Microsoft Defender Comes to the Mac
techcrunch.com
techcrunch.com
Just wait...
Being signature based instead of behavior based limits it's ability to detect evolving attacks.
The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-ga...
This approach works for people who k ow not to click strange links, but as long as people give their life savings away to scammers pretending to be the IRS or Microsoft, people will just open random software from the Internet as long as someone is telling them how to open the relevant executables. Linux is much the same way (are there even antivirus products for Linux other than ClamAV?) despite half the Internet running on mostly-unprotected Linux servers.
However, due to the lack of signatures available on macOS viruses, I do wonder how effective MS Defender will be. There's various interpreters and shells available by default which make it easy to write an obfuscated virus script for OSX (python, Ruby, bash, and so on) which is not as relevant ik the Windows world.
To the people who complain about "bloatware" being forced onto their machine: you're just as likely to get infected by a virus as the other techie people in your company running Windows or Linux. How can you blame your boss for wanting to prevent getting hacked? Apple's own AV is just not up to the task.
AV won't fix users wanting to launch pirated games or software from sketchy sources for example. However, it can fix malware placed on a system after an exploit.
I have more faith into Microsoft and their Defender suite than any commercial AV vendor or Apple itself. Right now, people are using Sophos or McAfee or Bitdefender on corporate Apple devices; none of those have a good reputation with me. I'd strongly prefer Microsoft's AV solution over any existing macOS security suite.
As for performance, any AV will cause some performance drops if you enable live scanning or during periodic scans. Having a macbook scan overnight does not cause an issue, having live scanning running during compilation will slaughter performance. The performance impact is up to how the AV is configured.
However at the time almost all of the malware definitions are from other anti-virus companies and Microsoft happens to ship them via Windows Update. But this could have been changed by now.
If Microsoft is serious about the 'user-centric' approach, which it seems more and more the case as opposed to just a cheap PR stunt, it might me a good move to opensource the whole Defender base and include some Linux users while their at it.
Does anti-virus matter anymore?
I haven't installed one for years, on Windows, Mac or Linx (decades?), it's unclear if that is a mistake or not.
If you're a single user, effective offline backups are probably a better investment. It's not that bad starting from scratch if you have all your data. It takes me about an hour to throw a usable build onto my laptop.
However corporate networks where the damage has a big multiplier may benefit from it and you certainly don't want to be asked all sorts of questions about whether or not you had a risk mitigation in place if something does happen.
Also with stuff like Steam and only downloading major games I should be fine. Most of my owned games atm are pretty old.
The moral of the story is that an after-market security solution not designed by the core architects is very likely to be buggy. They don't understand things. They make bad assumptions.
Windows Defender was designed by people who know windows. It works well on Windows because it respects the core architecture. If this defender is written in native OSX code, and obeys all the documented and un-documented OSX things, and if Apple staff commit to forwarding bug reports to Microsoft, it might work, one day, five or more years in the future.
Until then, I suspect like Sophos, its going to crash my Mac.
I feel like one of those curmudgeon memes with a "prove me wrong" sign on my desk at school.
However, if you look at the performance on Windows, Windows Defender is one of the best scanners out there. While some sort of added bottleneck is inevitable (especially during workloads like compiling software or downloading thousands of small files (NPM/Composer/etc)), I wouldn't be surprised if regular users wouldn't notice such an extensive slowdown in their daily work.
Perhaps to some extent the Windows and Mac version share a portion of their code, but at kernel level the Windows Defender system is simply incompatible with macOS. A redesign of the performance-limiting features is a necessity in this case, so I strongly doubt the "people who know Windows" were the ones that designed the kernel interface layer.
Basically, expect small freezes during compilation, but not crashes.
I expect small freezes. I expect pretty big ones too. Your optimism is exactly what my ICT guy said about Sophos.
"Don't just type in your password" is something everyone using windows or Mac or Linux should be taught.
Don't think I'd bother with this, but interested to see it play out. Maybe it'll have positive detection effects that feed back into XProtect
Example - Mozilla is going to remove support for TLS 1.0 and 1.1 [1]. A good change, we can all agree. But what if half their user base was relying on this feature? Can they still remove it? Should they commission a user survey asking everyday users about TLS? Fortunately, they have telemetry that tells them that only 1.2% of all connections are made with these versions of TLS. Cool, this change can go ahead.
