Do Macs need anti virus or firewall sftware?

azeemtn said:

This is quite a funny thread now.

Click to expand...

Not really.

azeemtn said:

I've been doing computer security for 15 years now, and currently run a nationwide security team. We specialize in security audits, attacks, and threat remediation.

Click to expand...

In other words, you profit by scaring people into thinking they're at risk, despite the fact that there are no viable threats on a Mac.

azeemtn said:

It is quite obvious in the industry that there is more going on with Mac's than people want to readily admit - mostly out of ignorance, and sometimes out of fan-boyism.

Click to expand...

There's plenty going on with Macs, but so far, nothing has turned into an actual threat without the user being a participant.

azeemtn said:

Here is a thread from 2008, not recently:
http://blog.trendmicro.com/new-malware-threatens-mac-users/

Click to expand...

http://www.tuaw.com/2008/11/21/new-mac-os-x-malware-osx*lamzev-a/

This is not a virus, and users must actually launch the app for it to install its payload .

azeemtn said:

Here's another from 2007:
http://www.v3.co.uk/vnunet/news/2202531/trojan-codec-spreads

Click to expand...

http://www.macworld.com/2007/10/firstlooks/trojanhorse/index.php

As you may have read, a new piece of OS X malware has been discovered. Intego has named this malware the OSX.RSPlug.A Trojan Horse. Note that this malware is not a virus— it can’t self-propagate from one machine to another .

Again, it's a trojan, not a virus, and it requires the user to install it with an admin password.

azeemtn said:

Here is one from 2010, read this one if are really willing to be objective:

http://www.dailytech.com/New+Trojan+Virus+Attacks+Mac+Computers+Via+Social+Networking+Sites/article20008.htm

Click to expand...

http://reviews.cnet.com/8301-13727*7-20020892-263.html

The installer cannot do anything to your system if you do not supply your password , so unlike a virus that can self-propagate, this should be relatively easy to remove by just deleting the file.

Another trojan that requires the user to install and provide an admin password in order to do something. I'm seeing a trend here.

azeemtn said:

Here's one more:
http://www.wired.com/politics/security/news/2007/11/mac*trojan

I can serve up about 100 of these for those of you stil willing to tell others that Mac's are safe the way they are..

Click to expand...

And every single one of them requires the user to download, install and provide an admin password. None can propagate on their own.

azeemtn said:

Here's some attacks testing where a Mac was taken over in 10 seconds, fully patched at the time. This was not at some quiet, uknown convention either:

http://www.computerworld.com/s/article/9129978/Researcher*cracks*Mac*in*10*seconds*at*PWN2OWN*wins*5k

Click to expand...

Charlie Miller's hacks are prepared in advance. It took a lot longer than 10 seconds to research and actually write and debug it. He also had physical access to the target machine.

azeemtn said:

Here's a article from Oct of 2010. It shows the growing threat of Mac Viruses, talks about how every vendor is now starting to prepare Mac AV software , and has the President of Panda security discuss how he also believes that once the Mac platform reaching enough of an audience, the games will really begin:

http://news.techworld.com/security/3245158/mac-users-warned-of-growing-virus-threat/

Click to expand...

People have been saying that for years and it hasn't happened. Best part of that article:

Relative to Windows, the comparison is no contest. New Windows malware threats outnumber Apple ones by between 100-1 and 500-1 depending on who you ask, and that ignores the vastly greater sophistication they exhibit.

And as I've said before, any anti-virus product you get today won't protect you from something not yet written since nobody knows what a virus from the future will do or how it will work. That means that you are still at risk, with or without anti-virus software.

Plus, many times, the anti-virus software itself causes problems of its own:

http://www.macfixit.com/article.php?story=20060511065134478

• The AutoProtect component of Norton AntiVirus produced an issue with apparent corruption of Mac OS X temp files that could result in spiking processor usage and complete system unresponsiveness .

• A previous version of Sophos' AntiVirus software generated false positives for the "OSX/Inqtana.B worm", invoking users to delete critical application and system files and causing serious issues...Sophos quickly resolved the issue, but results of the false positives were, in some cases, disastrous. Users who thought their systems were infected deleted dozens (in some cases hundreds) of critical files rendering some applications useless and eliminating important data .

