Virus/Worm issue?

[getz76]

You're splitting hairs. "In today's malware environment" obviously can't include unknown malware. All known Mac OS X malware can be completely avoided by practicing safe computing, without the need for 3rd party antivirus software.

I disagree, but your opening sentence is ironic. Common parlance has defined "virus" as any malware, but you make it a point in every post that there are no viruses for Mac OS X. Technically correct, but your average user is using virus to mean any malware, and in most cases the semantics do not matter.

But your definition of "today's malware environment" is more than semantics; it is just wrong. Everyone should be smart when connected to the internet or other networks, but the known and identified is only a portion of the risk.

 

[GGJstudios]

This statement is also just plain WRONG. Zero day exploits are part of todays environment. In the case of flashback, people were exposed long after zero day because Apple didn't release the Java updates in a timely manner.

In the case of Flashback, if people were practicing safe computing, they were completely unaffected by it, since they would have Java disabled in Safari, as has been recommended for over a year. Read the Mac Virus/Malware Info link that appears in most threads about malware. Safe computing will completely protect against the Flashback trojan.

Remember, people got infected with flashback without taking any actions and without any notifications.

Only if they had Java enabled, which is not practicing safe computing. It has been recommended for a long time that Java be disabled. Or have you not been reading the forum?

There were reports of MacDefender infecting users silently as well.

That is false. MacDefender always required user interaction to install. If someone installed unknown software just because they were prompted to do so from a website, that's obviously not practicing safe computing.

We've had these security conversations for a year or two.

Yes, and you're not any closer to being accurate than you were then.

I disagree, but your opening sentence is ironic. Common parlance has defined "virus" as any malware, but you make it a point in every post that there are no viruses for Mac OS X. Technically correct, but your average user is using virus to mean any malware, and in most cases the semantics do not matter.

When I say there are no Mac OS X viruses, I also point out that there are trojans, and I post a link to understand the difference. The semantics DO matter, as it determines the defense required.

But your definition of "today's malware environment" is more than semantics; it is just wrong. Everyone should be smart when connected to the internet or other networks, but the known and identified is only a portion of the risk.

My statement clearly made the distinction that there is still risk from unknown malware. The only way you can make the first sentence of my statement inaccurate is by taking it out of context.

 

[Penn Jennings]

In the case of Flashback, if people were practicing safe computing, they were completely unaffected by it, since they would have Java disabled in Safari, as has been recommended for over a year. Read the Mac Virus/Malware Info link that appears in most threads about malware. Safe computing will completely protect against the Flashback trojan.

Only if they had Java enabled, which is not practicing safe computing. It has been recommended for a long time that Java be disabled. Or have you not been reading the forum?

That is false. MacDefender always required user interaction to install. If someone installed unknown software just because they were prompted to do so from a website, that's obviously not practicing safe computing.

Yes, and you're not any closer to being accurate than you were then.

I know people that have to have java enabled for work. Having Java enabled is valid and widely practiced. The reason that an estimated 600,000 Mac got infected is in large part because Apple was not timely with their updates. Flashback was reportedly discovered in September, Apple patched Java for it in April. THAT is the bigger problem.

You are saying that MacDefender always required user interaction? I'm curious, tell me you credentials again for making that statement and how you know that for a fact? I know that I read reports on it. I wouldn't make a statement of fact it one way or another, its interesting that you can.

 

[GGJstudios]

I know people that have to have java enabled for work. Having Java enabled is valid and widely practiced.

At no time did I indicate that safe computing is widely practiced.

You are saying that MacDefender always required user interaction?

Yes. Name one variant that didn't.

 

[Ccrew]

Oh I'm sorry. Everything about your original post inferred that. My bad.

Understandable. I interface with federal law enforcement constantly as part of my job, but don't work for them.

 

[Penn Jennings]

At no time did I indicate that safe computing is widely practiced.

Yes. Name one variant that didn't.

You made the statement, you back it up. Where else in life can you make a statement and then demand that others prove you wrong? That's just bad form. I found two articles in 2 minutes on google. I found two articles stating that systems were silently infected by MacDefender using search engine optimization.

