Does anyone here actually use antivirus for their MacBook Air?

[GGJstudios]

OS9 and earlier had virus issues that aren't currently present in OS X for 2 reasons: a) a complete reboot of the OS and b) a switch to an entirely new processor architecture. OS9 had been an evolution of an OS that was nearing 20 years old, and as such virus coders had a solid base to code a virus that wouldn't change.

Which proves that the vulnerability to malware had nothing to do with market share, but rather, the weaknesses in the OS.

It's all about marketshare, and the Mac one is tiny. Don't act like it's been 'debunked' because that's nonsense and you're misleading people.

If it's all about market share, how is it that there is much less malware in the wild, and no viruses, now that OS X has much more market share than in previous versions? Your argument doesn't hold water.

Secondly, how is a wide open security exploit no threat to users? Especially if it's publicised on the web and has never been patched? Seriously, just because the virus that can use this exploit hasn't been found in the while, doesn't mean that having this security exploit isn't a threat.

Name one Mac user that has ever been affected by that virus. Just one.

Yes, malware can be avoided by practicing safe computing. You know what also counts as safe computing? Using a firewall and an antivirus. It isn't going to make your computer more vulnerable/less safe like the nonsense you're spewing is.

Using an antivirus and a firewall without practicing safe computing has been proven to be ineffective in protecting against OS X malware in the wild.

I recommend you read some of the dozens of threads on this topic from the past several years, so you don't repeat the same, unfounded arguments.

 

[AppleMacNerd]

I do just for extra safety and for the space it takes up it's minimum!

I use Avast just like a do for PC if anyone is wondering aswell

 

[dejo]

So much misinformation here it's unreal.

This is what is known as foreshadowing.

 

[AppleMacNerd]

Which proves that the vulnerability to malware had nothing to do with market share, but rather, the weaknesses in the OS.

If it's all about market share, how is it that there is much less malware in the wild, and no viruses, now that OS X has much more market share than in previous versions? Your argument doesn't hold water.

Name one Mac user that has ever been affected by that virus. Just one.

Using an antivirus and a firewall without practicing safe computing has been proven to be ineffective in protecting against OS X malware in the wild.

I recommend you read some of the dozens of threads on this topic from the past several years, so you don't repeat the same, unfounded arguments.

I can also say if YOU was a hacker, what platform would you go for? The one with more users therefore making a better chance of your virus been spread. And the OS that uses the more seen formats on the web that doesn't look as dodgy.
Although I do believe as a Windows & Mac user the OSX is much more secure but with more users on Windows and more hackers using windows there will be more people working on the loopholes in windows to bypass them.

 

[iMerik]

This may be useful:

Helpful Information for Any Mac User​

That's a great pile of useful info. Thanks

 

[chabig]

In the early days, Microsoft didn't put out the effort to design and code their OS correctly for security, so the whole AV market was created to address their shortcomings. OS X, on the other hand, was built on a solid foundation, with solid design and coding, and an emphasis on security.

Over the years, people have become comfortable buying and installing third-party AV software. But there is nothing inherent in third-party AV software that can't already be built into the system by the real experts who designed and coded the OS in the first place. Think about it.

 

[MacDawg]

I have a MBA and do not use any AV software

Everyone is free to research and form their own opinions, but I tend to ignore the fear mongers when it comes to this issue

 

[GGJstudios]

I can also say if YOU was a hacker, what platform would you go for? The one with more users therefore making a better chance of your virus been spread. And the OS that uses the more seen formats on the web that doesn't look as dodgy.
Although I do believe as a Windows & Mac user the OSX is much more secure but with more users on Windows and more hackers using windows there will be more people working on the loopholes in windows to bypass them.

Again, hacking and malware are two different things. Also, the Mac installed base of over 70 million users is plenty sufficient to be a target for malware writers. Macs were targeted to a much greater degree when the installed base was a fraction of that, so the idea that a larger market share or installed base equals greater instances of malware is completely unfounded.

