Is a necessary additional security, such as McAfee software on the new iMac and iPad?

Mac users often ask if they should install "anti-virus" (AV) or software "anti-malware". The answer is 'no', but it can give the false impression that there is no threat of what is loosely called 'virus '. There is a threat.

1. it is a comment on what you should - and should not-do to protect you from malicious software ("malware") that runs on the Internet and gets onto a computer as an unintended consequence of the user's actions.

It does not apply to the software, such as keyloggers, which can be installed deliberately by an intruder who has convenient access to the computer, or who has been able to take control of it remotely. This threat is in a different category, and there is no easy way to defend against it. AV software is not intended to and does not, to defend against these attacks.

The comment is long because the issue is complex. The essential points are in articles 5 and 11.

OS X implements now three levels of integrated protection specifically against malware, not to mention the protections of runtime such as quarantine the file, execute disable, sandbox, protecting the integrity of system, System Library randomization and randomized address space layout , which can also prevent other kinds of exploits.

2. all versions of Mac OS X 10.6.7 were able to detect the malware Mac known in downloaded files and block non-secure web plugins. This feature is transparent to the user. Apple calls internally it "XProtect."

The malware used by XProtect recognition database is automatically updated. However, you should not count on it, because the attackers are still at least a day before the defenders.

The following restrictions apply to XProtect:

☞ circumvented by some third-party network software, such as the BitTorrent clients and Java applets.

☞ It applies only to software downloaded on the network. Software installed from a CD or other media is not verified.

As new versions of Mac OS X are available, it is not clear whether Apple will continue indefinitely maintain the older versions such as 10.6 XProtect database. Versions of obsolete systems security may eventually be affected. Updates to security for the code of obsolete systems will be stop being released at any given time, and which can leave them open to other types of attack in addition to malware.

3. starting with the OS X 10.7.5, there was a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and installation packages downloaded from the network will be run only if they are digitally signed by a developer to a certificate issued by Apple. Certified software in this way has not been checked for safety by Apple, unless it comes to the App Store, but you can be reasonably sure that it has not been changed by someone other than the developer. His identity is known to Apple, so it could be held legally responsible if it distributes malicious software. Which may not mean much if the developer lives in a country with a weak legal system (see below).

Access controller does not depend on a database of known malware. He has, however, the same limitations as XProtect and in addition the following:

☞ It can easily be turned off or overridden by the user.

☞ A malware attacker could find a way around it, or could take control of a certificate of signing of code under false pretenses or could simply ignore the consequences of the distribution of malware Tryggvason.

☞ Developer App store could find a way around the Apple control, or the control may fail due to human error.

Apple took too long to revoke some known attackers codesigning certificates, thus diluting the value of the keeper and the program developer ID. These variances do not involve the App Store products, however.

For the reasons given, App Store, and, to a lesser extent - other applications recognized by signed Gatekeeper, are safer than others, but they cannot be considered to be absolutely sure. "Sand" applications could make to access to private data, such as your contacts, or for access to the network. Think that before granting access. Security sandbox is based on user input. Never click through any application for leave without thinking.

4. by starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background. He checks and removes, malware that corresponds to a database of recognition held by Apple. To ensure that MRT will be executed when the database is updated, the App Store tab in system preferences and check the box marked

Install the system data files and security updates

If it is not already done.

As XProtect, MRT is effective against known threats, but not against strangers. It alerts you if it detects malware, but otherwise, it has no user interface.

5. the built-in Mac OS x security features reduce the risk of malware attack, but they are not and will never be complete protection. Malware is a problem of human behavior, not a behavior machine, and none only of technological solution will solve. Software protect you from trust only will make you more vulnerable.

