Do I need to buy any protection software?

[Ethosik]

Please please please stop perpetuating these dangerous myths.

Little Snitch is a great tool - IF you have time to configure it correctly. As such it becomes either a labor of love or a metaphorical albatross around the neck.

Malware has become popular on Macs simply because Macs have become popular. Malware authors strike where they can get the best bang for their buck.

And M1 is not stopping them. Period. Rosetta 2 be damned.

Malware Is Now Targeting Apple’s New M1 Processor

Two distinct strains of malware have already adjusted to the new silicon just months after its debut.

www.wired.com

Malware these days can be delivered simply via a bad advert. There’s a reason why Apple continuously update the Mac with Security fixes - because they are blocking previously known attack vectors.

Zero day exploits are becoming more and more common. Sadly it’s also getting harder for AV apps to keep up but at least they can help.

You seem to advocate the ”head in the sand” principle.

If you personally want to do this then have at it, but recommending that other users don’t is wrong on every level.

But I thought macos is SOOOO SECURE!!!

Sorry, I’m frustrated by all the “let’s change iOS to be like macos, there is no problems at all!!!!” Attitude.

 

[Macative]

I have the new MacBook Pro 16" M1 running Monterey12..3.1. Do I need to buy any protection software?
I have had MalwareBytes for several years but I'm not convinced it is doing anything on my new MBP as it scans in under one second.
There seems to be so much disagreement over whether we need anything these days, so I don't want to add any potentially damaging software if it is really unnecessary.

Any qualified help would be appreciateed.

Thanks
John

You absolutely do not need anything. Just don't download crap from phishy websites.

 

[TiggrToo]

You absolutely do not need anything. Just don't download crap from phishy websites.

Silver Sparrow would like to remind you how awful this "advice" is...

New malware found on 30,000 Macs has security pros stumped

With no payload, analysts are struggling to learn what this mature malware does.

arstechnica.com

 

[NC12]

Printers don't have a "wiki" on them. Many do run a web interface for configuration, but none of this is relevant to the topic here.

I think they are just messing around, they are a G3 so I doubt they are actually inexperienced in these things

 

[chrfr]

I think they are just messing around, they are a G3 so I doubt they are actually inexperienced in these things

I don’t think so. Check the posting history– the quality of posts doesn’t necessarily correlate to quantity.

 

[jdb8167]

Silver Sparrow would like to remind you how awful this "advice" is...

New malware found on 30,000 Macs has security pros stumped

With no payload, analysts are struggling to learn what this mature malware does.

arstechnica.com

The article is more than a year old. Nothing implies that it uses any zero-days but is a normal package installer. In other words the user has to deliberately install it. Then there is this:

The URL check, though, suggests that malicious search results may be at least one distribution channel, in which case, the installers would likely pose as legitimate apps.

An Apple spokesperson provided a comment on the condition they not be named and the comment not be quoted. The statement said that after finding the malware, Apple revoked the developer certificates. Apple also noted there's no evidence of a malicious payload being delivered. Last, the company said it provides a variety of hardware and software protections and software updates and that the Mac App Store is the safest venue to obtain macOS software.

So the most likely path before Apple revoked their developer certificate was people installing what they thought was pirated software.

It looks like Apple’s built-in protections should easily prevent this Trojan.

 

[TiggrToo]

The article is more than a year old. Nothing implies that it uses any zero-days but is a normal package installer. In other words the user has to deliberately install it. Then there is this:

So the most likely path before Apple revoked their developer certificate was people installing what they thought was pirated software.

It looks like Apple’s built-in protections should easily prevent this Trojan.

Way to go in completely missing the point.

Sure it was a year ago, but at the time it was an unprotected exploit and Apple subsequently fixed it - but not until AFTER it had been successfully exploited.

That’s the point - chances are that exploits are being used today and we’ll read about THEM in a few weeks or months.

 

[Hoo Doo Dude]

Way to go in completely missing the point.

Sure it was a year ago, but at the time it was an unprotected exploit and Apple subsequently fixed it - but not until AFTER it had been successfully exploited.