 

[Reimer]

In the early days, Microsoft didn't put out the effort to design and code their OS correctly for security, so the whole AV market was created to address their shortcomings. OS X, on the other hand, was built on a solid foundation, with solid design and coding, and an emphasis on security.

Over the years, people have become comfortable buying and installing third-party AV software. But there is nothing inherent in third-party AV software that can't already be built into the system by the real experts who designed and coded the OS in the first place. Think about it.

Pretty much agree with this. I don't even use anti-virus on my Windows machines, let alone worry about it on my OSX computers. Well, that's not toally true. If it wasn't for the built in Windows Defender, I wouldn't be using one.

Back in the XP days, users were defaulted to administrative privileges leaving the system completely open to viruse/malware. It's a much more secure operating system now. OS system wide exploits just aren't as prevalent these days and regardless of operating system and most malware is social engineering. I don't need an anti-virus to tell me I don't need to install some special codec to watch a video.

Even with heuristics, anti-virus software is unreliable. Bad detection rates, false positives, performance degrading, pop ups and ads to get you to buy full versions. Any script kiddie can use a crypter, metasploit to package their payloads to bypass pretty much any anti-virus.

Securing your OS properly proves more effective than anti-virus, whether OSX or Windows.

 

[silvershamrock]

I use antivirus on my MBA. The Mac OSX may be _resistant_ but I'm not convinced that any computer can be fully _immune_ (unless of course it is completely isolated from the internet and never networked to another computer which is connected to the internet, which is too high a price to pay for computer security, IMO).

However, I admit I might not bother with an antivirus, if I relied exclusively on the App store, and never downloaded any third-party software. I usually only run a virus scan when I've just downloaded something from the web (everything that isn't downloaded from the App Store gets scanned before it gets installed, and the entire system gets scanned after it is installed). I don't have any kind of background scanner running 24/7 like I did on my PC.

And I also don't lose sleep over it, the way I did with my PC... and if the MBA ever does start acting funny, I doubt that I'll immediately assume it must have a virus...

 

[robvas]

NO.

Here's the thing about anti-virus. You have to know what a Mac virus looks like to detect one. There aren't any. So all you're protecting against (and wasting time scanning) are Windows viruses. Good if you're sharing files with Windows users who don't have anti-virus I guess.

One reason the Mac Classic OS had so many viruses was that it was a very insecure operating system. No memory protection etc. Easy to crash and corrupt. That has more to do with it than marketshare or the fact that it ran on PowerPC/680x0

Just like Linux, you don't need to bother running an anti-virus 24/7. If you want to scan files for the benefit of Windows users go for it. But files get checked when sending email, when a server receives email, when a Windows machine opens them....

 

[chabig]

I use antivirus on my MBA. The Mac OSX may be _resistant_ but I'm not convinced that any computer can be fully _immune...

I understand you may not be convinced, but how does running AV software change things? Do you suddenly think that the AV software makes your computer secure? I think AV software has become a placebo in most cases. As I said earlier, the best people to build security into the OS are the builders of the OS.

 

[silvershamrock]

I understand you may not be convinced, but how does running AV software change things? Do you suddenly think that the AV software makes your computer secure? I think AV software has become a placebo in most cases. As I said earlier, the best people to build security into the OS are the builders of the OS.

I understand your point, I agree with your logic -- and I like the "belt and suspenders" approach... I'm also not expecting perfect security; this is obviously not going to happen, lol.

A Mac malware attack is a highly unlikely scenario, I agree. And you're right, using an antivirus might not prevent it. But (worst case scenario here) if it does happen, at least if I'm using an antivirus, I'll know I did everything in my power to prevent it; if I wasn't using one, I'd always be wondering if it *might* have made a difference ....

And if the question had been "Do you _worry_ about viruses attacking your MacBook?" my answer would have been a "Not in this lifetime..." I'll concede that OSX is _probably_ secure enough that no "computer vaccinations" are required. I'll also concede that I probably don't need to create multiple redundant backups, clean the fan every three months, and limit my computer use to battery power if electrical storms are in the forecast. However, that's just me... YMMV of course

 

[chabig]

However, that's just me... YMMV of course

Well said.