The best defense is always going to be your own intelligence. Except perhaps feats of Java, all the known malware, circulating on the Internet wearing reached a completely setting installation to update to OS X 10.6 or later takes the form of so-called "Trojans", which may have no effect if the victim is deceived in their execution. The threat thus amounts to a battle of wits between you and cybercriminals. If you are better informed, they think you are, you win. In effect, it means that you always stay in the shelter of practical computing. How do you know when you leave the safe harbor? Here are a few signs warning of danger.

Software from a reliable source

☞ Software with a brand, such as Adobe Flash Player, does not come directly from the Web site. Don't be fooled an alert of any website for updating Flash, or your browser, or other software. A real alert that Flash is outdated and blocked is shown on this support page. In this case, follow the instructions on the support page. Furthermore, assume that the alert is false and that someone is trying to rip you off to install malicious software. If you see these alerts on more than one Web site, ask for instructions.

☞ Software any is distributed via BitTorrent or Usenet, or on a Web site that distributes pirated music and movies.

☞ Rogue sites Web such as CNET Download MacUpdate, Soft32, Softonic and SourceForge distribute free applications that have been packaged in a superfluous "install".

☞ The software is advertised through spam or intrusive web ads. Any announcement, on any site, which includes a direct link to a download should be ignored.

Software that is clearly illegal or doing something illegal

Commercial software ☞ high-end such as Photoshop is "cracked" or "free."

☞ An application helps you violates copyright law, for example to circumvent the copy protection on a commercial software, or streamed media recording to be reused without permission. All the 'YouTube downloaders' are in this category, but not all are necessarily malicious.

Conditional or unsolicited offer from strangers

☞ A phone calling or a web page you indicates that you have a "virus" and offers to remove. (Some reputable sites warned visitors who have been infected with the malware "DNSChanger" legitimately. The exception to this rule applies.)

☞ A web site offers a free content like music or video, but for use, you must install a "codec", 'plug-in', 'player' 'Downloader', 'extractor', or 'certificate' which comes from the same site, or a stranger.

☞ You win a prize in a competition that you are never entered.

☞ someone on a forum like this is eager to help you, but only if you download an application of your choice.

☞ a 'FREE WI - FI!' network presents itself in a public place like an airport, but is not provided by management.

☞ Online everything that you expect to pay is 'free '.

Unexpected events

☞ a file is downloaded automatically when you visit a web page, without any further action on your part. delete any file without opening it.

☞ You open what you think, it is a document and you receive an alert that it is "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you must always remove any download that is not what you expected it to be.

☞ An application does something you don't expect, such as permission to access your contacts, your location or the Internet without obvious reason.

☞ Software is attached to the email you na not ask, even if it is (or seems to come) by a person of trust.

I do not leave the safe harbour that once will necessarily lead to disasters, but make a habit of it will weaken your defenses against malicious software attacks. None of the above scenarios must, at the very least, make you uncomfortable.

6. Java on the Web (not to be confused with JavaScript, to which it is not related, despite the similarity of names) is a weak point in the security of any system. Java is, among other things, a platform to run complex applications in a web page. That was always a bad idea, and Java developers have proved unable to apply it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been a type virus Windows affecting OS X. simply load a page with Java malicious content could be harmful.

Fortunately, client-side Java on the Web is outdated and largely disappeared. Only a few outdated sites still use it. Try to accelerate the process of extinction by avoiding these sites, if you have a choice. Forget to play games or other uses not Java essentials.

Java is not included in OS X 10.7 and later versions. Discrete Java installers are distributed by Apple and Oracle (the developer of Java). Do not use one unless you need it. Most of the people don't. If Java is installed, turn it off- not the JavaScript in your browser.

Whatever the version, experience has shown that Java on the Web is not reliable. If you must use a Java applet for a job on a specific site, Enable Java only for the site in Safari. Never activate Java for a public Web site that carries the third-party advertising. Use only on websites that are well known, protected by login and secure without ads. In Safari 6 or later, you will see a padlock icon in the address bar when you visit a secure site.