 

[GGJstudios]

You made the statement, you back it up. Where else in life can you make a statement and then demand that others prove you wrong? That's just bad form.

You made the statement, so it's up to you to back it up:

There were reports of MacDefender infecting users silently as well.

I found two articles in 2 minutes on google. I found two articles stating that systems were silently infected by MacDefender using search engine optimization.

Links?

 

[simsaladimbamba]

You made the statement, you back it up. Where else in life can you make a statement and then demand that others prove you wrong? That's just bad form. I found two articles in 2 minutes on google. I found two articles stating that systems were silently infected by MacDefender using search engine optimization.

Can you please share the search and/or links with us, or is it up to us to do that too?

Btw, MacDefender was only scareware, wanting to trick you into purchasing some software in order to remove some alleged "viruses", that weren't there before. Thus if it could even install without any user interaction, the user still needed his or her own will to pay for it.

 

[Penn Jennings]

Can you please share the search and/or links with us, or is it up to us to do that too?

Btw, MacDefender was only scareware, wanting to trick you into purchasing some software in order to remove some alleged "viruses", that weren't there before. Thus if it could even install without any user interaction, the user still needed his or her own will to pay for it.

It may have been only scare ware. That is irrelevant. The relevant part is that there are reports of non authorized software being installed on workstations without prior approval or notification.

When someone breaks into your house while your family is home, do care what his intent is?

 

[GGJstudios]

The relevant part is that there are reports of non authorized software being installed on workstations without prior approval or notification.

And again you fail to post links to prove your statement.

 

[simsaladimbamba]

It may have been only scare ware. That is irrelevant. The relevant part is that there are reports of non authorized software being installed on workstations without prior approval or notification.

When someone breaks into your house while your family is home, do care what his intent is?

But can you link to those articles?

 

[/user/me]

But can you link to those articles?

You can't link to something that doesn't exist....

 

[simsaladimbamba]

You can't link to something that doesn't exist....

With looking at Penn and the past conversations s/he had with Mister GGJstudios, I concur. But one can try. Maybe one day. And I like to see Mister GGJstudios be proven wrong. I try it all the time with those Other battery malware, but guess what, the spinach cat at my hat.

 

[GGJstudios]

With looking at Penn and the past conversations s/he had with Mister GGJstudios, I concur. But one can try. Maybe one day. And I like to see Mister GGJstudios be proven wrong. I try it all the time with those Other battery malware, but guess what, the spinach cat at my hat.

I've been wrong about things many times in my life, as I'm far from being perfect. After all, making mistakes is a great way to learn! I've been asked in the past how I know as much as I do. My answer is, "Simple! I make mistakes faster than most people!"

I don't have a problem with being proven wrong. What I do take issue with is someone claiming I'm wrong without providing proof to back up their claim.

 

[simsaladimbamba]

I've been wrong about things many times in my life, as I'm far from being perfect. After all, making mistakes is a great way to learn! I don't have a problem with being proven wrong. What I do take issue with is someone claiming I'm wrong without providing proof to back up their claim.

See, and that is where you are wrong. Here is the link.

 

[GGJstudios]

See, and that is where you are wrong. Here is the link.

Oh yes! Now I see it! Thanks!

 

[simsaladimbamba]

Oh yes! Now I see it! Thanks!

Glad to have helped. Now can we open a betting bucket* or whatever it is called, that we will get links in the end? Or will it be rechts?

* betting pool I suppose transparently the opacity of the luma key

 

[Ccrew]

You can't link to something that doesn't exist....

http://surfbits.posterous.com/macguard-is-mac-defender-only-much-worse

http://betanews.com/2011/05/25/this-mac-malware-thing-is-really-scary-now/

http://www.intego.com/mac-security-blog/flashback-is-not-a-trojan-horse-what-is-it/

snap

"A recent phishing scam has targeted Mac users by redirecting them from legitimate websites to fake websites which tell them that their computer is infected with a virus. The user is then offered Mac Defender "anti-virus" software to solve the issue.

This 'anti-virus' software is malware (i.e. malicious software). Its ultimate goal is to get the user's credit card information which may be used for fraudulent purposes."

