Apple Quietly Updates Antimalware Protection in Mac OS X 10.6.4

This is a good first step. I just hope Apple keeps this up into the future.

Where would I be downloading iPhoto from that this would be a problem? Is it common to download something that comes pre-installed on your Mac

I'm confused... is Apple "Pro" malware protection of "Anti" malware protection? LOL

Let the whining begin.

bigcat318 said:

Is it common to download something that comes pre-installed on your Mac

Click to expand...

Ever heard of a "new version" ? Honestly, this is kind of a dense comment.

So, let me see if I've got this right.

If I download pirated/illegal/illicit software from the interwebs and proceed to install it and give my root password, something bad may happenz?

I can haz malware?

People are morons. Stop downloading and installing pirated/hacked free copies of paid for software and you won't have these problems. Idiots.

miles01110 said:

Ever heard of a "new version" ? Honestly, this is kind of a dense comment.

Click to expand...

And I gotta say yours sounds kind of harsh.

I believe Apple just uses clamAV.

http://www.opensource.apple.com/source/clamav/

MorphingDragon said:

I believe Apple just uses clamAV.

http://www.opensource.apple.com/source/clamav/

Click to expand...

I think that is only included in Mac OS X Server

jmpage2 said:

So, let me see if I've got this right.

If I download pirated/illegal/illicit software from the interwebs and proceed to install it and give my root password, something bad may happenz?

I can haz malware?

People are morons. Stop downloading and installing pirated/hacked free copies of paid for software and you won't have these problems. Idiots.

Click to expand...

Get your facts straight. Just few weeks ago there was an report about malware included on a screen saver packages promoted by Verisontracker, Macupdate etc.

Nuvi said:

Get your facts straight. Just few weeks ago there was an report about malware included on a screen saver packages promoted by Verisontracker, Macupdate etc.

Click to expand...

I do not consider those as trust worthy.

This is how Apple does it, they introduce a feature subtly, make improvements, then once they feel it's ready, they announce it. I expect that this feature will be an advertised part of OS X 10.7. Just like how they recompiled most of Snow Leopard 64-bit, while Leopard was already 64-bit compatible. Leopard was, in my opinion, partly a preparation to get ready for recompiling everything 64-bit.

Does Pinhead-B spread itself over the Internet?

Macs have always had trojans and always will. A Trojan is simply a lie, and if you can make someone believe a lie, you can get them to do anything. That doesn’t mean victims are “morons,” since nobody is perfect. So it’s good to defend against Trojans by methods other than just common sense.

But something that spreads itself (properly called a worm, though most people say virus) over the Internet has never been successfully achieved on OS X. (But about once a year, tech sites post a false alarm, which then never gets retracted when the facts emerge. Example: The iChat/Oomp-A thing, which wasn’t at all what sites first reported it to be.) Unless, of course, this is the first! I think it would have been a big headline in April if so.

Downplaying? Apple is protecting from a known trojan. Trojan ≠ Virus.

satcomer said:

This is a good first step. I just hope apple keeps this up into the future.

Click to expand...

No, This approach can't work. You can't just compare a file to a short list of bad files. Malware is so easy to write. For example I could make a three line shell script and call it "free-porn-for-life" and then inside the scrip is a line to enable remote logins. It's nearly trivial to do and does not require any sophisticated "hacking". This trick is so old that Virgil wrote about it 2,000 years ago The idea is to give someone a gift but the gift is not what it appears to be.

The only way to defend against these is to do what the people of Troy should have done with that big horse, quarantine it and observe what what it does and examine it before trusting it. Comparing it to a short list will not work. Maybe that's what the Trojans did. Maybe they had a list and knew not to accept a giant wooden pigs or giant cows, but "horse" was not on the list so they took it.

In the article, someone wrote some malware but he tells people it is a pirated version of iPhoto. The fools think "man I can save $79!" and download it. Surprizing that Apple would bother to protect people from this.

Let's face it, nobody can stop you from downloading and installing malicious software except by enforcing something like the "App Store" for all installations. In which case all applications can be reviewed before being made available.

Macs are just as susceptible to malware as PCs now that Microsoft has been kind enough to add the warning before blindly executing something downloaded from the internet (how dumb of them was that back in the day?).

