Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Undecided

macrumors 6502a
Mar 4, 2005
704
168
California
There's nothing wrong with open safe files. Even with this whole malware thing, even though it launches the installer, it's trapped in the installer and won't install unless you allow it.

You know what this thing is? An IQ test.
 

Apple...

macrumors 68020
May 6, 2010
2,148
0
The United States
Wirelessly posted (Opera/9.80 (iPhone; Opera Mini/6.13548/24.871; U; en) Presto/2.5.25 Version/10.54)

FroMann said:
Better than downloading a third party anti virus application.

Amen! I'm very happy with the actions Apple made today.
 

Ger Teunis

macrumors member
Jan 2, 2010
55
0
In front of my Mac
Žalgiris;12662449 said:
There are no known viruses for Mac OS X. Get your facts straight and stop spreading misinformation, pal.
Endless stupidity. Sure.

What he said; it's just an extra protection (and warning) before opening a download for the gullible OSX users. In no means a virus scanner.

Lets get the facts right: it's not a virus. The application will not automatically install itself. The users still has to take actions to install the app. So in short: it's a 'normal application' doing bad things. The real problem here is that it is able to convince end-users (like you and me) that it's a secure application to install.

There is no real way of protecting users from that except educate them not to trust anything they download.
 
Last edited:

gnasher729

Suspended
Nov 25, 2005
17,980
5,565
A Jail/Sandbox would make Trojans a none issue. Along with an out going firewall to stop phoning home. Finally only allowing applications to be executable/ran from specific directories. Now reason I should be able to run an app that's installed in another location besides the Applications folder. Unix apps that are installed in bin etc... Would need admin rights/sudo to be installed in the first place.

Actually, no. If you look at what MacDefender is doing (lying to the user that there are tons of viruses on their Mac, showing disgusting websites, and asking for credit card information to pay to get rid of these non-existing viruses), it can do all of that quite nicely in its own little sandbox.


And yet they keep "Open 'safe' files" around in Safari. Get rid of that already.

This is very easy to demand, but you haven't thought through the consequences. (The main consequence being that all users including you would start screaming "Safari is broken! It doesn't open the documents that I'm downloading anymore!")
 

jonnysods

macrumors G3
Sep 20, 2006
8,426
6,892
There & Back Again
Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Mobile/8J2)

Interesting to see Apple start to get into this issue now the way the PC world has to chase it's tail.

Friggin hackers.
 

res1233

macrumors 65816
Dec 8, 2008
1,127
0
Brooklyn, NY
do you think this will be failsafe when you're using a standard-account?
normal system-updates do not work when you're no admin.
(even though you can activate it in system prefs)

No matter what account type you're running, the system still has the right to do anything with your computer it wishes. It's probably just a process running in the background as root once a day.

Oh don't be so pedantic. You knew what I meant.

It doesn't matter if he knew what you meant. Misinformation is still misinformation regardless of what you intended to say. Nowadays there are not that many people who know the difference between a virus/trojan/worm/spyware (yes some people even confuse spyware for viruses).
 

mcdermd

macrumors regular
Mar 17, 2004
181
4
This is very easy to demand, but you haven't thought through the consequences. (The main consequence being that all users including you would start screaming "Safari is broken! It doesn't open the documents that I'm downloading anymore!")

Wrong. I turn it off first thing for myself and any other person who asks me to set up their system for them. I've been doing it since Safari 1.
 

roadbloc

macrumors G3
Aug 24, 2009
8,784
215
UK
It doesn't matter if he knew what you meant. Misinformation is still misinformation regardless of what you intended to say. Nowadays there are not that many people who know the difference between a virus/trojan/worm/spyware (yes some people even confuse spyware for viruses).

As well as a specific thing it is also a generic term. You can be strict to the definitions and call it 'malware' just to ram home that "OS X has no viruses" to everyone, but the rest of the home users will still call it a virus, be it malware, spyware, trojan, worm etc. We know that OS X doesn't actually have any known viruses thank you. It's a generic term.

Say what you wish, OS X has what people know as an 'antivirus' built in.
 

Žalgiris

macrumors 6502a
Aug 3, 2010
934
0
Lithuania
MacRumors ad lovers please change the title so it makes sense. It doesn't update daily, but checks for updates daily. We all know very well that there wil be nothing to update.
 

newfoundglory

macrumors 6502
Nov 5, 2007
281
8
And yet they keep "Open 'safe' files" around in Safari. Get rid of that already.

I agree!!!! What on earth were Apple thinking. This is the cause of the current mess, that one ********* check box!!

They address the problem, but not the cause - not impressed one bit, Apple
 

mscabot

macrumors newbie
Jun 25, 2009
9
0
Only one way

No software of any kind can be installed on your mac except thorough the App store. That puts an end to malware on the mac full stop. I know that is unacceptable in a lot of ways but I think it is the future. The other way is to have all applications that will be installed out side the app store be issued a secure certificate that phones home when installed and every time it starts. If the app is tampered with the cert becomes invalid and the app won't run. If the cert isn't valid the application can not be installed. This will make it harder to create malware, but not impossible. If a widely installed application is infected with a virus the app can be disabled be revoking the cert, and not re-certified until the vendor fixes the problem.
 

notjustjay

macrumors 603
Sep 19, 2003
6,056
167
Canada, eh?
Cue new virus that pretends to be a malware update file, causing it to automatically be downloaded to millions of Macs, in 3, 2, 1.....
 

MacMan86

macrumors 6502
Jul 22, 2008
324
0
UK
Cue new virus that pretends to be a malware update file, causing it to automatically be downloaded to millions of Macs, in 3, 2, 1.....

Uh... No.

The updater will be looking for information hosted on Apple's servers. The information is stored in a plist file (called XProtect.plist). A plist file is not executable. Never going to happen.
 

LegendKillerUK

macrumors 6502
Apr 9, 2010
398
0
Uh... No.

The updater will be looking for information hosted on Apple's servers. The information is stored in a plist file (called XProtect.plist). A plist file is not executable. Never going to happen.

Actually, Yes.

A UI could easily be made to ask the user to update their defintions. It could easily lie and say it was unable to connect to a server and therefore you must press OK now to do it.

Average user goes, Oh, Apple needs an update, clicks ok and boom. Infected.
 

MacMan86

macrumors 6502
Jul 22, 2008
324
0
UK
Soon they will need to update this page to remove the bottom most left tile.

It says:
It doesn't get PC Viruses
That will never be incorrect. Mac OS X will never get PC viruses because it's a different architecture. You can't run a .exe file on a Mac and that's why it's instantly impossible. Further, a virus targets a specific vulnerability in the code that makes up an OS. Mac and Windows have different codebases (obviously they're written differently) so a virus that's written to infect Windows could not infect a Mac


Actually, Yes.

A UI could easily be made to ask the user to update their defintions. It could easily lie and say it was unable to connect to a server and therefore you must press OK now to do it.

Average user goes, Oh, Apple needs an update, clicks ok and boom. Infected.

Actually, No.

That would be a trojan, just like MACDefender or any other kind that is using social engineering to install a malicious payload.

What the OP was saying was that the Apple updater would be tricked into downloading some malware instead of the definitions file, execute this malware and then become infected, making it a virus as it required no user interaction.

This could never happen as the OS does not execute the definitions file, it reads it.

I'll say it again, never going to happen.
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.