Is there an on-line spyware scanner for MAC systems?

[leicaman]

I took a look at my firewall log file and the number of port probes was unbelieveable in a short period of time. There were even some stealth connection attempts. 2 days of logging with rge machine one for just short periods was over 30 pages of fine print.
It dangerous in cyberspace!

 

[JonE190246]

Sounds great...

Now if I can find one that would seek out / archive / remove leftover files from 'prior' installs...

Never thought Mac would need a 'registry cleaner' but... I guess GUI's always leave some slime...

 

[JonE190246]

... Just wonder what the cost on thruput would be, scanning / filtering each packet, matching across packets looking for info...

There was several attempts to make internet applilances that did stuff like that but most of them are either extremely expensive or died in the dot-bomb.

 

[Kendall Helmstetter Gelner]

Ok first off, the term 'spyware' is vague at best. There are
several types of malware possible on mac and some need no
permissions what so ever, because they work by the same way the
systems do... by design. Just because they are not common does not
mean they do not exist. The same can be said about Linux, AIX,
Solaris etc. Just because they are not common... NEVER say they
don't exist... Always be careful of that word.

They don't exist. There are enough Mac owners running things like little snitch, and examining new software, that if spyware or malware were released for the Mac we'd all know very quickly.

Saying Spyware or Malware does not exist is not the same as saying it cannot exist; saying that because it can it must exist is equally false.

1) Tracking cookies / image bugs / e-mail bugs etc...
w/o knowing the mechism not much can be done to prevent these since
they work from collecting data from remote sites and cookies,
downloading small images (ie bugs).

Yes but this really isn't spyware or malware, it's just tracking stuff and cannot by itself release any personal data about you without you knowing apart from browsing habits on a given site (which they could also track server side to some degree based on IP). Basically you can't stop a site owner from knowing what you are browsing, or than an image hosted somewhere else is being viewed!

2) Trojans malware etc
To do damage, one does not need admin priviges. I can delete
everythiing in your home directory, including your desktop very
quickly and quitely (think something like 'rm -rfy ' (there is an
intenional typo to keep it form working so nicely)

That however is not what modern malware does. Modern malware is created for profit by turning your computer into a part of a botnet then can be controlled remotely to send spam or launch denial of service attacks in conjunction with other infested computers.

Spyware sits gathering your personal data like account numbers and passwords to make direct theft more possible.

Both of these kinds of attacks rely on system level access to really hide themselves in the system - running as a user level process they can be too easily disposed of.

3) Worms
The first internet virus was an e-mail worm... Mac osx is based on
Unix...

And has no worms. Much was learned from those early worms and that is why UNIX is as secure as it is today. When was the last major UNIX worm attack?

4) Exploits
Check it there are still a few remaining Safari expoits possible...
just no one has openly exploited them. Some are in the SSL stack,
some are in the browser itself. It also has several other open
ports, programs etc accessable to outside world...

Apple is generally good about fixing these though, and just because there are exploits does not mean any programs exist that are making use of them - again, exploiting the local use account is not really appealing all by itself if the end product can be too easily detected and removed. In the recent "Month of Apple bugs" they found one Quicktime exploit that only worked for one in sixty people, and then moved on to bugs in third party products that Apple does not even ship by default!

Further someone wishing to take advantage of an exploit faces a dilemma - you must target an exploit to PPC or Intel platform. Which do you choose? The PPC platform is much larger, but has no new computers entering the system. The Intel side is growing but is still smaller in numbers. So if market size is a factor in Macs having malware written, the platform reset has made Mac users safe for at least a few more years.

5) Remote - Brute force... as long as someone is paying attention
to logs, then it may be caugh, but may not...

That is an irrelevant attack as far as Macs are concerned, because by default no ports are open to outside connection. Any brute force attack on any given service on a Mac is not going to yield enough results to make it worthwhile, unless you are trying to break into a particular Mac for something like cooperate espionage.

The more popular the platform, the bigger target it becomes. While
the system does a fair job, but how many times does it ask for
admin etc...

An assertion that is proven false by the Apache web server having less attacks than IIS, Microsofts less popular web server.

There are tens of millions of Macs in peoples homes at this point. How many computers would you say it would require before Macs would be tempting as a target? Remember that attacks today are generally financially related, you can sell access to botnets created. From that standpoint Macs are a very tempting target indeed being very similar systems number in the tens of millions!

As for removing apps, go check in Libarary and Libary for 'add
ons' that won't be deleted just by dragging the app into the
trash... they are not always kept inside the app...

Yes but stuff lingering in the Library is only taking space, not actually running.

--
---> Kendall
http://InsideAperture.com
http://www.pbase.com/kgelner
http://www.pbase.com/sigmadslr/user_home

 

[Kendall Helmstetter Gelner]

But is it really likely to be so easy? Norton is difficult to
uninstall from Macs - one has to download a special uninstaller.
And if Norton can do it, others with malicious intent certainly
could. And they wouldn't always offer an uninstaller.

You have to provide Norton with your admin account access to install it, at which point it can do anything. Unfortunatley it does, which is annoying - but you could clean it out even without the special software if you were willing to look more deeply.

It would have to somehow get the admin password I guess, either
through "social engineering", or a privilege escalation flaw, or
just sit around and wait until a password is entered on the
keyboard.

Exactly, it would have to gain admin access. However it could not do so via monitoring the keyboard as that would require admin level access to install (which it does not have, a catch-22). It would then have to be either through privilege escalation (which are few and far between) or making you enter your password (the more likley approach since some would fall for it).

Basically although it's not impossible for another program to gain admin level access to hide itself deeper in the system, it's a much harder task on Windows where just getting a program to run or an exploit to work means you have access to the whole box for most users. Vista helps this situation but is pretty new and untested.

--
---> Kendall
http://InsideAperture.com
http://www.pbase.com/kgelner
http://www.pbase.com/sigmadslr/user_home