Malware and macOS

Am I hallucinating?

No, but that threat may be overstated. To cite the most popular example, it is very common to find the execrable MacKeeper installer .dmg or .pkg in people's Downloads folder, often multiple copies of it.

Merely loading a website can automatically initiate a download of any file of any type hosted by that website, a fact of Internet browsing life that tends to concern people. Since the user has to get past Gatekeeper and explicitly and intentionally open and install such things for them to cause any harm, I don't consider that practice a significant threat. It's more accurate to characterize such websites as simply ill-mannered.

Adobe Flash Player and Java:

When Apple and others became sensitive to their potential vulnerabilities, they made the logical decision to stop bundling Adobe Flash Player and Java with their default browser configurations, telling customers if they want to install those things they're on their own. Even if a user chooses to install them though, Apple blocks outdated versions of those products automatically.

Flash Player's popularity is also commonly used to deceive people into installing junk—adware in particular, but there is no reason the same tactic could not be used for a Trojan or anything else: Beware bogus Adobe Flash "installers". Please bear in mind that particular exploit has absolutely nothing to do with Flash and is strictly unrelated to it. It just leverages Flash's ubiquitous nature to exploit human fallibility.

Really, no one should be using Adobe Flash any more. If your cable service provider requires Flash Player, presumably they are aware that Adobe announced its end of life a few months ago...? They have about three years to address that, but they shouldn't have waited even this long.

There is no -ish about my paranoia. I tend to think in terms of probabilities and consequences: a small probability of occurrence couple with a potential catastrophic result warrants action to head it off.

The practices you described above are an excellent model of responsible computing practice. Well done! You ought to publish them in a User Tip. They can be summarized as follows:

• There is no one-click solution to computer security:
  • Even if it were to exist reliance upon such a thing is ill-advised because it increases one's threat exposure due to actual or potential vulnerabilities in those products, as well as the likelihood of conveying a false sense of security.
  • Reports of Macs with various and sundry "anti-virus" products that have nevertheless been affected by malware of various descriptions are common on this site.
  • Beware of products loudly claiming to "protect" you, your Mac, or anything else, even if they are "free". Especially if they are free. Nothing is free.
• An effective security strategy requires multiple defenses (or "layers" if you prefer):
  • That "layered" concept applies not only to computing but to security in general: personal security, building security, transportation security, information security, infrastructure security, etc.
  • Any single one of those defenses could be breached since none of them are perfect.
  • Multiple, redundant defenses provide the only means to convey effective protection, as long as each "layer" reduces your threat profile.
  • Introducing vulnerabilities (by installing consumer "anti-virus" products for example, or by incorporating a "back door" as the US Justice Department famously ordered Apple to implement last year) is counterproductive because it nullifies other defenses.
• Remain vigilant for scams:
  • Scams of all descriptions are a constantly evolving threat as old as mankind itself.
  • As a Mac owner, you are wealthy. Fabulously, ridiculously wealthy, much more so than the vast majority of the world's population. You are a fat target just waiting to be exploited by criminals all over the world, many of them living in unimaginably desperate conditions, who can earn a year's living with a single phone call or a link in an email sent from a rented PC. Act accordingly.
• Security is not a product. It is a practice.

You're not wrong. In fact Apple's products represent an enormous target for scam artists of all stripes.

The problem is the corrupt and filthy "anti-virus" business is on their side, not yours, with plenty of paid and unpaid shills representing their interests.

Read Effective defenses against malware and other threats.

DesertRatR wrote:

I've seen other posts whereby folks claim AV and other anti-malware SW somehow hurts a Mac. Can you please elaborate on that?

There are a lot of answers to that question, some of which I did not address in that User Tip, such as the following:

https://www.wsj.com/articles/russian-hackers-stole-nsa-data-on-u-s-cyber-defense -1507222108

pull quote in case the above is behind a paywall:

“You’re basically surrendering your right to privacy by using Kaspersky software,” said Mr. Darché, who is chief security officer for Area 1, a computer security company.

To their credit, Kaspersky essentially responded by saying "what did people expect? Of course that's what our software does" or words to that effect. Not that I have read them, but its terms and conditions probably don't try to hide that fact.

Now... if a user chooses to ignore facts and reality, and really, really wants to use "anti-virus" junk in willful ignorance of such knowledge, Kaspersky isn't a bad choice. There are far worse products to choose from, most of which simply harvest the information on your Mac just so that they can sell it (like AVG) or exist for the sole purpose of providing kickback revenue to entities that advocate or require its use (like Trusteer). But you can't very well install "anti-virus" junk and then complain it does some very virus-like things.

