New Mac Malware Threat - time to get AV software...

RussJK

thescouselander wrote: »

AV programs do take up significant system resources. The can also interfere with other applications and cause unwanted messages to pop up at times

Oh, I dunno - sometimes they are wanted:



Just the thing to brighten your step

They really do mean the'more than security' bit.

thescouselander

I might also add that the effectiveness of antivirus is questionable - many AV programmes fail to detect some attack vectors. Also the level of integration in the operating kernel can actually make the AV programme itself a serious security hole. I've certainly had a virus get onto my PC even though I was using a well known AV programme at the time (Zone alarm as I recall).

[Deleted User]

thescouselander wrote: »

You say that but I have been running OS X for many years with my current security policy with absolutely zero issues.

How have you been able to verify that with any degree of precision?

I accept that it is possible for my Mac to be infected with malware/viruses but as yet I don't assess the risk as being high enough to justify the inconvenience of having to run anti-virus software.

When the risk increases I will re-assess my position.[/QUOTE]

thescouselander wrote: »

I dont see what you're saying. I know there is a risk now but for me it is not high enough to take action.

Entirely your prerogative.

There are a lot of disadvantages to AV.

Certainly less so than not utilising any.

There is a noticeable effect on performance and AV programs do take up significant system resources.

Choose from the right ones and there isn't. Modern PCs have vast amounts of unused processing power and memory resources available, something taking up less than 100MB of RAM is hardly going to bring a system to its knees.

The can also interfere with other applications and cause unwanted messages to pop up at times.

Once again, choose the right software and this is a seldom experienced event.

A risk management approach is an accepted way of approaching IT security.

AKA "trust nothing".

You may be running AV but I guarantee your computer would fail any security test a very high security system would be subject to.

Examples of such testing procedures?

I must admit, I'm always amused when people bring computers into our work that don't have any security software installed. They aren't given permission to connect to any of our networks, even if they are just wanting to browse the internet. Usually the reaction is something like "but it's a Mac it doesn't get viruses".

If you aren't able to prove to the best of your ability that your computer is free from malicious software then you are not permitted to connect.

If you take the approach that all risks should be reduced to zero you'll
quickly end up with an unusable system.

Its called being sensible and cautious. Risks with computer security can never be reduced to zero, but you can do a lot to mitigate most factors.

What it comes down to is the individuals appetite for risk and this will differ between people - In my case I'm prepared to take a bit more risk than you.

Ignorance is bliss I guess.

thescouselander wrote: »

I might also add that the effectiveness of antivirus is questionable

It is significantly more effective than the other option of running no anti virus at all.

many AV programmes fail to detect some attack vectors.

Security is all about layers.

Also the level of integration in the operating kernel can actually make the AV programme itself a serious security hole.

Example?

I've certainly had a virus get onto my PC even though I was using a well known AV programme at the time (Zone alarm as I recall).

As in ZoneAlarm, the Firewall?

thescouselander

@anewhope - Ok, answering the questions in no particular order.


The Zonealarm software I was talking about was a firewall and Antivirus suite.


Examples of security testing include that done by CESG for government computer systems.


Examples of flaws in security software:

http://www.pcworld.com/article/122907/symantec_reports_critical_security_flaw_in_antivirus_scan_engine.html

http://www.adminspy.com/Technology-News/Software/Security-flaw-hits-Trend-Micro-antivirus.html

http://www.zdnet.co.uk/news/security-management/2005/03/18/mcafee-antivirus-vulnerability-published-39191831/

http://www.zdnet.co.uk/news/security-management/2005/10/04/kaspersky-flaw-opens-back-door-39225777/


Need I go on? When you install this software how can you be sure you haven't introduced a security hole that wasn't there previously?

http://www.infoworld.com/d/security-central/security-software-becoming-security-risk-437?page=0,0


I assume on your computer you are using full disk encryption and sanctuary software for control of hardware and software. I assume you have removed active x and Java from your web browser. Have you also shielded your home computer equipment to prevent leakage of EM radiation - better still I expect you have a fibre optic network instead of an electrical based system. If not why not - surely sensible security precautions?

debitcardmayhem

I just want to wait for the thread that starts with "iHaveavirus on my iMac iNeedhelp", mind you they will probably go to the Apple Store rather than risk ridicule on here.

[Deleted User]

thescouselander wrote: »

The Zonealarm software I was talking about was a firewall and Antivirus suite.

Was ZA's anti virus ever renound for being a good product? I'm struggling to remember.

Examples of security testing include that done by CESG for government computer systems.

With confidence I can say yes because that covers such a wide spectrum that most computer set ups are going to be compliant in one area at least.


Examples of flaws in security software:

http://www.pcworld.com/article/122907/symantec_reports_critical_security_flaw_in_antivirus_scan_engine.html

http://www.adminspy.com/Technology-News/Software/Security-flaw-hits-Trend-Micro-antivirus.html

http://www.zdnet.co.uk/news/security-management/2005/03/18/mcafee-antivirus-vulnerability-published-39191831/

http://www.zdnet.co.uk/news/security-management/2005/10/04/kaspersky-flaw-opens-back-door-39225777/

Need I go on? When you install this software how can you be sure you haven't introduced a security hole that wasn't there previously?

http://www.infoworld.com/d/security-central/security-software-becoming-security-risk-437?page=0,0

The same as mentioned previously, a layered approach will mitigate the impact an exploited vulnerability can have on a system.

I assume on your computer you are using full disk encryption and sanctuary software for control of hardware and software. I assume you have removed active x and Java from your web browser. Have you also shielded your home computer equipment to prevent leakage of EM radiation - better still I expect you have a fibre optic network instead of an electrical based system. If not why not - surely sensible security precautions?

Nice Straw Man you've got there.

toastydave

The best way to stop Malware and Virus's is to leave it unplugged from the wall!

A well written operating system should not need AV, Mac has had a few scares and its high profile news because it rarely ever happens.

The is no real story here, a coder has found a exploit (one I expect will be fixed shortly) that allows a downloader program to download and then run automatically if you have "open safe files on completion" enabled in safari
When it does run it prompts the user to install its program, which you can cancel, the main news it that you don’t need a password to install as your are already the administrator, I.E for more security change your Mac account for everyday use to limited.

No AV will catch everything, and on a windows system there are more holes to cover, so it better than not having AV, but with Mac there are so few issues, it just not worth having AV (I type this on a windows pc before you think i’m a Mac Fan Boy)

thescouselander

anewhope wrote: »

Was ZA's anti virus ever renound for being a good product? I'm struggling to remember.

It had good reviews at the time. AFAIK no AV software is particularly effective at catching zero day viruses and it is these types to threats that are the problem for macs.

Most, if not all, of the known threats can be avoided if the user is aware of them. The known list of threats is small at the moment so this isn't a problem. OS X has also been updated to stop some of the known threats.

anewhope wrote: »

The same as mentioned previously, a layered approach will mitigate the impact an exploited vulnerability can have on a system.

I entirely agree - I do have many layers of security, its just anti virus isn't one of them.

miniklop

few months use this firewall "NetMine by ProteMac"(protemac.com) yet without attacks on my mac)!
hope help you)

23n1th

Love it! Thread about OSX malware problem. Recommend getting AV software. Mac users answer "I don't need it atm because I'm not infected". Screw the proactive approach lets react (after the fact)!