Mac OS X Now Updates Malware Definitions Daily

[FroMann]

Better than downloading a third party anti virus application.

[Undecided]

There's nothing wrong with open safe files. Even with this whole malware thing, even though it launches the installer, it's trapped in the installer and won't install unless you allow it.

You know what this thing is? An IQ test.

[Apple...]

Wirelessly posted (Opera/9.80 (iPhone; Opera Mini/6.13548/24.871; U; en) Presto/2.5.25 Version/10.54)

Originally Posted by FroMann

Better than downloading a third party anti virus application.

Amen! I'm very happy with the actions Apple made today.

[Žalgiris]

Originally Posted by roadbloc

OS X now has an inbuilt antivirus. The day has come.

There are no known viruses for Mac OS X. Get your facts straight and stop spreading misinformation, pal.

Originally Posted by Dammit Cubs

And so it begins .......

Endless stupidity. Sure.

[Ger Teunis]

Originally Posted by Žalgiris

There are no known viruses for Mac OS X. Get your facts straight and stop spreading misinformation, pal.
Endless stupidity. Sure.

What he said; it's just an extra protection (and warning) before opening a download for the gullible OSX users. In no means a virus scanner.

Lets get the facts right: it's not a virus. The application will not automatically install itself. The users still has to take actions to install the app. So in short: it's a 'normal application' doing bad things. The real problem here is that it is able to convince end-users (like you and me) that it's a secure application to install.

There is no real way of protecting users from that except educate them not to trust anything they download.

[roadbloc]

Originally Posted by Žalgiris

There are no known viruses for Mac OS X. Get your facts straight and stop spreading misinformation, pal.

Oh don't be so pedantic. You knew what I meant.

[nrajack]

Originally Posted by frankieboy

See System Preferences > security > General tab.

Only if you're on 10.6.7. For those of us on older revisions of Snow Leopard it doesn't exist.

[gnasher729]

Originally Posted by z3r0

A Jail/Sandbox would make Trojans a none issue. Along with an out going firewall to stop phoning home. Finally only allowing applications to be executable/ran from specific directories. Now reason I should be able to run an app that's installed in another location besides the Applications folder. Unix apps that are installed in bin etc... Would need admin rights/sudo to be installed in the first place.

Actually, no. If you look at what MacDefender is doing (lying to the user that there are tons of viruses on their Mac, showing disgusting websites, and asking for credit card information to pay to get rid of these non-existing viruses), it can do all of that quite nicely in its own little sandbox.

Originally Posted by mcdermd

And yet they keep "Open 'safe' files" around in Safari. Get rid of that already.

This is very easy to demand, but you haven't thought through the consequences. (The main consequence being that all users including you would start screaming "Safari is broken! It doesn't open the documents that I'm downloading anymore!")

[jonnysods]

Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Mobile/8J2)

Interesting to see Apple start to get into this issue now the way the PC world has to chase it's tail.

Friggin hackers.

[res1233]

Originally Posted by whustedt

do you think this will be failsafe when you're using a standard-account?
normal system-updates do not work when you're no admin.
(even though you can activate it in system prefs)

No matter what account type you're running, the system still has the right to do anything with your computer it wishes. It's probably just a process running in the background as root once a day.

Originally Posted by roadbloc

Oh don't be so pedantic. You knew what I meant.

It doesn't matter if he knew what you meant. Misinformation is still misinformation regardless of what you intended to say. Nowadays there are not that many people who know the difference between a virus/trojan/worm/spyware (yes some people even confuse spyware for viruses).

[mcdermd]

Originally Posted by gnasher729

This is very easy to demand, but you haven't thought through the consequences. (The main consequence being that all users including you would start screaming "Safari is broken! It doesn't open the documents that I'm downloading anymore!")

Wrong. I turn it off first thing for myself and any other person who asks me to set up their system for them. I've been doing it since Safari 1.

[roadbloc]

Originally Posted by res1233

It doesn't matter if he knew what you meant. Misinformation is still misinformation regardless of what you intended to say. Nowadays there are not that many people who know the difference between a virus/trojan/worm/spyware (yes some people even confuse spyware for viruses).

