Hacker News Reader

Comment by caseyohara | Hacker News Reader

I use a Mac for work and personal, and I feel like I take the reasonable precautions to avoid malware/ransomware/spyware/*ware (ex. prefer the App Store when possible, only download stuff from trusted sources, etc.) What more can I do to be safe? In 2017, is it recommended to use some kind of antivirus on a Mac? I've always been told it's unnecessary, but it seems like nefarious software is becoming more commonplace on the Mac.

View on HN

Use a cloud-based backup service like BackBlaze or CrashPlan that saves old versions of your files. Since these backups are not connected like regular read-write hard drives, there should be no way for the ransomware to encrypt or delete the old versions.

I really discourage from using CrashPlan. I have had very bad experience with that app. It was constantly crushing and overused HW resources.

I've used it for years with no problems. But I've never had to restore anything yet, knock on wood.

Turn off iCloud storage though. Holy crap it messed with my Back Blaze stuff when the documents folder all went to the cloud and got deleted off the local drive. As easy as that sounds to fix, it isn't. What a terrible default option for an OS update.

This is it.

The paranoid list/methods in the sibling comment by Razengan is good, but you cripple and annoy yourself (no admin account etc).

Hopefully most mac users backup their files with Time Machine, easy to use and that would probably defeat the ransomware.

> probably

Not the best attitude to have when it comes to backups.

If you seek a heuristic way to prevent ransomware on Mac, RansomWhere[1] by Objective-See is awesome and free of charge. It constantly monitors the file system, and if it sees a sudden burst of encryption, will freeze the concerning process. Yes, you'll 'lose' at least a few files, but major loss is prevented. Obviously, you'll need to turn it temporarily off if you want to do any legit encryption. [1] https://objective-see.com/products/ransomwhere.html

I got too many false positives due to backup software and had to remove the tool.

That's weird, you should only have to `allow` your backup tool once. From the site:

* allow

Tells RansomWhere it's ok to let the process continue running. This will be persistently remembered; you'll never be alerted about this binary again.

> What more can I do to be safe?

• Work from an standard (non-admin) user account.

• Review the settings in System Preferences » Security & Privacy and pick a reasonable ground between convenience and security.

• At the very least, "Require an administrator password to access system-wide preferences" (found under the "Advanced..." button.)

• Be wary of any third-party app that asks for an administrator password, and try to see if it runs after denying the prompt. Dropbox, for example, seems to work fine even if I cancel its second (after installation) admin prompt. (There were news about it faking the prompt and storing your macOS password [2] for automatic updates...)

• You may want to tighten the firewall settings, and/or consider Little Snitch [3].

• If you have to install something from a .pkg file, which can autorun scripts, try to review the .pkg and its scripts with Pacifist [0] first. It may be possible to just extract the payload with Pacifist and run the app just fine without "installing" the .pkg.

• Make regular backups. Automatic (e.g. Time Machine) AND manual (of your most important stuff at least.)

• Don’t use the same passwords for different things.

• Enable multi-factor authentication on as many services as you can.

• Visit dodgy websites in private browsing mode, or a secondary, locked-down browser like Tor [1].

• If you can't help downloading pirated/"cracked" apps or games, try to run them from a different user account.

• If concerned about outright theft of your Mac, enable FileVault full disk encryption, and set a firmware password. [4]

• Whenever you're bored or something is acting janky, check the usual places where third-party processes can install themselves and hook into your system:

- System Preferences » Security & Privacy » Privacy » Accessibility

- System Preferences » Users & Groups » Login Items

- /System/Library/LaunchAgents, /System/Library/LaunchDaemons, /System/Library/StartupItems

- /Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems, /Library/Internet Plug-Ins

- Check for 3rd-party kernel extensions:

  kextstat -kl | awk ' !/apple/ { print $6 $7 } '

• Oh and before you paste any command/script (like the above) from the internet into your terminal, see the man page for each command and its arguments first. :)

----

I've used Macs without an antivirus since 2012 and I haven't been hit by malware yet... I think. :)

[0] http://www.charlessoft.com

[1] https://www.torproject.org/projects/torbrowser.html.en

[2] https://news.ycombinator.com/item?id=12463338 (How Dropbox Hacks Your Mac)

[3] https://www.obdev.at/products/littlesnitch/index.html

[4] https://support.apple.com/en-us/HT204455

> There were news about [Dropbox] faking the prompt and storing your password

Wow, I've missed that. An example of the article:

http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dir...

"note the ‘Type your password…’ sentence is both misaligned and is spaced into a separate paragraph, unlike genuine authentication requests from OS X. The phrasing of the first sentence “your computer password” is also very “un-OS X”."