 

[mattferg]

Which proves that the vulnerability to malware had nothing to do with market share, but rather, the weaknesses in the OS.

If it's all about market share, how is it that there is much less malware in the wild, and no viruses, now that OS X has much more market share than in previous versions? Your argument doesn't hold water.

Name one Mac user that has ever been affected by that virus. Just one.

Using an antivirus and a firewall without practicing safe computing has been proven to be ineffective in protecting against OS X malware in the wild.

I recommend you read some of the dozens of threads on this topic from the past several years, so you don't repeat the same, unfounded arguments.

You're completely missing the point and are obviously clouded by fanboyism, I really can't be bothered to argue. OS X has no viruses because developers spend more of their time targeting Windows. Windows is far more secure, holes get patched immediately. To argue OS X is more secure that has a 6 year old exploit remain unpatched is a joke. The widely accepted opinion of the industry is the marketshare analogy, to argue otherwise you must either work for Apple, or be obsessed with them.

Oh, and safe computing INCLUDES using an antivirus, not just using one. Learn to use a computer, please.

----------

There was no processor shift from OS 9 to OS X. On top of that, the processor has nothing to do with whether a piece of software (or an OS) is architecturally secure. OS X is secure by design (like banks are more secure than homes by design), whereas Windows was not. It's not a marketshare thing at all.

I'm talking about the Intel shift. OS X is not secure by design, just secure by having significantly less marketshare. Windows is far more secure as an OS.

 

[chabig]

OS X has no viruses because developers spend more of their time targeting Windows.

Maybe developers target Windows because Macs are more secure. It's often hard to associate cause and effect.

----------

I'm talking about the Intel shift. OS X is not secure by design...

I don't understand why you say that. OS X was designed from the ground up as a multi-user system, with robust permissions and privileges. Windows was designed for a single user and everyone in the early days had administrator privileges by default. Multi-user support was added later.

 

[Mrbobb]

OSX maybe doesn't have virus, but what about malwares?

There are a couple of vendors that have managed to get through Safari on me, one is that Mac Clean utility, it had managed to spam me, and I have popup and Java disabled.

 

[mattferg]

Maybe developers target Windows because Macs are more secure. It's often hard to associate cause and effect.

----------



I don't understand why you say that. OS X was designed from the ground up as a multi-user system, with robust permissions and privileges. Windows was designed for a single user and everyone in the early days had administrator privileges by default. Multi-user support was added later.

No, developers target Windows because it has a higher marketshare and can run legacy code. If you look into one of the links i posted earlier, you'll see that in a hackathon the Mac was the first one to go by a long, long mile, followed by Vista and Ubuntu shortly thereafter.

 

[notjustjay]

I don't have a MacBook Air specifically, but I have had a Mac in some form or other since 2003. I have not ever run antivirus software on them, and have never felt the need to.

I know my Mac is not immune to exposure, and it may not even be the most secure platform, but I feel the real-world risk is so incredibly low that it is not worth the bother. If and when the tech news is abuzz with talk of some new Mac malware that I might seriously be at risk of catching, then I'll look into protecting myself.

 

[GGJstudios]

OSX maybe doesn't have virus, but what about malwares?

There are a couple of vendors that have managed to get through Safari on me, one is that Mac Clean utility, it had managed to spam me, and I have popup and Java disabled.

As stated earlier, there are a handful of trojans in the wild. Read the earlier links I posted for tips on how to avoid these by practicing safe computing.

 

[munkery]

Macs do have a firewall enabled by default. Sandboxing via mandatory access controls is a type of firewall, which is much more effective that packet filters or application firewalls. Macs are sandboxed via the Trusted BSD MAC framework by default.

In relation to hacking, no methods have been demonstrated to bypass the runtime security mitigations in OS X since the release Lion. Java has been exploited but it doesn't use those runtime security mitigation in relation to how it was compromised. If you don't have Java allowed in your browser, the chances of being hacked without the user actively being tricked into explicitly installing the malicious software is virtually zero. Even now, Java security has been improved so the risks are low even with Java installed.