• Virex from McAfee (the company that released the aforementioned warning that Mac malware threats were up more than 200 percent in the past year) was a component of the .Mac subscribers package up until mid-2005, when Apple decided to pull the offering due to a number of issues documented here on MacFixIt, including slow overall system performance, constant fan activity, degraded performance in some applications and more.

• In 2003, VirusBarrier X caused an issue where the system became totally unresponsive and refuses to start up properly from that moment forth.

• Another minor issue was caused by VirusBarrier in late 2005, where hard drive space was rapidly decimated by the creation of several thousand tiny (4 KB) files spawned by VirusBarrier.

• In one case, application of the Adobe Illustrator CS2 12.0.1 updater was prevented by ClamXav's scanning operation.

azeemtn said:

So, there's a lot of conjecture about this not being real. I have provided actual links so you can read for yourself, not just providing my opinion, or sitting on the fact that since my personal Mac hasn't had a virus, then they must all be safe..

Click to expand...

No, what you've provided are sensationalist headlines from those with a vested interest in selling anti-virus products (and even with links to buy) or from web sites who want more traffic.

Weve had about 10 macs these last 25 years and also run PC's at home. Mac OS is built on Unix and bulletproof. You dont need anti virus. Ive had it before and never needed it.

The last Trojan horse I got a few years back was easily removed since it couldn't act out in an OS it wasn't familiar with,most bug writers write for PC's. Macs are fun and great computers. With all that said so are PC's if you take care of them and ad a firewall,enable the internal one,use anti virus and run a program at night every so often like mechanic system 6. my sons PC gamer is going strong after 8 years...only replaced the CD drive and hard drive. But he keeps it clean.The hardest thing I ever had to remove off my daughters laptop was anti virus 2010..too two days to finally get it off with its fake blue screen of death and would allow safe mode boot up but we got it off. Youll love a mac !!!!

Okay, my last response on this.

In 2008, Apple, not some company trying to make money, changed their public documents to reflect that users should run "multiple" antivirus products:

http://gizmodo.com/5100996/false-alarm-apple-mac-os-x-anti+virus-recommendation-is-old

Gizmodo found an even older document from Apple stating the same.

Many of you know Apple then rescinded this document.

The question is, did they on accident put up pages where they recommend AV programs for the mac, and then someone noticed, and they took it off?

More likely, they tried to get in in quietly after all their "Macs don't get viruses" commercials, and then had to pull it when it started getting too much attention.

The information is out there. My best advice: Do your own research and decide for yourself. Don't trust when you can read and decide on your own.

azeemtn said:

Okay, my last response on this.

In 2008, Apple, not some company trying to make money, changed their public documents to reflect that users should run "multiple" antivirus products:

http://gizmodo.com/5100996/false-alarm-apple-mac-os-x-anti+virus-recommendation-is-old

Gizmodo found an even older document from Apple stating the same.

Many of you know Apple then rescinded this document.

The question is, did they on accident put up pages where they recommend AV programs for the mac, and then someone noticed, and they took it off?

More likely, they tried to get in in quietly after all their "Macs don't get viruses" commercials, and then had to pull it when it started getting too much attention.

The information is out there. My best advice: Do your own research and decide for yourself. Don't trust when you can read and decide on your own.

Click to expand...

Indeed, talk to people who have had Macs for years. Macs don't get viruses.

Sal

azeemtn said:

Okay, my last response on this.

In 2008, Apple, not some company trying to make money, changed their public documents to reflect that users should run "multiple" antivirus products:

http://gizmodo.com/5100996/false-alarm-apple-mac-os-x-anti+virus-recommendation-is-old

Gizmodo found an even older document from Apple stating the same.

Many of you know Apple then rescinded this document.

Click to expand...

Yes they did rescind it, because it was a mistake. It was an old and obsolete article.

azeemtn said:

The question is, did they on accident put up pages where they recommend AV programs for the mac, and then someone noticed, and they took it off?

Click to expand...

There is no question, because that's what Apple said as to why they removed it.

Or are you suggesting that Apple is lying? You've already claimed that Mac users are lying about not getting malware.

azeemtn said:

More likely, they tried to get in in quietly after all their "Macs don't get viruses" commercials, and then had to pull it when it started getting too much attention.