I'd call the end result a bit more than "scareware" Even Apple calls it malware. http://support.apple.com/kb/HT4650#

 

[GGJstudios]

http://surfbits.posterous.com/macguard-is-mac-defender-only-much-worse

snap

From that link:

The new variant, which Intego ranks as only "medium" risk, still
requires some interaction from the user -- and that's at least limited
barrier to infection.

snap

 

[/user/me]

http://www.intego.com/mac-security-blog/flashback-is-not-a-trojan-horse-what-is-it/

snap

From that link:

A Trojan horse is malware hidden in something that you have downloaded, or have received by e-mail. You think it’s something useful – an application or a file – but when you open it, even though it might seem to do something useful, it actually installs malware. Many Trojan horses use “social engineering” to trick users into opening them.

A user has to actively download/install the trojan/worm.

snap

 

[Ccrew]

From that link:

snap

Missed the part that shot you down though. THIS is where I have issues with your virus posts. .

"Unlike the previous variants of this fake antivirus, no
administrator's password is required to install this program. Since
any user with an administrator's account -- the default if there is
just one user on a Mac --can install software in the Applications
folder, a password is not needed. This package installs an
application, the downloader, named avRunner, which then launches
automatically. At the same time, the installation package deletes
itself from the user's Mac, so no traces of the original installer are
left behind."

----------

From that link:




A user has to actively download/install the trojan/worm.

snap

You missed the next sentence dude.

"But recent versions of Flashback – the name has remained the same because the underlying malware code is similar – have been using Java vulnerabilities to infect Macs.The difference between these two methods is important. In the first method, users are tricked into launching something which then infects their Macs. In the second, a “drive-by download” takes advantage of a vulnerability to install, in many cases, without users being aware that anything has happened. (And the actual malware that is installed is called a “backdoor,” because it opens ports on an infected computer enabling remote users to access those computers and the data they contain.) " and links here: http://www.intego.com/mac-security-...es-advantage-of-unpatched-java-vulnerability/



You're both doing a really good job of only cherry picking lines to make your point while ignoring that which doesn't.

 

[GGJstudios]

Missed the part that shot you down thuogh.

"Unlike the previous variants of this fake antivirus, no
administrator's password is required to install this program. Since
any user with an administrator's account -- the default if there is
just one user on a Mac --can install software in the Applications
folder, a password is not needed.

That's not true. As I've said many times, and as is clearly stated in the Mac Virus/Malware FAQ:

It may automatically launch, depending on your browser and settings, but it cannot be installed unless you actively continue the installation process, which may or may not include entering your admin password. The solution is simple: don't! If you quit the installation process without completing it, nothing on your Mac is affected.

The discussion wasn't about whether a password was required or not. MacDefender and its variants all required user interaction to install.

"But recent versions of Flashback...

You're coming into the middle of a specific discussion, which wasn't about Flashback. It was claimed that MacDefender installed silently without user interaction. That is what is being refuted, not Flashback.

 

[Ccrew]

It was claimed that MacDefender installed silently without user interaction. That is what is being refuted, not Flashback.

MacDefender's later iterations, which became "MacGuard" were able to install without user interaction

"Now comes word that Mac Defender –– which required users to actually click through a few sites and enter a password before the malware latched onto the hard drive –– has spawned the variant bug Mac Guard, which requires users to enter no password at all. Instead, the malware downloads more or less automatically, after a user has logged on to one or another fake sites."

 

[GGJstudios]

MacDefender's later iterations, which became "MacGuard" were able to install without user interaction

No, they weren't. Link, please.

as spawned the variant bug Mac Guard, which requires users to enter no password at all.

It still required going through the installation process, even though it didn't ask for a password.

Instead, the malware downloads more or less automatically, after a user has logged on to one or another fake sites."

All variants of MacDefender would download automatically. None installed themselves without user interaction.

 

[Ccrew]

No, they weren't. Link, please.

Christian Science Monitor's Tech section. Have the discussion with them that they're wrong, I merely cut and pasted from their article. Hence the quotes. I'm merely disassembling your arguments and watching you try to defend using narrower and narrower requirements.

I think any non-rabid Apple user can probably now read this thread and get a semblance that what's constantly being harped is quite possibly flawed. I'm done.