That’s the point - chances are that exploits are being used today and we’ll read about THEM in a few weeks or months.

Read the content! It was a misleading headline about nothing, more crap from one of the biggest sources of misinformation and sensationalization on the web. Mac OS is extremely well protected and updated better than any 3rd party drivel being pushed as “protection”. But by all means go ahead and get something you don’t need if it makes you feel better. Just please don’t regurgitated false information to those looking for informed professional advice.

 

[Reggaenald]

Good advice, however, how may times have we meant to type something like ww.bestbuy.com, but didn't realize we made a typo of ww.betbuy.com. There is malware that affects Macs so, IMO, better to have protection and not need it than to need it and not have it.

Edit: removed the "w" at the front as unlinking wasn't working and didn't want anyone to click on an uncertain website. One thing I also just thought of, is even posts on forums like this can contain a bait.

Example: if you click on this www.google.com I can get you to go to a different web site that isn't google. Don't worry it just goes to Bing, but you wouldn't know it by looking.

Links in forums can contain bait, like a google. com link that actually goes to Bing. Bing!

WOW!
I certainly opened a can of worms there guys!
Thank you all for your input but I am still as confused as ever.
I think the majority view is that I really don't need any extra protection, so I won't instal any.

Thanks again
John

No. Do get something like Malwarebytes. Like the pill after.

 

[planteater]

Read the content! It was a misleading headline about nothing, more crap from one of the biggest sources of misinformation and sensationalization on the web. Mac OS is extremely well protected and updated better than any 3rd party drivel being pushed as “protection”. But by all means go ahead and get something you don’t need if it makes you feel better. Just please don’t regurgitated false information to those looking for informed professional advice.

If one had the ability and capacity to both read and comprehend the content, one would have reached a concussion other than posted.

The exploit referenced in the article, and corroborated by Patrick Wardle, is of a variety that is dormant and exists (existed) in a stealth manner to deliver a payload when those in control of it desired. It is a variety of malware that is most deadly, waiting for orders.

Perhaps if you reread the article and research Wardle's credentials, you would retract your obviously uninformed comment.

 

[Ethanmenzel]

I tried Malwarebytes, but I felt like I needed more protection from the software as it did little coming from a Windows PC to Mac. I switched over to Bitdefender For the added protection, but reviews say it can slow down your machine, which doesn’t bother me. I mainly use antivirus to stop those pesky ad-filled sites from infecting my Mac which has done great forever since I started using antivirus on my Mac.

 

[Apple_Robert]

I tried Malwarebytes, but I felt like I needed more protection from the software as it did little coming from a Windows PC to Mac. I switched over to Bitdefender For the added protection, but reviews say it can slow down your machine, which doesn’t bother me. I mainly use antivirus to stop those pesky ad-filled sites from infecting my Mac which has done great forever since I started using antivirus on my Mac.

Use an adblocker instead of bloatware like Bitdefender. It will work much better.

You have been conditioned as a previous Windows user, to think you need more than what comes with MacOS, in regards to the topic of the thread; you don't.

 

[Romain_H]

Without a doubt, YES!

Yes, you will have disagreements, but OSX can be affected by malware. When it comes to protecting your system it is better to have protection and not need it, then to need it an not have it.

Problem is: what is advertised as protection rarely if ever is. And it opens holes by itself

 

[Romain_H]

Sure it was a year ago, but at the time it was an unprotected exploit and Apple subsequently fixed it - but not until AFTER it had been successfully exploited.

How could any “protection software“ possibly have protected agains a zero day?

 

[bobcomer]

How could any “protection software“ possibly have protected agains a zero day?

Most look for particular behaviors, like a new program scanning the drive, or creating unusual network traffic, especially to known malware sites. That's how, and it's actually pretty effective. It might not fix the zero day, but it has a good chance of stopping something bad happening that a mac without AV wouldn't.

In simpler terms, they don't look to fix a 0-day exploit, they contain whatever payload that 0-day planted.

