Mac malware, it's now a reality

[Johnny]

Originally Posted By: Mystic
It may seem bad to say this, but let the people who do not even know how to turn the firewall on get attacked first.


That's twice you've said this. Do you know how to turn it on? If so, tell us.

Originally Posted By: 97prizm

I hope mac users do end up with a ton of viruses on their computers. Most users are snooty, inept computer users that claim that they purchased a mac because the "Don't get viruses like PC's) All mac books are overpriced pc's that run BSD Linux underneath and then add a proprietary gui and then triple the price.


Sorry, but I am not snooty.

 

[Mystic]

Sure, no problem. To turn on the firewall on a Mac OS X computer, click on system preferences in the dock. And then click on sharing. When the sharing pane comes up click on firewall. And then click start. You can then click the lock icon to make sure the firewall stays on. To allow for certain types of internet communications you use the Allow check boxes to fine-tune the firewall. You can also get to System Preferences by clicking on the Apple icon at the top-left hand side.

Unless Apple has changed things recently the firewall in Mac OS X is NOT on by default. You have to turn it on unless that has changed recently in the most recent Max OS X systems. I don't have experience with Mac OS 10.6 or the upcoming 10.7.

It seems to me the firewall should be on by default. I can't explain why it is not. But a good thing about Macs is that services have to be turned on. And then you should turn them off if you no longer need a service.

From time to time I toy with the idea of replacing my old iMac with a Mac Mini to use just for the internet. I would not put any programs on it except for Intego's VirusBarrier and maybe Internet Cleanup and I would use a standard account and good passwords. And of course I would turn the firewall on. I could just easily reinstall the operating system if I was attacked by malware. There is so much malware for Windows computers this might be worth it.

Or if by some miracle Apple actually started to build an affordable desktop computer again I might go back to using Macs. Photoshop will work on Macs of course, but I would have to check and be sure my scanner and printer would work. And iWork is a decent office program and Pages is a decent word processor. At this time it does not seem that there will be a lot of malware for Macs, but you can never tell for sure. But unlike a lot of Apple users I know how to secure a Mac. But every time I have this dream I have to remember a MacPro costs $3000.00-no monitor, cheapest model.

 

[Mystic]

This is for turning on the firewall in 10.4 Tiger. Actually you now go to System Preferences and Security for turning the firewall off and on in 10.6. I forgot that they changed it to security. I was used to 10.4 Tiger.

I used Tiger so long I just put down from memory how to turn the firewall on in Tiger. But they changed it beginning with 10.5. I turned my old iMac on to make sure and I remembered they changed it to security. I hate to turn the old iMac on because ti does not run so good anymore.

I am sure I will be personally attacked now. But they did change it from 10.4 Tiger (sharing) to 10.5 and 10.6 (security).

One good thing about Macs is that everything is very easy to understand. After you go to system preferences and security, and turn the firewall on, you can easily figure out from there if you want for an application to be allowed to connect to the internet, or allow some sort of service or not, etc.

 

[Iain]

Do people still trust software firewalls what with hardware firewalls rapidly becoming old-fashion?

UTM use is growing quickly because the threat is not teenage hackers any longer.

 

[OVERKILL]

Originally Posted By: Iain
Do people still trust software firewalls what with hardware firewalls rapidly becoming old-fashion?

UTM use is growing quickly because the threat is not teenage hackers any longer.


Anybody with a 40 dollar Linksys/D-Link/Netgear router has a hardware firewall.

 

[greenaccord02]

Hardware firewalls are not old fashioned by any stretch.

 

[Iain]

Originally Posted By: OVERK1LL
Originally Posted By: Iain
Do people still trust software firewalls what with hardware firewalls rapidly becoming old-fashion?

UTM use is growing quickly because the threat is not teenage hackers any longer.


Anybody with a 40 dollar Linksys/D-Link/Netgear router has a hardware firewall.


Quite right, that.

However, my point was that the only real innovation in network security over the past couple of years seems to be in UTM segment, whilst the hardware firewall segment seems stagnant.

Seems as though malware authors are winning the security war because of it.

 

[Mystic]

It is safer to have both a hardware and a software firewall. But I have heard that there are ways to defeat some hardware firewalls.

When I was using Macs I liked to use a better software firewall than what Apple provided. I would use NetBarrier, which is made by the same company that makes VirusBarrier (Intego). During the time that I ran Mac OS X (a period of several years) I was attacked twice and my NetBarrier firewall stopped the attacks. After one of those attacks I asked the guy who owns Syracuse.net (an ISP that specialized in providing ISP service for Macs) to investigate. The attack had come from a website that had not be in use for a while. It was a definite attack according to the Syracuse.net guy.