Click to expand...

That's not supported by the facts.

azeemtn said:

The information is out there. My best advice: Do your own research and decide for yourself. Don't trust when you can read and decide on your own.

Click to expand...

Exactly. And don't fall prey to scare tactics.

I suppose the following points have been made among the many replies above, that I do not have time to read, but just in case:

1. No one has had any real trouble with virus on any recent mac system.

2. Even if a powerful virus or trojan would start propagating in the wild, there is no guarantee that any virus protection software would actually be able to remove it more efficiently than you yourself or indeed Apple with some Software update.

3. Virus protection software often (always?) makes your machine slower and less stable.

Stay away from virus protection software, but use normal precautions when you surf the web, obviously, just like you should if you have virus protection software on any system.

--
http://photophindings.blogspot.com/
http://picasaweb.google.com/nmlewan

Andy Hewitt said:

Of course now the idea is to install malware that opens specific ports that can be accessed from WAN, and I allow them to extract any user data they can find.

Click to expand...

Yeah, there is a lot more money to be made by hording a lot of machines and renting / using them as needed in the future.

Andy Hewitt said:

The way that MacOSX works, as I understand it, means that this is extremely difficult to do without the users knowledge, and authorisation. The same will apply to most Unix versions, and probably to Linux as well.

Click to expand...

Well no, not really. Linux and Unix machines get rooted quite frequently. The main reason they are secure and used as web servers is that the attack surface is kept as small as possible. This means that a Linux or Unix server will generally just have a web server application open to the world, and it will be kept up to date. Servers generally also have pretty conservative operating systems which have less bugs as they don't have all the newest bell and whistle features. My employer runs a big web service with tens of millions of users, and we frequently get hit by DDOS attacks. Generally a DDOS attack will have thousands of computers participating, but the top 20 will almost always be compromised Linux servers (top 20 by the amount of traffic they generate). These are web servers where:

• The application has not been kept up to date so people have accessed the machine with limited rights.
• The server has had a local privilege escalation vulnerability allowing the attacker to install a rootkit

There is no magic involved. Sure OSX seems to have far less vulnerabilities where you can directly get administrator rights remotely, but if you get application rights remotely and have a local privilege escalation you end up with the same end result.

gaussian blur said:

As you may have read, a new piece of OS X malware has been discovered. Intego has named this malware the OSX.RSPlug.A Trojan Horse. Note that this malware is not a virus— it can’t self-propagate from one machine to another .

Click to expand...

I wouln't concentrate too much on viruses, there has not been a virus epidemic on pc's for years either, pc's have a malware epidemic. Somehow speaking of viruses all the time feels very 2000ish.

These days mail servers have antivirus, home networks have NAT and firewalls and virus just don't spread like they used to. A huge minority of pc's are infected by trojans, and IF osx starts to be hit by malware at some point they will too.

kamina said:

gaussian blur said:

As you may have read, a new piece of OS X malware has been discovered. Intego has named this malware the OSX.RSPlug.A Trojan Horse. Note that this malware is not a virus— it can’t self-propagate from one machine to another .

Click to expand...

I wouln't concentrate too much on viruses, there has not been a virus epidemic on pc's for years either, pc's have a malware epidemic. Somehow speaking of viruses all the time feels very 2000ish.

These days mail servers have antivirus, home networks have NAT and firewalls and virus just don't spread like they used to. A huge minority of pc's are infected by trojans, and IF osx starts to be hit by malware at some point they will too.

Click to expand...

of course I meant majority, not minority

azeemtn said:

This is quite a funny thread now.

I've been doing computer security for 15 years now, and currently run a nationwide security team. We specialize in security audits, attacks, and threat remediation.

It is quite obvious in the industry that there is more going on with Mac's than people want to readily admit - mostly out of ignorance, and sometimes out of fan-boyism.

Here's a article from Oct of 2010. It shows the growing threat of Mac Viruses, talks about how every vendor is now starting to prepare Mac AV software , and has the President of Panda security discuss how he also believes that once the Mac platform reaching enough of an audience, the games will really begin:

http://news.techworld.com/security/3245158/mac-users-warned-of-growing-virus-threat/

So, there's a lot of conjecture about this not being real. I have provided actual links so you can read for yourself, not just providing my opinion,

Click to expand...