 

[JouniS]

Most look for particular behaviors, like a new program scanning the drive, or creating unusual network traffic, especially to known malware sites. That's how, and it's actually pretty effective. It might not fix the zero day, but it has a good chance of stopping something bad happening that a mac without AV wouldn't.

Is there any evidence that they are effective?

I haven't been interested in information security in professional capacity in 15+ years, so my understanding may be outdated. My impression was that end-user security software pretty much lost its reason to exist when OS vendors started taking security seriously and automatic software updates became the norm. You would only want to use them to comply with policy requirements. Or if you assume that the people who made the security software are more competent than the ones who made the OS.

The big issue with end-user security software is that it runs on the same computer it's supposed to protect. If the computer is compromised, you can no longer trust any software running on it. Malware authors know how popular security software works, and the malware may be designed to bypass them. Maybe it scans the drive or contacts a shady server, but your malware scanner never becomes aware of that.

 

[MarkC426]

Time to invest in a Tin Hat........?

 

[UBS28]

It is a nicer experience without protection, but you may run the risk of catching viruses. Always do it safe.

 

[bobcomer]

Is there any evidence that they are effective?

I haven't been interested in information security in professional capacity in 15+ years, so my understanding may be outdated. My impression was that end-user security software pretty much lost its reason to exist when OS vendors started taking security seriously and automatic software updates became the norm. You would only want to use them to comply with policy requirements. Or if you assume that the people who made the security software are more competent than the ones who made the OS.

The big issue with end-user security software is that it runs on the same computer it's supposed to protect. If the computer is compromised, you can no longer trust any software running on it. Malware authors know how popular security software works, and the malware may be designed to bypass them. Maybe it scans the drive or contacts a shady server, but your malware scanner never becomes aware of that.

I can't provide any but anecdotal evidence. I've seen it be effective. So many users don't do the right things to stay safe, and as A/V got more advanced (And it's become quite good at it in the last 10 years), I haven't seen any exploited PC in quite some time. (I'm an IT Manager.)

We use a third party AV because of its reporting capabilities, and Microsoft does have something that does that, it's for more PC's than we have and is prohibitively costly. But I have no problem using Microsoft Defender on my own machines.

As for Apple's built in AV, I really haven't seen any evidence of it at all, so I can't really trust it, so I run a third party app on my Macs. (Malwarebytes). The OS updates of course fix exploits, but I've never seen anything from the OS that would tell me it's looking for active viruses. The reason I'm uneasy with Apple AV is I have some test tools that most AVs flag as potential exploits, but not a peep from MacOS. They of course are not real exploits, but like I said in my last message, current AV looks for behavior patterns (even in code that hasn't been executed).

>The big issue with end-user security software is that it runs on the same computer it's supposed to protect.

True, but by that same token, if AV stops reporting problems, either on the local PC or some master console PC, it's a good sign there's a problem. Kind of a canary in a coal mine type thing. If it dies, there's a problem.

 

[ian87w]

I think a no non-sense security app is probably good for the lay people. Problem is, all these security software companies are so eager into feeding FUD to people and taking up system resources for their own marketing purposes that I have lost faith in any of them. It's sickening seeing their marketing strategy. I don't even use any 3rd party anti-virus software on Windows the minute MS made Windows Defender available.

Best way is to be vigilant yourself.
Basic things to do (on any OS):
- Always create a standard user for your day-to-day use. Do not use your admin account.
- Turn on the firewall (I don't think macOS has it on by default, which I found weird).
- Install an ad-blocker (or use a browser with built-in ad-blocker like Brave). This will cut down your risk of accidentally clicking something nefarious a lot.
- Never download anything from suspicious website/sources. Always download a software from the actual company that made them. Eg if you need Adobe Acrobat reader, download it from Adobe's website, not from somewhere else.
- Pay attention to emails. Phishing scams are so common these days. Be vigilant on where those emails are from.
- Don't use pirated software. There are always free open-source alternatives for most things.