The marketshare argument is a myth. Examples from other OS platforms show that the weaker target is more targeted. For several years, iOS had greater marketshare than Android but Android was targeted much more. Even now iOS still has a relatively large marketshare but it isn't being targeted because Android is such a weaker target. The marketshare argument is based on game theory but iOS has a large enough marketshare that according to game theory it should be targeted even more than OS X but iOS is almost completely untouched. This is because Android and Windows are much weaker targets to attack.

 

[munkery]

No, developers target Windows because it has a higher marketshare and can run legacy code. If you look into one of the links i posted earlier, you'll see that in a hackathon the Mac was the first one to go by a long, long mile, followed by Vista and Ubuntu shortly thereafter.

At that contest, the OSes are not hacked head to head. They are hacked on a schedule and OS X was first in the schedule. So being hacked first is meaningless. Also, Ubuntu was never compromised. Ubuntu has never been hacked at that contest.

BTW, Macs haven't been compromised at the last 2 pwn2own contests since OS X has included all the same security mitigations as Ubuntu.

Also, OS X has always been more secure than Windows:

1) Discretionary access controls (DAC) prevent protected data entry, including masked password entry and secure text fields, and protected data storage, such as Keychain entries in OS X, from being compromised.

Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Much of the ability to turn these vulnerabilities into exploits is due to the insecurity of the Windows registry. Also, more easily being able to link remote exploits to local privilege escalation exploits in Windows is due to the Windows registry.

Mac OS X does not use an exposed monolithic structure, such as the Windows registry, to store system settings. Also, exposed configuration files in OS X do not exert as much influence over associated processes as the registry does in Windows.

Mac OS X Mountain Lion has contained only 1 elevation of privilege vulnerability since it was released; obviously, it hasn't been used in malware. http://www.h-online.com/security/ne...privilege-escalation-1816387.html?from-mobi=1

Windows 8 has contained at least 14 elevation of privilege vulnerabilities related to just kernel-mode drivers since being released with at least 2 of those vulnerabilities being remote system level access (root) vulnerabilities, which are the most critical type of vulnerability. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=8+kernel-mode

Windows 7 alone has many more privilege escalation vulnerabilities than all the versions of Mac OS X combined.

The following link shows the number of privilege escalation vulnerabilities in Windows 7 related to just kernel-mode drivers:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=kernel-mode+7

More information about privilege escalation in Windows 7:

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://mista.nu/research/mandt-win32k-paper.pdf -> more complete documentation about alternative methods to exploit the Windows kernel.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

2) Windows has the potential to have full ASLR but most software does not fully implement the feature. Most software in Windows has some DLLs (dynamic link libraries = Windows equivalent to dyld) which are not randomized.

http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf -> article overviewing the issues with ASLR and DEP implementation in Windows.

Also, methods have been found to bypass ASLR in Windows 7.

http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf -> article describing bypassing ASLR in Windows 7.

Mac OS X has full ASLR implemented on par with Linux. This includes ASLR with position independent executables (PIE). DLLs in Windows have to be pre-mapped at fixed addresses to avoid conflicts so full PIE is not possible with ASLR in Windows.

Using Linux distros with similar runtime security mitigations as Lion for a model, client-side exploitation is incredibly difficult without some pre-established local access. Of course, this is self defeating if the goal of the exploitation is to achieve that local access in the first place.

See the paper linked below about bypassing the runtime security mitigations in Linux for more details.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

The author only manages to do so while already having local access to the OS.

3) Mac OS X Lion has DEP on stack and heap for both 64-bit and 32-bit processes. Third party software that is 32-bit may lack this feature until recompiled in Xcode 4 within Lion. Not much software for OS X is still 32-bit.

But, not all software in Windows uses DEP; this includes 64-bit software. See first article linked in #2.