I'd rather have a virus.

When the truth comes to light I prefer to just sit back and watch the show.

https://phys.org/news/2017-11-kaspersky-blames-nsa-hack-infected.html

There are plenty more sordid stories where that came from, and there will be plenty more to come, until people appreciate how the entire "anti-virus" consumer software business has been built on a foundation of lies and deception. Deceiving a perennially gullible public has always been a monumentally successful strategy though, and I'm not holding my breath.

BTW, what is your take on Intego AV ...

Apple is the most famously secretive company in the world. Apple's operating systems run only on Apple's hardware and they license neither to anyone. Why anyone or any thing would claim macOS knowledge superior to Apple's own is one of the most curious aspects of 21st century technology.

I personally evaluated all the popular Mac "anti-virus" products a while ago. Their effects on a Mac ranged from benign but useless to practically malicious. Intego's "Net Barrier" and "Virus Barrier" products resulted in the worst performance degradation of any product I ever used. The Mac became practically unusable as Intego churned and chugged along, looking for viruses that don't exist. No knowledgeable Mac user would have considered it even remotely acceptable.

I think you're missing the point though. This is not about any particular product. All non-Apple "anti-virus" products are categorically worthless. Installing them will expose a Mac to more threats than would exist without them, and the Kaspersky example I cited just happens to be the most prominent.

It shouldn't have come as a surprise to anyone:

Security wares like Kaspersky AV can make you more vulnerable to attacks | Ars Technica

Similar products will have similar vulnerabilities just waiting to be exploited:

It might be time to stop using antivirus | Ars Technica

Security and user space isolation have been a fundamental aspects of macOS since its inception. Each succeeding version has only grown more secure. Outside of proof-of-concept models under controlled conditions a macOS virus has never been successfully implemented, and with the introduction of SIP a while ago it can be said there will never be one. There is only worthless, time- and money-wasting garbage a user can willingly choose to install. Non-Apple "anti-virus" products might as well be in that category.

As computing and communications products go, Apple's are the most secure consumer-grade products on the planet, by far. If Apple's customers are bound and determined to install junk on their Macs though, macOS does little to intervene. If they couldn't, a Mac wouldn't be the general purpose computing appliance that it is. The alternative is iOS, running on devices completely closed to user-inflicted modifications—which is probably where macOS is headed anyway, eventually.

Apple's target demographic has frankly become too stupid not to require such nanny-like impositions, but guess what happens then? You got it, people complain: FTP server, Mac OS High Sierra.

... and firewall?

The purpose of an application firewall is frequently misunderstood. Not surprising, since it is also woefully misnamed. There is no fire and there is no wall. It sounds good though. Like "cleaning".

Two more questions, please. I have read about what I'll call contaminated websites, whereby malicious code is some how inserted into images or other site items.

As far as I am aware, OS X and macOS (and System 1-9) never executed code in data. I don't think any other OS did that, either. I believe that is completely the realm of Microsoft.

In a modern OS, you would first have to generate an exploit over the internet (extremely difficult). Then you would have to use that exploit to inject your malicious code into the execution space. Then, you would have to trick the OS into executing that code. See Kurt's discussion of Flashback. I think it might have been the great nephew of Ralph Nader who said Flash and Java are unsafe at any speed.

I thought I read somewhere one might want to set up a user account that does not have administrative privileges and do all ones web browsing from there. Or is that overkill?

Take a look at this discussion. I think we covered most of the pros and cons: Re: Users & Groups: Do I need a user besides an admin if I am the only user?

Back to the Firewall…

Since your computer is most likely already behind a NAT router, the Application Firewall is superfluous. About the only need for the built-in firewall (and most others) is if you 1) have a laptop and use public WiFi occasionally, and 2) you must enable several sharing services on your laptop when using normally (work, home), then turning on the Firewall when you connect to a public network would be simpler than turning off all of the sharing services. In an older Apple OS, Network Locations did this for you. I wish they'd bring that back.

Unless you enable them in the Sharing System Preferences (or other means), nothing will respond to an external request. So, even if you are open to the wild world of the internet, nothing is listening to respond to an attempt to hack.

Some firewall-like software may be useful to you if you want to see what is talking back to whom. You mentioned being paranoid(-ish), so something like Little Snitch may be entertaining to you.