I am lucky enough that I developed this sense during my learnings about computing (from the days of eDonkey/Morpheus where everything is dodgy... ). But I see that it's not easy, and I have seen even the smartest person got tricked into installing malware. This is also why imo the post-PC devices are actually a good thing for the lay users (eg. Chromebooks, iPads/Android tablets). There are simply less vectors to worry about.

 

[Apple_Robert]

It is a nicer experience without protection, but you may run the risk of catching viruses. Always do it safe.

There are no Mac viruses in the wild. A Mac user may come across Malware written for a Windows machine, if one blindly opens files shared between users on both sides of the tech aisle or downloading files from sketchy websites hosting illegally available software etc. Malware is not the same thing as a Virus in the context of this thread. Software companies may use the two interchangeably and they do that to scare people into paying for their software.

 

[bobcomer]

There are no Mac viruses in the wild. A Mac user may come across Malware written for a Windows machine, if one blindly opens files shared between users on both sides of the tech aisle or downloading files from sketchy websites hosting illegally available software etc. Malware is not the same thing as a Virus in the context of this thread. Software companies may use the two interchangeably and they do that to scare people into paying for their software.

List of Mac malware, viruses and security flaws known today

macOS has long been heralded as the most secure operating system on the market. But it’s not bulletproof. Here are some Mac threats to avoid.

macpaw.com

 

[Chevysales]

As others have stated, macOS already has built-in protections that are adequate for the average user. Even if you want to install macOS updates on your own time, make sure that you at least have "Check for updates" and "Install system data files and security updates" enabled inside Software Update's "Advanced" menu. The first will alert you of any updates that Apple has released, the second option will automatically install the latest versions of XProtect and MRT, which are roughly the closest equivalent to the Mac having included anti-virus. XProtect blocks known malware when installing or running programs for the first time, MRT is Apple's automatic malware removal tool which operates without requiring user interaction.

Other than that, you can use "FileVault" to encrypt your system drive, enable "Find My" through iCloud to locate/lock your Mac if it is stolen, use a password manager such as the one already built into Safari, enable the Firewall inside system preferences, use a DNS Profile such as Quad9 over HTTPS to block some suspect sites at the DNS level and to enhance privacy, use a quality ad blocker such as AdGuard for Safari, and simply go through System Preferences, such as "Security and Privacy" to make sure you have the proper options enabled. Also, make sure to regularly check for updates to any third-party applications that you may use, since they can have security patches, as well. Ostensibly, programs downloaded through the Mac App Store should be more secure, since Apple has oversight over those files, but still be careful about what you download.

One tool that I can suggest is from Dr. Howard Oakley who runs the Eclectic Light website and has written numerous articles, released useful utilities for Mac users, and has been doing so for many years. In order to make sure that you have important security settings enabled, as well as the latest versions of Mac files and patches installed, I would suggest installing his free SilentKnight utility, which will give you an easy rundown of what protections are currently active and what you may want to enable to further protect your system. For instance, some advanced users will disable SIP (System Integrity Protection), and this can remind them to enable it. Also, unless you specifically need these settings lowered, make sure that Security Policy is set to "Full Security".

So, keep macOS and your other software regularly updated, use caution when downloading and installing unknown programs, avoid dodgy websites, and make sure your Mac's built-in protections are enabled. That should be sufficient to keep your Mac safe and secure.

got that eclectic light link from another post of yours way back... THANKS! Great stuff there.

 

[Chevysales]

WOW!
I certainly opened a can of worms there guys!
Thank you all for your input but I am still as confused as ever.
I think the majority view is that I really don't need any extra protection, so I won't instal any.

Thanks again
John

And your system will thank you for that in the long run by generally being more snappy and responsive... as long as its paired with smart safe computing .
Good Choice!

 

[Apple_Robert]

List of Mac malware, viruses and security flaws known today

macOS has long been heralded as the most secure operating system on the market. But it’s not bulletproof. Here are some Mac threats to avoid.

macpaw.com

The person that wrote that article is doing nothing more than writing an advertisement for MacPaw software and using Virus and Malware as the same thing and they aren't. My statement stands. There are no Mac viruses in the wild.