Interesting - not your opinion, but actual links. Albeit actual links to other people's opinions...

Steve

as for me, I use antivirus software, for me ProteMac NetMine ( http://www.protemac.com ) is better, than other....

In a post to this thread from about a month ago I said that I had put Sophos on both my Macs.

Well last night I removed it. It was slowing things down and it really seemed pointless. Both my machines had been all over the web and to many high risk sites yet the inital scans found nothing. Heck I even went in search of bad sites just to see if it would alert me to some potential threat, but it never did, Even so I kept it installed thinking it is good of me to keep to do so to protect the windows people I deal with.

Well I have decided its not my job to let my computer get slowed down by anti virus software so that windows users can feel safer when they deal with me, they should take the effort to protect themselves

For now I feel perfectly safe by just not using an administrator account for day to day activity and keeping Java disabled.

--
My kit - D200, 10.5mm f/2.8D, 35mm f/1.8G, 50mm f/1.4G & 70-300VR
Wifes kit – D80, 18-105VR
SB800, SB600 and other misc lighting equipment

Lenses worth mentioning owned and sold– 12-24 f/4, 17-55 f/2.8, 35-70 f/2.8, 80-200 f/2.8, 20mm f/2.8, 35mm f/2, 50mm f/1.8, 50mm f/1.4D, 60mm f/2.8D, 85mm f/1.8, 105mm f/2D-DC, 180mm f/2.8, 300mm f/4D-ED

It probably isn't worth it for me to weigh in on this. I am definitely not an expert, nor have I devoted a lot of time to researching the topic. But FWIW this is what I have distilled out of all that I have read.

1) It is just a matter of time, wait until Macs have a larger market share then you will see! This argument is total hogwash! In the Eco-system there is a principle that no resource remains long exploited. What this means is if you are eatable some one will find out and eat you. There are too many teen-age nerds lusting after making a name for themselves and too many criminal 'entrepreneurs' for the 8 to 11 percent of Mac users to remain uneaten if it were reasonable to do so.

2) The real key is Unix vs Dos (the original foundation for Windows). Both reflect the mindset of their developers. Unix puts the ultimate control in the hands the user/system admin. Windows/Dos puts the ultimate control in the hands of the OS developer and 3rd party software developers. Essentially it is the Bill Gates mentality that allows outside code to enter and take control, because it uses the same rights he set aside to himself to decide what processes could and could not run on your system. Until this changes Mac will always have an inherent advantage over Windows.

razormac said:

It probably isn't worth it for me to weigh in on this. I am definitely not an expert, nor have I devoted a lot of time to researching the topic. But FWIW this is what I have distilled out of all that I have read.

1) It is just a matter of time, wait until Macs have a larger market share then you will see! This argument is total hogwash! In the Eco-system there is a principle that no resource remains long exploited. What this means is if you are eatable some one will find out and eat you. There are too many teen-age nerds lusting after making a name for themselves and too many criminal 'entrepreneurs' for the 8 to 11 percent of Mac users to remain uneaten if it were reasonable to do so.

2) The real key is Unix vs Dos (the original foundation for Windows). Both reflect the mindset of their developers. Unix puts the ultimate control in the hands the user/system admin. Windows/Dos puts the ultimate control in the hands of the OS developer and 3rd party software developers. Essentially it is the Bill Gates mentality that allows outside code to enter and take control, because it uses the same rights he set aside to himself to decide what processes could and could not run on your system. Until this changes Mac will always have an inherent advantage over Windows.

Click to expand...

Remark re: #2: This is all true, but somehow Adobe, Skype and other developers managed to swing by Growl that installs on your system without ANY opportunity for you to object, it just does, and then loads itself, and asks you to update it to the newest version. Thats just to show something about the "ultimate control".

Regarding the rest I alwasy thought that activating built in Firewall is sufficient. SOme people went further and installed Little snitch, which is much more detailed. I have not heard of any successful AntiVirus software as there were no viruses yet, and any software of that sort is usually built around the existing viruses.