As well as a specific thing it is also a generic term. You can be strict to the definitions and call it 'malware' just to ram home that "OS X has no viruses" to everyone, but the rest of the home users will still call it a virus, be it malware, spyware, trojan, worm etc. We know that OS X doesn't actually have any known viruses thank you. It's a generic term.

Say what you wish, OS X has what people know as an 'antivirus' built in.

[silentnite]

Now that's what I call taking one for the team. Seems to me apple was on the ball. Good to know

[Žalgiris]

MacRumors ad lovers please change the title so it makes sense. It doesn't update daily, but checks for updates daily. We all know very well that there wil be nothing to update.

[newfoundglory]

Originally Posted by mcdermd

And yet they keep "Open 'safe' files" around in Safari. Get rid of that already.

I agree!!!! What on earth were Apple thinking. This is the cause of the current mess, that one ********* check box!!

They address the problem, but not the cause - not impressed one bit, Apple

[mscabot]

No software of any kind can be installed on your mac except thorough the App store. That puts an end to malware on the mac full stop. I know that is unacceptable in a lot of ways but I think it is the future. The other way is to have all applications that will be installed out side the app store be issued a secure certificate that phones home when installed and every time it starts. If the app is tampered with the cert becomes invalid and the app won't run. If the cert isn't valid the application can not be installed. This will make it harder to create malware, but not impossible. If a widely installed application is infected with a virus the app can be disabled be revoking the cert, and not re-certified until the vendor fixes the problem.

[notjustjay]

Cue new virus that pretends to be a malware update file, causing it to automatically be downloaded to millions of Macs, in 3, 2, 1.....

[MacMan86]

Originally Posted by notjustjay

Cue new virus that pretends to be a malware update file, causing it to automatically be downloaded to millions of Macs, in 3, 2, 1.....

Uh... No.

The updater will be looking for information hosted on Apple's servers. The information is stored in a plist file (called XProtect.plist). A plist file is not executable. Never going to happen.

[saberahul]

Soon they will need to update this page to remove the bottom most left tile.

[GGJstudios]

Originally Posted by saberahul

Soon they will need to update this page to remove the bottom most left tile.

No, because it still doesn't get PC viruses.... or Mac viruses.

[LegendKillerUK]

Originally Posted by MacMan86

Uh... No.

The updater will be looking for information hosted on Apple's servers. The information is stored in a plist file (called XProtect.plist). A plist file is not executable. Never going to happen.

Actually, Yes.

A UI could easily be made to ask the user to update their defintions. It could easily lie and say it was unable to connect to a server and therefore you must press OK now to do it.

Average user goes, Oh, Apple needs an update, clicks ok and boom. Infected.

[MacMan86]

Originally Posted by saberahul

Soon they will need to update this page to remove the bottom most left tile.

It says:

It doesn't get PC Viruses

That will never be incorrect. Mac OS X will never get PC viruses because it's a different architecture. You can't run a .exe file on a Mac and that's why it's instantly impossible. Further, a virus targets a specific vulnerability in the code that makes up an OS. Mac and Windows have different codebases (obviously they're written differently) so a virus that's written to infect Windows could not infect a Mac

Originally Posted by LegendKillerUK

Actually, Yes.

A UI could easily be made to ask the user to update their defintions. It could easily lie and say it was unable to connect to a server and therefore you must press OK now to do it.

Average user goes, Oh, Apple needs an update, clicks ok and boom. Infected.

Actually, No.

That would be a trojan, just like MACDefender or any other kind that is using social engineering to install a malicious payload.

What the OP was saying was that the Apple updater would be tricked into downloading some malware instead of the definitions file, execute this malware and then become infected, making it a virus as it required no user interaction.

This could never happen as the OS does not execute the definitions file, it reads it.

I'll say it again, never going to happen.

[sainsburys]

As I understand correctly, you don't need to run some "Malware Test" it's all doing automatically yes?

[dukebound85]

Originally Posted by sainsburys

As I understand correctly, you don't need to run some "Malware Test" it's all doing automatically yes?

correct