Additionally if you're really paranoid

- Use LittleSnitch or similar to block traffic per process

- Use ad blockers in your browser and make sure Flash, Java and Silverlight are off by default

- Do update regularly

If you care about security in case your device gets stolen

- Use full disk encryption

- Do /not/ forget to also set a firmware password

> Check for 3rd-party kernel extensions:

Let me add one:

- Not paste commands from the internet into your terminal.

This one's fine! I'm also nitpicking.

Just a little nit-pick: checking for kernel extensions that don't have Apple in their name is definitely not the same as checking for 3rd-party extensions... :P

Ah of course. Just a less cluttered starting point, I suppose :P

> At the very least, turn the firewall on

It's amazing how many Mac owners have this turned off. Why?

It’s off by default..

Why?

Because it's annoying and it doesn't help — most people don't care for managing a firewall, nor should they. If an attacker has run an executable on your laptop, whether you block it from phoning home or not is hardly your main concern.

You don't run a firewall to prevent a compromised system from dialing out, you run it to prevent other compromised systems on the network from dialing in. Everyone on the same wifi network is an attack vector.

Good point. Most importantly, that's the far less annoying use-case: one can imagine a simple UX with a list of applications bound to LISTEN on an external interface for you to whitelist for an hour, a day, or indefinitely. I think browser exploits are still a slightly more common attack vector, but that's certainly an option.

Because it's an ingress firewall and by default netstat -an returns zilch, so a firewall would have zero work to do.

┐(°—°)┌

I'm not sure, but maybe simply turning the firewall on in macOS doesn't provide any benefit if everything else is fine, and you have to lock it down and disallow all requests by default to actually get added security through it.

Edited the recommendation after reading the sibling comments.

Because a hardware firewall is infinitely more effective. If your router has a firewall, that should be turned on first. If it doesn't, that's when you should look at turning on the Mac firewall.

Regular backups with the drive disconnected from your machine when you're not backing up or restoring and a second (or more if you're paranoid) drive somewhere else entirely in case your house burns down. The best free options here are jwz's method[1] and Time Machine. Ransomware can't encrypt files that it can't access because the drive is disconnected, and by having a spare somewhere else (updated once a month or so) you prevent yourself from losing everything if you don't notice the malware and it eats your local backup drive.

I use Little Snitch configured in Silent mode to Deny All and then I allow only the things I want to go outbound out of my machine (though I do let my machine talk to my home network freely). You might want to consider that.

I also use Avast's free antivirus for the Mac, but with the Email and Web shields off. I find that overkill when I have the File shield (real-time protection on file access) already enabled.

[1] http://nullrefer.com/?https://www.jwz.org/doc/backups.html

(Edit: fixed the referrer to the jwz page)

Your link redirects to a picture of a scrotum in an eggcup.

Try this instead: http://nullrefer.com/?https://www.jwz.org/doc/backups.html

Sorry, I was not aware that happened. I'd like to say that it was completely unexpected, but I guess I can understand that that as a result of jwz's accounts of working at Netscape being flogged by VCs as way of duping young and naive engineers into sacrificing their youth and hard work on the altar of uncertain reward.

He seems to have a strong dislike for HN in general...

I wish I had read this before I clicked that link. Fuck.

Note that links to jwz.org from HN results in a not very nice, not safe for work, image.

Thanks. I have fixed that.

we've an air gapped one for the kids

every month I have to go in and clean it up - Malwarebytes gets rid of most of the browser trub - to the point Chrome is usable again

they are casual browsers - something is very wrong when kids can render a Chrome install unusable after an hour or so of clicking flashy things

Extraordinary. I have two kids who each have their own accounts on a couple of Macs and over the space of 5 years I have never had to clean Malware off.

1. Set them up with managed accounts 2. Use parental controls to stop them from installing things 3. Set the default browser to Safari which works better with Parental Controls 4. Try using the Parental Controls automated web filter. It's pretty good and not too stringent. 5. TALK to your kids about the importance of NOT simply clicking indiscriminately on random stuff.

it's not random stuff - it's more often than not the game sites that are ranking which ask to mod the Chrome config - not ads

the OSX parental controls break Chrome - or did when they were on - and were overly intrusive - if you're typing in the password every 10 mins you might as well not have one - the parental controls on router don't work with HTTPS

what I need is Google Account / Chrome setup that is age aware and:

1. filters search results on age of user

2. downranks sites that prompt to alter configs or force email address to run a game

3. enforces strict content (not just on results, but also on what Chrome will render)

4. locks down Chrome config

5. filters gmail more aggressively than it would for an adult

6. notifies adult user on suspicious activity (not reports sites visited etc. but reports if something serious happens)

So,

0. Use Safari not Chrome

5. Use Mail.app rather than the Gmail web interface. Parental controls then let you whitelist addresses that the kids can use e-mail with you can set it up so that if they ask t e-mail someone new, they can request it and you'll get an 'allow/deny pop up.

