Do You Even Need Antivirus Software in 2024?

Mac has builtin antivirus software similar to "Windows Defender" but it's hidden to spread the myth that the Mac has something fundamentally different about its design to make it impossible to create viruses and malware. It's called XProtect:

https://arstechnica.com/gadgets/2022/08/apple-quietly-revamp...

And there are a bunch of other services running. From the arstechnica piece

> ... Apple has added multiple anti-malware features to macOS, though they're not always branded that way. Gatekeeper, app notarization, System Integrity Protection, the Signed System Volume, and access controls for hardware and software are all, one way or another, about proactively protecting system files from being tampered with and making sure that installed apps do what they say they're doing. Another under-the-hood tool, the Malware Removal Tool (MRT), behaved more like a traditional anti-malware scanner, periodically receiving definitions updates from Apple so that it could scan for and remove malware already present on your system.

This is no different from Windows Defender

Agreed. Last time I saw a third-party antivirus in a Windows machine was 10 years ago and it was due to company policy.

That's precisely why it was never necessary.

> The internet is full of outdated cybersecurity advice that just won’t die but should, like “public WiFi is unsafe” and “you should change your passwords regularly.” For the more pedantic in the crowd...

This was never pedantry and still isn't.

Windows defender is not only useless. It actually deletes files without asking.

> Additionally, Windows 11 has made huge improvements in the security department and has learned from many of the mistakes that made past

Cough, some days ago hackers compromise Microsoft, ransomware is a good business...

Antivirus is likely not useful for the vast majority of users that regularly browse HN.

> Keep everything updated. [...]

> Remove things you don’t need. [...]

> Use wisely. [...] This means implementing practices in your life like only using trusted, official websites

> If you must... If you’ve read all this and still decided that antivirus software is right for you, be sure to pick one wisely. [...]

What a piece of B.S.! Backup would be the first thing to recommend. But the word "backup" is nowhere to be found in that article!

So why install antivirus software?

It is just one more layer app that should run with elevated privileges, increasing both attack surface and trying to increase defense depth. So why increase complexity, for unknown gains?

But nice of the article, to link tools that help you think about threats for iOS/macOS.

> changing your passwords regularly can have some potential benefits (mostly for companies)

No. This goes back to the way-too-broad Appendix A ("Estimating Password Entropy and Strength") of NIST SP 800-63 in 2004. Which explicitly says "Readers are cautioned against interpreting the following rules as anything more than a very rough rule of thumb method to be used for the purposes of E-authentication", but, you know, it's NIST and became a whole thing anyway.

NIST finally came out explicitly against rotation in 2017. The specific guidance since then: "Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator."

> Macs, for example, are notoriously secure

That's like saying Windows Phone is notoriously secure. I mean, maybe? But mostly nobody cares enough to attack them. Macs aren't directly targeted much because a) the business world doesn't run on them, and b) most attacks are credential phishing, i.e. platform-agnostic, for the handful of mac-using targets you might care about. There are still plenty of attacks on macs, pentesting tools for them, LOOBins, so on. Just most users aren't on macs, workloads aren't on macs, infrastructure (Exchange servers, domain controllers) isn't on macs. Probably it would be worthwhile to attack them more, honestly. Maybe the bad guys just haven't seen Moneyball yet.

> the vast majority of compromises [...] convince the targeted user to hand over their own credentials or download malicious software or otherwise convince the target to somehow give the attacker access

Well, yeah. Chrome replaced Internet Explorer, PDF.js replaced Acrobat Reader, the Microsoft Office Equation Editor replaced itself, Flash is gone. The exploitable computing surface today is way smaller than it was 10 years ago. At the same time, everyone's identities and accounts have moved to the cloud, so the juice-to-squeeze ratio of targeting a device is way down. Still happens every day, but rarely with exploits.

I'm not sure "you chose to run the malware, idiot" supports the claim that "you don't need antivirus", though. Like, people do dumb things sometimes. That's exactly why they might need antivirus. The built-in stuff is as good as anything else for consumers, so sure, stick with Defender or whatever. That's still antivirus. The ~98th percentile of people by tech-savviness should probably turn it on.