7. another perennial weak point is Adobe Flash Player. Like Java, Flash is declining well deserved, but content Flash is still much more widespread than the contents of Java on the Web. If you choose to install the Flash plugin, you can reduce your exposure to Flash by checking the box marked

Stop the plug-ins to save energy

in the Advanced tab of the preferences of Safari window, if not already done. Consider also installing an extension Safari as "ClickToFlash" or "ClickToPlugin." They will prevent the Flash content automatically load and are initially not Flash video is substituted for Flash on YouTube and perhaps a few other sites. I tested the extensions and found them safe, but you should always do your own research before you decide whether to trust any third party software.

8. remain within the sphere of security, and you will be as safe from malware you can be practically. The rest of this comment is what you must do to protect you.

Never install any AV or products 'Internet security' for Mac if you have a choice, because they are all worse than useless. If you are required by a (wrong) institutional policy to install some kind of AV, choose one of the free apps in the Mac App Store, nothing else.

Why you should not use products AV?

☞ To recognize malware, software depends on a database of known threats, which is always at least one day to day. This technique is a proven failure, as a major supplier of AV software has admitted. Most of the attacks are "zero-day" - that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry comes to realize that the traditional AV software is worthless.

☞ design is based generally on the nonexistent threat that malware can be injected at any time, anywhere in the file system. Malware is downloaded from the network; He is not of the blue leaves. To meet this threat does not exist, a commercial AV software changes or low level functions of the operating system, which is a waste of resources and a frequent cause of instability, bugs, poor performance, and duplicates.

☞ changing the operating system, the software can also create weaknessesthat could be exploited by malicious attackers.

☞ especially, a false sense of security is dangerous. This fact relates to all AV software it will never be any changes elsewhere.

9. a free AV product from the Mac App Store is safe as long as you don't let it delete or move files. Ignore all the warnings that it can give you on "heuristic" or "phishing." These warnings, if they are not simply false positives, see the text of e-mail messages or updates cached web pages, not malware.

An AV application is not necessary and may not be invoked for protection against malware for OS X. It is useful, or even not at all, only to detect malware Windows and even for this use it is not really effective, because the new Windows malware makes its appearance much faster than OS X malware.

Windows malware cannot hurt you directly (unless, of course, you use Windows). Just do not pass to someone else. A malicious link in the e-mail is usually easy to recognize by the name alone. A concrete example:

     London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe

You don't need software to tell you it's a horse Trojan for Windows. Software may be able to tell what trojan is, but who cares? In practice, there is no reason to use a recognition software, unless an organizational strategy requires. Malware Windows is so widespread that you must assume that it is in each attachment until proof to the contrary. Nevertheless, a free AV product on the App Store can serve a purpose if it fulfills a misinformed network administrator that says you must have some sort of application AV. An App Store product will not change the operating system; in fact, it does nothing, unless you run it.

If you are just curious to know if a file is considered malware by the AV engines, you can download it from the "VirusTotal" site, where it will be tested against most of them without charge. A negative result is evidence of what whether, for the reasons given above. I do not recommend doing this with a file that may contain private information.

10. There seems to be a common belief that the firewall Application acts as a barrier to infection, or prevents operation of malware. He does not. It blocks incoming connections to some network services you are using, such as file sharing. It is disabled by default, and you should leave it like that if you're behind a router on a private home or office network. Activate only when you are on an untrusted network, for example a public Wi - Fi hotspot, where you do not want to provide services. Disable services that you don't use in the sharing preferences window. All are disabled by default.

11. as a Mac user, you don't have to live in fear that your computer may be infected whenever you install the software, read emails, or visit a web page. But nor can you assume that you will always be free from exploitation, no matter what you do. Internet browsing, it's like walking the streets of a big city. It can be as safe or as dangerous that you choose to do so. The greatest harm done by software AV is precisely its selling point: it makes people feel safe. They can then feel sufficiently safe to take risks, which the software does not protect them. Nothing can reduce the need for safe computing practices.

more

Tags: Mac