I think this is a very good point - virus software usually only protects against known threats. When a new threat comes out the anti virus software writers and the OS writers scramble to patch their operating systems and to write new threat patterns so that the OS is once again safe and the anti virus software can protect against the threat.

until these things are done your system, be it windows or mac, is just as vulnerable to the new threat as any unprotected system would be.

Clearly the anti virus software writers do try to have patterns in their software that might catch a new virus if it just happens to fit a pattern, but I must assume that these patterns are based on prior experience with threats that have already been found and thus would be very limited in what they could protect against in the case of OSx where there is virtually no prior experience .

considering all of this, it seems to me, that if a new Mac virus were to suddenly be created, one that did in fact spread itself like nothing before it any virus software you might happen to be using would most likely be worthless

denis klimentov wrote:

I have not heard of any successful AntiVirus software as there were no viruses yet, and any software of that sort is usually built around the existing viruses.

--
My kit - D200, 10.5mm f/2.8D, 35mm f/1.8G, 50mm f/1.4G & 70-300VR
Wifes kit – D80, 18-105VR
SB800, SB600 and other misc lighting equipment

Lenses worth mentioning owned and sold– 12-24 f/4, 17-55 f/2.8, 35-70 f/2.8, 80-200 f/2.8, 20mm f/2.8, 35mm f/2, 50mm f/1.8, 50mm f/1.4D, 60mm f/2.8D, 85mm f/1.8, 105mm f/2D-DC, 180mm f/2.8, 300mm f/4D-ED

Thank you, but i stand corrected: according to some websites, there IS a growing number of malware, trojans etc that exploit both the system vulnerabilities (regardless of how few) and that of the software installed. SOme of these sites though are associated with companies producing a/v software, so ... YMMV. Nevertheless, I guess, a good starting point would be to place yourself, your usage and your system on the map vis a vis these threats and try to fine-tune your system accordingly. Some extensive guides are here:
http://www.apple.com/support/security/guides/

I went and had a look at the osx 10.6 guide in your link and once you get past the index and introduction one of the first things it says is this

"̂ Secure default settings. When you take your Mac out of the box, it is securely configured to meet the needs of most common environments, so you don’t need to be a security expert to set up your computer. The default settings make it very difficult for malicious software to infect your computer. You can further configure security on the computer to meet organizational or user requirements."

so basically they think it is good out of the box for most normal users

denis klimentov said:

. Some extensive guides are here:
http://www.apple.com/support/security/guides/

Click to expand...

--
My kit - D200, 10.5mm f/2.8D, 35mm f/1.8G, 50mm f/1.4G & 70-300VR
Wifes kit – D80, 18-105VR
SB800, SB600 and other misc lighting equipment

Lenses worth mentioning owned and sold– 12-24 f/4, 17-55 f/2.8, 35-70 f/2.8, 80-200 f/2.8, 20mm f/2.8, 35mm f/2, 50mm f/1.8, 50mm f/1.4D, 60mm f/2.8D, 85mm f/1.8, 105mm f/2D-DC, 180mm f/2.8, 300mm f/4D-ED

yeah, i did read them back when i was on Tiger. I am no security pro, nor do these papers talk about viruses directly (as the party line is that there are none) I just recall that the Guide paper was a very illuminating read, simply by focusing attention on so many various angles of the same issue of security...
--
cheers!

Sal Baker said:

All I can tell you is I've had Macs at home and at work with no anti-virus software for 14 years without a single problem.

Sal

Click to expand...

me too, i have been a macuser since the mac IIfx, all without any anti virus software, and have no problem all, I go through all kind of web site you can think of, even those warmed by firefox, I just go ahead, and nothing happened, i downloaded allbkind of files you can think of, just nothing.

razormac said:

1) It is just a matter of time, wait until Macs have a larger market share then you will see!

Click to expand...

there is another theory, is that virus are written by anti virus company secretly, if the sale of anti virus software are not good on that platform, chance are they will have less virus written for it, so this is why there are not much virus for the mac, because most of the macuser never care about anti virus, on the other side pc, nearly every pcuser on their pc they will install one or more anti virus programs, and they will feel so bare without it, so they have the most virus.

so even there maybe more macuser in the future, that does not mean more chance they will get virus.