One other time some sort of weird software tried to load on my computer without permission but was unable to run. I think it was some sort of Windows malware but it was not able to run on the Apple platform.

The only other times that I know of that I ran into malware for the Mac was when I was using Classic Mac O/Ss and not Mac OS X.

I think a person is safer on the internet using a Mac for right now. It is impossible to say if this will change or not. Certainly malware can be written for the Mac but that depends on the malware writers and ultimately on if they can make a lot of money or not.

 

[OVERKILL]

Originally Posted By: Mystic
It is safer to have both a hardware and a software firewall. But I have heard that there are ways to defeat some hardware firewalls.

When I was using Macs I liked to use a better software firewall than what Apple provided. I would use NetBarrier, which is made by the same company that makes VirusBarrier (Intego). During the time that I ran Mac OS X (a period of several years) I was attacked twice and my NetBarrier firewall stopped the attacks. After one of those attacks I asked the guy who owns Syracuse.net (an ISP that specialized in providing ISP service for Macs) to investigate. The attack had come from a website that had not be in use for a while. It was a definite attack according to the Syracuse.net guy.

One other time some sort of weird software tried to load on my computer without permission but was unable to run. I think it was some sort of Windows malware but it was not able to run on the Apple platform.

The only other times that I know of that I ran into malware for the Mac was when I was using Classic Mac O/Ss and not Mac OS X.

I think a person is safer on the internet using a Mac for right now. It is impossible to say if this will change or not. Certainly malware can be written for the Mac but that depends on the malware writers and ultimately on if they can make a lot of money or not.


Could you elaborate on the "defeat" of a hardware firewall?

There are ways to circumvent them (or at least parts of their function), particularly the consumer-grade routers. Things like "Universal Plug'n'Play" when enabled, can be exploited. Somebody not changing the default password.... Can be exploited.

But really, it is quite difficult to get around the security of even something as basic as what NAT provides. And I mean from an OUTSIDE host. Normally, something is required to initiate a connection from the inside, on the host, which then, is already compromised.

Devices like Cisco's ASA's, Juniper SSG's....etc are far more robust in the filtering/screening department. And provide a level of granular control you won't find in a typical consumer device. However, they are expensive.

 

[Mystic]

I can't remember the exact details of all of that. It was awhile back. But somehow some people figured out how to bypass the security of some routers.

 

[greenaccord02]

"Defeat" seems to crop up a lot in security related posts these days for some reason... It's repetition has started to grow old.

Vanquished would sound cooler. Maybe decimated or annihilated. Perhaps routed?

 

[Iain]

Originally Posted By: OVERK1LL

.........

Devices like Cisco's ASA's, Juniper SSG's....etc are far more robust in the filtering/screening department. And provide a level of granular control you won't find in a typical consumer device. However, they are expensive.


Even Cisco's RV and RVS line of SOHO devices offer a level of security you won't find in a typical Linksys device for not a lot more in price.

Of course there are the Fortinet Fortigate, Netgear Prosecure, Watchguard XTM and ZyXEL USG appliances as well.

Like they say, you get what you pay for.

 

[OVERKILL]

Originally Posted By: Iain
Originally Posted By: OVERK1LL

.........

Devices like Cisco's ASA's, Juniper SSG's....etc are far more robust in the filtering/screening department. And provide a level of granular control you won't find in a typical consumer device. However, they are expensive.


Even Cisco's RV and RVS line of SOHO devices offer a level of security you won't find in a typical Linksys device for not a lot more in price.

Of course there are the Fortinet Fortigate, Netgear Prosecure, Watchguard XTM and ZyXEL USG appliances as well.

Like they say, you get what you pay for.


I've actually been quite impressed with Cisco's SA5xx security appliances. They aren't insanely expensive, and are VERY easy to setup. No knowledge of IOS necessary, since they run Linux.

Currently becoming quite the fan of Juniper's ScreenOS. I replaced my ASA5505 with an SSG 5 to toy around with.

And yes, your point rings true: You get what you pay for.

 

[simple_gifts]

We use the term "host based" firewall rather than "software firewall"; that doesn't really indicate quality, however. I was directed attached to the internet for years using "only" a host based FW (iptables) and never had an issue.

Most people never upgrade their appliance firewalls. (I haven't); but my Ubuntu machine gets regular kernel updates.