, but they would rather leave all the details to more technical venues. This was their policy for Leopard too, with most users having no clue that a full port of TrustedBSD's mandatory access controls was included and being used to sandbox certain potentially vulnerable services.

  14. Amen by AlexBirch · · Score: 4, Insightful

    There was a guy who was studying technical writing at my university. He uninstalled his anti-virus software because it was preventing him from installing some free software he wanted.

  15. Re:Come the time for rain, it'll pour. by 99BottlesOfBeerInMyF · · Score: 4, Insightful

    Problem with having a single, unified anti-virus (if ever such a thing is reliably possible), programmers will have an easier time guessing what protections they'll face when creating a virus.

    I agree, to some extent. In terms of attacks on the antivirus system itself a single system may be more vulnerable. In terms of bypassing signatures, however, there is no reason centralized anti-malware cannot draw signatures from disparate feeds, the user subscribes to, be they supplied by Apple, open projects, or commercial companies, for free, or charge.

    That said, Apple including malware detection doesn't mean users can't install other malware detection services as well. ClamAV isn't going away just because Apple ships a built in competitor.

    End users aren't encouraged to practice personal responsibility, they pay and trust... pay for trust...

    From Apple's Snow Leopard Web site:

    Security Advice The Mac is designed with built-in technologies that provide protection against malicious software and security threats right out of the box. However, since no system can be 100 percent immune from every threat, antivirus software may offer additional protection. Here are some other ways to help keep your information as safe as possible:

    • Download files only from known and trusted websites.
    • Use FileVault to encrypt your most important documents.
    • Control access to your Mac by locking your screen after a period of inactivity.
    • Securely delete outdated sensitive files with the Secure Empty Trash command.

    That sounds to me like end users are being encouraged to practice personal responsibility.

  16. Re:AV for consumers will be free by fuzzyfuzzyfungus · · Score: 3, Insightful

    Though, to make up for it, they are likely to blame virtually any occurrence, from their ISP's technical issues to a full hard drive, on "viruses".

  17. Given that we've had the golden master for weeks.. by diamondsw · · Score: 4, Informative

    ...and no such thing exists there, this would seem to be completely made up bullshit.

    --
    I don't know what kind of crack I was on, but I suspect it was decaf.
  18. Hmm.. Speculation on a rumour from unkown source. by MROD · · Score: 5, Informative

    So, we have a Slashdot story speculating about the outcome of a story on another site which uses unknown, and not necessarily reliable source, about a possible feature in an unreleased OS.

    Can we please wait until there is real evidence before shouting that the sky's falling please.

    Oh, sorry, this is Slashdot! ;-)

    As for the article: *IF* it is true, fine! Who cares what anti-virus engine it uses as long as it works and is ready for any dangerous malware which does come along for MacOS?

    (And for those who wish to gloat, no OS is fully immune, especially from the security hole at the keyboard. Why does Linux need an anti-virus product like ClamAV?! Linux doesn't have any viruses.... ;-))

    --

    Agrajag: "Oh no, not again!"
  19. Mac OS X Security Architecture by Gary+W.+Longsine · · Score: 5, Informative

    Although some Snow Leopard details may not be available yet, most components of the Mac OS X security architecture pre-date Snow Leopard, and details are available, in places like this... Mac OS X Security Architecture

    --
    If you mod me down, I shall become more powerful than you could possibly imagine.
  20. Re:Bound to happen by 99BottlesOfBeerInMyF · · Score: 4, Interesting

    So when will they actually implement something genuinely useful against real security threats, like package management?

    If you don't think Apple has been adding useful technologies to stop security threats, you haven't been paying attention. Of course most people don't they just assume because Apple doesn't advertise their security technologies to the mainstream public, such technologies they don't exist. You remember that vulnerability in Apple's ZerConf implementation (one of the few enabled by default services on OS X)? No? That's because Apple had sandboxed the entire service in Leopard making the vulnerability impossible to exploit without another exploit for the sandbox, which never materialized. Maybe you remember that said vulnerability did exist on several Linux distros and was exploitable?