If you were in charge at Mozilla and you don't want to collect opt-out telemetry, please tell me how you would have made the TLS decision.
Literally what are you scared of that telemetry will send? If you're so concerned about it, why don't you just opt out?
[1] - https://blog.mozilla.org/security/2018/10/15/removing-old-ve...
This is dangerously close to a “nothing to hide” argument. The issue with telemetry is that it’s difficult to do it right, and often it ends up just siphoning data that ends up being abused or mishandled. Having this be opt-in raises questions of consent.
If you think there is something that it might upload that you might not like, please let us know. Here's the extension - https://github.com/Microsoft/vscode-extension-telemetry. You can check for usages here - https://github.com/Microsoft/vscode
There is plenty of personal information that I never want shared with anyone, like my location history, who I speak to and so on. But what shortcuts I use, what features I use in an application, after it's been anonymized? I have "nothing to hide" there.
[1] - https://news.ycombinator.com/item?id=19427773
[2] - https://news.ycombinator.com/item?id=19109815 (this one is great, because it's a task raised on dotnet cli, but posted on the thread about VS Code release notes)
Also, if you're so worried about being de-anonymized, then opt-out?
They disclose vulnerabilities to US government agencies first and stil to this day have no transparency about what information they share with governments.
Wow do you actually believe that? Have we forgotten about NSA KEY already?
Perhaps you’re assuming too much. I’d class this forum more as a “tech enthusiast and startup” forum. A lot of software developers, a lot of hardware developers, and a lot of conscious users of both.
I do agree with what you’re saying though. When I was doing open source things, I sometimes joked about how much easier it would be with some telemetry.
One time, me and someone else spent a day of testing and not doing anything, while in the back of my mind I just wished I could look at a database to see the results from users. Then we all could’ve just made things better.
Software engineers, not cops and marketing specialists.
Seriously, I know that might sometimes make our work harder, but the answer to many of those questions is "we don't, it's none of our business." Except for crashes, making them opt-in is trivial.
If anything telemetry gives developers an excuse to use users as QA.
if it's a crash on the client, you should apologise to the user and ask if it's ok to send the crash dump to the supplier and give them an option to review the content and add additional information if they see fit.
CHOICE is not a forbidden word in 2019.
In the age of Web apps how is that any different?
Wasn't the problem with Microsoft telemetry that it is not so much opt-out as many users would wish?
Microsoft: Umm- looks like nobody used jumplists in start menu. Lets remove in windows 8+
Everybody: Windows is getting worse for power users.
I myself use Arch as my default OS with dmenu and rofi to help me.
Do you have a source for that?
What data are they collecting maliciously? For example, what program(s) with telemetry are using it to exfiltrate my financial information or passwords?
No thanks. That's disrespectful towards the customer and quite illogical. Why?
1. We deal with a lot of personal information and we do not want risk vectors associated with telemetry under GDPR. If you don't have full control over your data then you put your customer data at risk. This is indicated by Microsoft already getting into trouble over Office telemetry leaking customer data.
2. Opt-out is not a logical option because of the fragility of positive configuration. All things should fail safe. Microsoft already broke the opt out for dotnet core on Debian once.
3. It creates a hell of a lot of network traffic to tens of different hosts which makes it difficult to quantify what is telemetry and what isn't.
4. It costs us money to admin. Literally a pile of cash goes into compliance every year and this makes it harder and more expensive trying to plug all the holes in a giant swiss cheese. We'd rather have a cheddar and just make the holes we need in it.
5. If you're not an enterprise customer you can't opt out. This is just WRONG.
With respect to Mozilla and ending support for TLS v1.0 and 1.1, you do what we are doing with TLS deprecation which is communicate with your users, something Microsoft seem to have forgotten about in their drive to marginalise user opinion and move to a subscription model.
The problem is software management has got lazy and stupid and figures that every problem can be solved if you collect enough data about your clients and that total isn't true. What you end up with is a lot of data and a poor signal to noise ratio.
Edit: downvoters - explain yourselves! I explained my perspective!
I mean, I can't think of a different interpretation of this line…