At least my Mac warns me before running any executable I downloaded that is not digitally signed by a trusted authority. And yes, when I get that warning I try to make sure I downloaded from a good and trusted site (especially when dealing with open source downloads).

And while any computer can be vulnerable to virus and unwanted intrusions via a simple buffer overflow, overall Macs have seemed to have less exposure to this. But yet we still see security patches to every version of every operating system ever produced (including OSX).

The best you can do is design an OS to isolate "root/admin" activities from user activities, force the user to specifically authorize actions that require "root/admin" access and warn them, and do your best to minimize bugs that can be exploited. If anybody thinks they are perfectly safe because they are running a specific OS, they are wrong. A while back Sun produced "Trusted Solaris" for government customers that were big on security, and YES they still issued security patches to this.

Apple's move here is a great step in the right direction to warn users who are not knowledgeable when they have just been social-engineered into downloading crap. I think they should expand the feature and advertise it -- tell folks "hey we are going to warn you when you've downloaded something known to be dangerous and we are going to periodically update the list of known dangerous downloads". If you don't want to wait around for Apple to do that then you can go purchase commercial software to do the same. If you are careful about your downloads then you probably don't need the commercial software.

I am shocked that someone that writes and sells antivirus software would say this isn't enough to protect your system. Amazing.

</scarsam>

miles01110 said:

Ever heard of a "new version" ? Honestly, this is kind of a dense comment.

Click to expand...

The question still stands. Why, when seeing "new software update" appear in OS X, would someone ignore that pop-up from Apple and instead go out and find iPhoto on the internet?

That makes no sense to me. But the person questioning it is "dense?" Then I must be dense too. Please explain it to me because I don't get it.

As a firm that writes and sells antivirus software, Sophos unsurprisingly takes the position that Apple's antimalware feature, while welcome, is insufficient for proper protection against threats. In fact, the blog post from Sophos notes that nowhere in the Mac OS X 10.6.4 documentation does Apple announce this antimalware, leading to speculation by Sophos that Apple is simply trying to downplay security threats for marketing purposes and thus providing users with a false sense of security.

Click to expand...

Just the kind of comment you'd expect from a company who wants to sell you their own antivirus crap.

seppler said:

I think that is only included in Mac OS X Server

Click to expand...

Umm,

so Apple is wasting time remaking something they could just simply add too?

Sounds like somebody at Novell just got a job at Apple.

Small White Car said:

The question still stands. Why, when seeing "new software update" appear in OS X, would someone ignore that pop-up from Apple and instead go out and find iPhoto on the internet?

That makes no sense to me. But the person questioning it is "dense?" Then I must be dense too. Please explain it to me because I don't get it.

Click to expand...

I'm pretty sure it's when people try to download free versions of an upgrade to iPhoto that they would have to pay for normally, usually via torrenting. Don't even ask me how I know that. THX!

Small White Car said:

The question still stands. Why, when seeing "new software update" appear in OS X, would someone ignore that pop-up from Apple and instead go out and find iPhoto on the internet?

That makes no sense to me. But the person questioning it is "dense?" Then I must be dense too. Please explain it to me because I don't get it.

Click to expand...

iLife, including iPhoto, doesn't get free updates through Software Update, except for minor bug fixes. If iLife 08 came with your computer, and you wanted the new features in iPhoto 09 like face recognition, you could buy iLife 09 for $79, or you might choose to pirate it.

res1233 said:

I'm pretty sure it's when people try to download free versions of an upgrade to iPhoto that they would have to pay for normally, usually via torrenting. Don't even ask me how I know that. THX!

Click to expand...

Ha ha...deal.

So like with most of these things, it seems like it mostly affects pirates.

Small White Car said:

The question still stands. Why, when seeing "new software update" appear in OS X, would someone ignore that pop-up from Apple and instead go out and find iPhoto on the internet?

That makes no sense to me. But the person questioning it is "dense?" Then I must be dense too. Please explain it to me because I don't get it.

Click to expand...

You don't get new updates to the iLife suite when a new version appears. So people have a choice to either buy it, or pirate it. Those that fall in the second category risk being infected with malware.

Too slow, that'll teach me to do other things before submitting..