6. Set up a free OpenDNS account for use on your kids machines and set up a profile for use with them (you can adjust strictness and alerts you want to receive).

7. Once again - talk to your kids. Explain that if they click on something that requests this kind of thing, they are not to run it. Running it will result in reduced computer time and privileges. Ultimately technology can only help you parent, it cannot do it for you.

Out of curiosity, do you ever browse with your kids and keep teaching them what to click, what not and why? I assume that it can't make them completely safe, but it should eventually bring them near to it. If you're doing it, what's your experience with that and where do you think the malware is still coming from?

it comes, mostly, from the online game sites and other shiny honeypots for kids - google "X game" click top link - the game sites themselves override Chrome search bar and home page etc. - they click yes and put an email in to every single prompt to get to the game

it's completely and utterly broken

Why not just wipe the comp/reinstall the browser? Seems easier and safer. Also get them on ublock so they cant click dangerous ads..

Funny, that. I've got several machines around the house which are used by my daughters (~6 and 12 yo) and wife. The machines run Debian, apart from one on which I installed Mint. I have several Android devices for the same purpose. Those Android devices range from a 2011 Ainol Novo 8 Advanced running Gingerbread to a Teclast X80 running Lollipop. I use Debian myself, on client and server hardware. We use Firefox, Seamonkey and Chromium (not Chrome).

I never had a single piece of malware on any of these machines, ever. I do see lots of SSH login attempts to the servers (in vain, naturally) and quite a bit of exploit scanning for vulnerable services but the amount of successful intrusion attempts, whether on client or server, is zero.

Maybe you should to try this solution for your children?

How is a machine with a network connection 'airgapped'?

Not op but my reading was that it is airgapped from the other machines in the household, possibly on a secondary network interface. ¯\_(ツ)_/¯

But... that's not an airgap.

Has the original meaning of the word been lost?

bad phrase - it's on another segment

His backup HDD is airgapped, I assumed. Maybe rather he wipes and reinstalls, making it relatively impossible for malware to stay.

Tried using Safari instead? Might make a difference?

>In 2017, is it recommended to use some kind of antivirus on a Mac?I've always been told it's unnecessary

AV-Comparatives[1] puts out a pretty comprehensive, quantifiedm real world benchmark of antivirus comparisons that they update every month for Windows (a more dynamic threat environment) and once a year for Mac[2]. Let's take a best case scenario (which isn't likely) that there are _no_ security vulnerabilities in any software on macOS. You still have the issue of being an accessory to spread malware to Windows machines if you aren't screening for them. "Oh hey boss, include this file in the Windows deployment of our software".

A biological equivalent would be, even if you are an asymptomatic carrier[3] (macOS claim) you can still transmit the disease to someone else, therefore should limit transmission through condom use, gloves, general precautions (run an antivirus)

A final point to add is one regarding risk engineering. The decision to increase the robustness of a design is not governed by the probability of the event (Mac's hardly ever get infected!), it is governed by the magnitude of the effect of the event. Even if the probability of malware on a Mac is low[4] if the effect of the infection is catastrophic (your entire business is destroyed) you should be increase the systems robustness to threats.

[1] https://www.av-comparatives.org/about-us/ AV-Comparatives is an independent organization offering systematic testing that checks whether security software, such as PC/Mac-based antivirus products and mobile security solutions, lives up to its promises. Using one of the largest sample collections worldwide, it creates a real-world environment for truly accurate testing. AV-Comparatives offers freely accessible results to individuals, news organizations and scientific institutions. Certification by AV-Comparatives provides an official seal of approval for software performance which is globally recognized.

Currently, AV-Comparatives' Real-World Protection Test is the most comprehensive and complex test available when it comes to evaluating the real-life protection capabilities of antivirus software. Put simply, the test framework replicates the scenario of an everyday user in an everyday online environment – the typical situation that most of us experience when using a computer with an Internet connection.

AV-Comparatives works closely with several academic institutions, especially the University of Innsbruck’s Department of Computer Science, to provide scientific testing methods.

[2] https://www.av-comparatives.org/wp-content/uploads/2016/07/a...

[3] https://en.wikipedia.org/wiki/Asymptomatic_carrier

[4] http://www.thesafemac.com/mmg-catalog/ https://en.wikipedia.org/wiki/MacOS_malware

Reply on news.ycombinator.com