4) Mac OS X implements canaries using ProPolice, the same mitigation used in Linux. ProPolice is considered the most thorough implementation of canaries. It is known to be much more effective than the similar system used in Windows.

http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf -> article comparing ProPolice to stack canary implementation in Windows.

5) Application sandboxing and mandatory access controls (MAC) in OS X are the same thing. More specifically, applications are sandboxed in OS X via MAC. Mac OS X uses the TrustedBSD MAC framework, which is a derivative of MAC from SE-Linux. This system is mandatory because it does not rely on inherited permissions. Both mandatorily exposed services (mDNSresponder, netbios...) and many client-side apps (Safari, Preview, TextEdit…) are sandboxed in Lion.

Windows does not have MAC. The system that provides sandboxing in Windows, called mandatory integrity controls (MIC), does not function like MAC because it is not actually mandatory. MIC functions based on inherited permissions so it is essentially an extension of DAC (see #1). If UAC is set with less restrictions or disabled in Windows, then MIC has less restrictions or is disabled.

http://www.exploit-db.com/download_pdf/16031 -> article about Mac sandbox.

http://msdn.microsoft.com/en-us/library/bb648648(v=VS.85).aspx -> MS documentation about MIC.

https://media.blackhat.com/bh-eu-11/Tom_Keetch/BlackHat_EU_2011_Keetch_Sandboxes-Slides.pdf -> researchers have found the MIC in IE is not a security boundary.

6) In relation to DAC and interprocess sandboxing in OS X in comparison with some functionality of MIC in Windows 7 (see #5), the XNU kernel used in OS X has always had more secure interprocess communication (IPC) since the initial release of OS X.

Mac OS X, via being based on Mach and BSD (UNIX foundation), facilitates IPC using mach messages secured using port rights that implement a measure of access controls on that communication. These access controls applied to IPC make it more difficult to migrate injected code from one process to another.

Adding difficulty to transporting injected code across processes reduces the likelihood of linking remote exploits to local exploits to achieve system level access.

As of OS X Lion, the XPC service has also been added to implement MAC (see #5) on IPC in OS X. (http://developer.apple.com/library/...stemStartup/Chapters/CreatingXPCServices.html)

7) Security benefits of a UNIX foundation

Not all software vulnerabilities are exploitable. Vulnerabilities that are not exploitable only allow a denial of service condition upon being triggered. Exploitable vulnerabilities allow code execution when triggered.

There are two methods to achieve code execution in relation to buffer overflows:

1) RET overwrite -> control return address of instruction pointer

2) SEH (structured exception handler) overwrite -> control content of handler that will be executed upon an exception

To clarify:

While typical stack-based buffer overflows work by overwriting the return address in the stack, SEH overwrites work by overwriting the handler attribute of an exception registration record that has been stored on the stack. Unlike overwriting the return address, where control is gained immediately upon return from the function, an SEH overwrite does not actually gain code execution until after an exception has been generated. The exception is necessary in order to cause the exception dispatcher to call the overwritten handler.

Basically, SEH overwrites provide a second method to exploit a vulnerability in the event that a RET overwrite is unsuccessful or not exploitable. Obviously, more vectors being available to facilitate exploiting a vulnerability increases the number of vulnerabilities that are exploitable. SEH overwrites reduce the number of vulnerabilities that only produce a denial of service condition.

Mitigations have been developed to prevent SEH overwrites. These include SafeSEH and SEHOP. Methods are known that allow bypassing both mitigations.

SafeSEH is bypassed if only one component of the program doesn't implement this mitigation; it is common that not all components implement SafeSEH.

SEHOP is bypassed if ASLR is compromised via a memory disclosure vulnerability.

So, what does this have to do with the security benefits of a UNIX foundation?

UNIX and UNIX-like operating systems, such as Mac OS X and Linux, don't have structured exception handling. Mac OS X and Linux use system calls available by default in the operating system to manage exception handling. So, SEH overwrites, as a vector to increase the number of exploitable vulnerabilities, doesn't exist in these operating systems. The signalling system used in these operating systems isn't liable to this type of manipulation.

