Hacker News Reader

Comment by saagarjha | Hacker News Reader

Mac users cringe worldwide as they anticipate overzealous IT departments mandating that they install this on their computers. Serious, though: why does this exist? What does it protect Macs from? There are only a handful of things that actually target macOS, and XProtect flags most of them pretty quickly…

View on HN

My ${dayjob}’s IT department installs security software from Symantec onto the Macs in our organisation. If they swap that out for the new Microsoft tool in the article that might be a net benefit.

Same, and Symantec is hot garbage that eats CPU and battery for no real benefit.

Oh yes, our IT has mandated it installed on our (oldish) build server. That went about as well as you can imagine, with all the file access.

Having enacted similar policies before i can say with some certainty your IT department don't actually care. They're most likely trying to fill out a checkbox on some compliance/tender document from a decade ago.

Some cyber-liability insurance policies mandate the use of "industrial-grade" antivirus, whatever that means.

I've seen some computers used in an industrial setting and their grade of anti-virus was some version of McAfee from 2005.

I've had security software from Bitdefender installed on my office Mac. This would probably be an improvement.

I run BitDefender on my mac from time to time and it has found and removed files from time-to-time.

And what kind of files were those? Not everything flagged by an antivirus is guaranteed to be malware.

Probably EICAR

That was my reaction. Microsoft is smart to capitalize on overzealous IT Security departments though. There’s a lot of money to be made in the gradual extinction of Windows. I’m surprised they didn’t go for Android though.

> I’m surprised they didn’t go for Android though.

Just wait...

It's useful for enterprise customers. It's more advanced than XProtect.

How? XProtect prevents execution of known binaries based on checksums without impacting system performance. How could anything be more effective?

My understanding is XProtect works off signatures and only for data coming in from certain pathways (registered quarantine agents, chrome/safari etc). This doesn't protect against using a vulnerability in an app (chrome/safari) to trigger another process to download a malicious payload.

Being signature based instead of behavior based limits it's ability to detect evolving attacks.

The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-ga...

Some contracts end up having clauses that require anti virus software to be used, sometimes on every networked system, which means that they need to load up /something/ to check that box.

Maybe it exists so people think Mac OS is insecure?

Reply on news.ycombinator.com