You're not wrong. Malware and adware are becoming increasingly common on macOS, particularly with items masquerading on free video streaming sites as being necessary add ons to stream a video (i.e. fake Adobe Flash plugins). I like Malwarebytes for Mac and ClamX to scan for and remove threats: Malwarebytes | Free Cyber Security & Anti-Malware Software

https://www.clamxav.com/

No one has ever said it's immune. At least not those folks who are smart enough not to use such a blanket statement.

There are no viruses. None. And haven't been since OS X appeared. The closest anything ever came to being a virus was Flashback. It used one of the many flaws in Java to infect OS X as a back-door method. If you had Java on for your browser, just visiting an infected web site would get Flashback on your Mac. All very virus like behavior, with the caveat that it was Java being used for the infection, not the OS. It is long dead and patched against.

There are oodles of Trojans. Software which requires the user installing it to get on your Mac. Adware, keyloggers, you name it. Somehow, you have to be the one to get it on your system.

One worm. Oompa-Loompa (Leap-A). You first had to infect your Mac via a Trojan that installed Leap-A. It would then act as a worm looking for other Macs in your Messages list. Once found, it would cause that user's Mac to popup an admin password screen to allow it to install. Most folks knew better than to allow something to install they hadn't initiated. While there were likely quite a few unreported instances, experts say a grand total of 50 Macs were infected. It is also long dead and patched against.

Modern OSs like High Sierra have built in protections. There are no Mac virus' out in the wild. Anti virus apps use system resources and provide no benefit. So why install such an app? There is malware in the form of adware or other scams. You have already been provided a link to John's User Tip which addresses these types of malware. MalwareBytes and etrecheck are useful tools often used to remove malware.

macOS is based on BSD UNIX. The OS and applications are sandboxed. If you are an administrator on the system, you can not alter critical system files without authenticating with your administrator credentials. This means any malicious software you download also can not alter those files. You also do not automatically have rights to data stored in other users home folders.

AV software on a mac will, at best, impact performance by attempting to intercept and scan all file transactions, downloads, data transfers to and from the network and Internet, etc. At worst, it can attempt to delete, quarantine, or otherwise bork files when it throws a false positive for an infection. And ALL of the positives it generates will be false, since there are no viruses that can affect macOS. Malware... trojans, adware, etc. are NOT viruses. They are undoubtedly unwanted, but they are not viruses, and AV and active anti-malware SW can not stop them. In order to get them, you have to proactively grant them permission to do what they want to do.

The only anti-anything you need on a mac is common sense. Something that it seems is sorely lacking these days...

Apps like the trusted MalwareBytes for Mac and EtreCheck look for malware in the only places it would typically be found. Which is your user account, and some limited access to the Library folder. That's mostly the reason they work so fast. Time isn't wasted examining every single file and folder on the drive.

With System Integrity Protection enabled, you shouldn't even have to look in the System folder. It is now off limits to everything that isn't part of the installed OS. Third party kernel extensions are no longer allowed in the System folder, and are now relegated to the /Library/Extensions/ folder.

SIP even protects every app installed by the OS. Nothing can be injected into those application packages. Nor can they be altered by any third party software.

AV programs want access to everything, as if your Mac were a PC. This is monstrous waste of time and system resources. Don't use them. They are completely - utterly - worthless.

3) Third party firewalls are also a waste of money. As for incoming threats, there are redundant to the OS FW. And there is no need to catch outgoing threats, as there would be none to catch.

That one does need minor clarification. If you aren't using a firewall capable router, then yes, you need a firewall on the software side. But no, you don't need a third party firewall. The one included with the Mac OS is industrial grade. Turn that one on if you need to. If your router does have its own firewall (and virtually all do), you don't need any firewall enabled on your Mac. They won't have anything to do behind the router.

I have read about what I'll call contaminated websites, whereby malicious code is some how inserted into images or other site items. The user supposedly doesn't even have to click on the contaminated items, but merely open the page with the contamination. Am I hallucinating?

No, not hallucinating. Flashback was the one and only known malware that could do a drive-by infection of a Mac. And that was only if you had Java enabled for your browser. It was patched against years ago. There has been no other such known attack.

Java and Flash have both been slated to be killed off for this reason. They are both full of security holes that allow back-door entrance to the system as Flashback did with Java. Getting rid of both of these browser extensions completely kills off that vector.

I thought I read somewhere one might want to set up a user account that does not have administrative privileges and do all ones web browsing from there. Or is that overkill?

Many security experts suggest setting up any Unix based system that way. You can still perform admin actions from a standard account. It's just that you need to type both the admin account user name and its password. It's an extra layer of protection while using your Mac to be in an account that has less permissions to the file system.