SEH overwrites do provide a plausible explanation for more vulnerabilities being exploitable in Windows.

http://www.i-hacked.com/freefiles/EasyChat_SEH_exploit_v1.3.pdf

http://www.sysdream.com/sites/default/files/sehop_en.pdf

8) Windows has far more public and/or unpatched vulnerabilities than OS X.

http://m.prnewswire.com/news-releas...-vulnerability-in-microsoft-os-110606584.html -> article about 18 year old UAC bypass vulnerability.

9) Password handling in OS X is much more secure than Windows.

The default account created in Windows does not require a password. The protected storage API in Windows incorporates the users password into the encryption key for items located in protected storage. If no password is set, then the encryption algorithm used is not as strong. Also, no access controls are applied to items within protected storage.

In Mac OS X, the system prompts the user to define a password at setup. This password is incorporated into the encryption keys for items stored in keychain. Access controls are implemented for items within keychain.

Command line functions that could be used by malware to compromise protected storage require Sudo. Sudo in OS X is not available unless a password is set. http://support.apple.com/kb/HT4103

Also, Mac OS X Lion uses a salted SHA512 hash, which is still considered cryptographically secure. It is more robust than the MD4 NTLMv2 hash used to store passwords in Windows 7.

http://www.windowsecurity.com/articles/How-Cracked-Windows-Password-Part1.html -> article about Windows password hashing.

10) The new runtime security mitigation improvements to be included in Windows 8 have already been defeated.

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

Alternative methods to defeat the runtime security mitigations in Windows 8 were also demonstrated at pwn2own 2013.

The runtime security mitigations and other security protocols in Windows 8 are essentially the same as Windows 7 but with only slight modifications. This is why these protections are also being defeated in Windows 8.

To put this into perspective, methods to bypass the new runtime security mitigations in Mac OS X Lion and Mountain Lion are not yet available.

11)In regards to recent earlier version of Mac OS X:

The following article relates to varying levels of security mitigations in different Linux distros but it is applicable in revealing that the runtime security mitigations in some earlier versions of Mac OS X prior to Lion were far from inadequate.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

While Mac OS X Leopard/SL lack full ASLR, Windows Vista/7 have stack canaries (aka stack cookies) that are trivial to bypass.

The following link shows the issues with stack canaries in Windows. -> http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf

So:

Windows Vista/7 = NX + ASLR
Mac OS X Leopard/SL = NX + stack cookies

These articles show that NX in combination with stack canaries is more difficult to bypass than a combination of NX and ASLR.

12) Mountain Lion only improves upon the security of Lion.

BTW, Safari on a Mac running Lion was not hacked at pwn2own 2012.

And, Safari on a Mac running Mountain Lion was not hacked at pwn2own 2013.

But, Macs aren't completely immune from all attacks. Java applets are only protected by the Java sandbox which is independent of the protections provided by OS X. Luckily, the default security setting of Java have been increased and Apple is diligent to blacklist vulnerable versions of Java via XProtect, which is included in OS X, when security threats arise.

Also, the robust discretionary access controls in OS X mitigate the usefulness of Java attacks at least in mainstream malware, such as malware that targets protected data entry to steal banking credentials, so the typical consumer isn't at risk. These types of exploits against Macs only target specific individuals who work for companies that have valuable intellectual property.

 

[GGJstudios]

Windows is far more secure, holes get patched immediately.

If Windows is so secure, explain why there is so much malware in the wild for Windows, and relatively little for OS X. And no, it's not due to marketshare, as already proven. You would benefit from taking the time to read munkery's posts.

Oh, and safe computing INCLUDES using an antivirus, not just using one.

If you choose, you can certainly use a third-party antivirus app, along with practicing safe computing. As has already been proven, antivirus apps are not as effective in protecting against malware as practicing safe computing. Safe computing alone will protect your computer better than using a 3rd party antivirus app alone.

Learn to use a computer, please.

If you knew my experience with computers, you would know how completely laughable that statement is.