[Rumour] Snow Leopard Has Hidden Antivirus Talents


Recommended Posts

500x_snowav.jpg

Well, this is int-er-est-ing: Early testers have come across what looks like a new antivirus function within Snow Leopard. Or to put it another way, Macs don't need antivirus! Wait.

The new feature behaves like a cross between a traditional antivirus tool and the "Are you sure you want to open this?" warnings already present in Leopard. I doubt it's doing any real-time heuristic scanning and it's definitely not running as a visible app in the OS, but if it's checking .PKG and .DMG files for malware before you run or mount them, well, that sounds an awful lot like what your average Symantec, AVG or Kapersky product is intended to do.

The first report came from the Intego blog, (they make Mac antivirus software) and it's been corroborated by Snow Leopard testers over at the MacRumors forums. We'll try to test this one out as best we can, but it's looking like Apple may have slipped this ever-so-slightly unflattering feature into their new OS under the radar.

souricon.gif News source: Gizmodo

Does anyone else find this ironic (if true), considering what Apple's marketing department focused on in the latest 'Get a Mac' ads?

Disclaimer: This post was written on a Mac, running OS X 10.5.

Hardly ironic. They're keeping true to their word by preventing any possible malware from reaching your computer in the first place. It's essentially a re-worded confirmation box for when you run a new program, but made more focused on preventing malware to stop people mindlessly clicking 'run' when the box pops up.

Maybe like UAC, or if not once again Apple allowed to bundle what it pleases in to its OS.

But basic Unix password prompts are already very similar to UAC.

As stated, this isn't really anything new at all, just your typical password prompt, but reworded to call attention to any potential malware you might be installing on your system.

Very good move. This is a message warns the user of what they are installing. There are too many people that will give permissions to just anything these days.

Edit: Pretty much summed up by Quillz. You'd still need an account with SU privileges and would still need to type your password for something like this to work.

Well, this is int-er-est-ing: Early testers have come across what looks like a new antivirus function within Snow Leopard. Or to put it another way, Macs don't need antivirus! Wait.

Does anyone else find this ironic (if true), considering what Apple's marketing department focused on in the latest 'Get a Mac' ads?

Disclaimer: This post was written on a Mac, running OS X 10.5.

I am running 10A432 and I see nothing resembling AV software at all.

By the way, this build is full of WIN.

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist

Contains just the two most active trojans, the DNS changer one and the one bundled with the pirated iWork.

Nice find. I don't use OSX but it's still interesting to know.

Ah so Apple can bundle antivirus software with their OS but Microsoft can't (in Europe)

Because Apple, for whatever reason, isn't considered to have a monopoly.

Also, this isn't really anti-virus software at all. It's just a reworded standard password prompt that simply uses a blacklist, similar to a phishing filter in a web browser.

I notice a lot of people are saying "It's just reworded" or "It's UAC".... Am I the only one that noticed the dialog says "It contains the OSX.RSPlug.A malware"?

It is specically saying "It contains", not "It may contain", not "There is a chance this may contain", but simply stating that it does, indeed, contain malware. If Apple just said that every thing you download specifically contains malware, that would cause all sorts of problems and backlash. It has to either be scanning or using some kind of filter/blacklist/analyzer to detect malware.

I notice a lot of people are saying "It's just reworded" or "It's UAC".... Am I the only one that noticed the dialog says "It contains the OSX.RSPlug.A malware"?

It is specically saying "It contains", not "It may contain", not "There is a chance this may contain", but simply stating that it does, indeed, contain malware. If Apple just said that every thing you download specifically contains malware, that would cause all sorts of problems and backlash. It has to either be scanning or using some kind of filter/blacklist/analyzer to detect malware.

I think it's using a blacklist, and I'd imagine it's something that can and will be updated in 10.6.x builds.

Hardly ironic. They're keeping true to their word by preventing any possible malware from reaching your computer in the first place. It's essentially a re-worded confirmation box for when you run a new program, but made more focused on preventing malware to stop people mindlessly clicking 'run' when the box pops up.

So wait, when Apple embeds an antivirus checking in the OS it's awesome but when you can choose what antivirus you want to install on Windows than it's PC being hit with viruses and it's ridiculous. GOT IT!

This is the same thing as Microsoft Security Essentials only done Apple way, meaning it's "hush hush" and again closed up and embedded in the OS.

Smells like same crap to me if you ask.

Ah so Apple can bundle antivirus software with their OS but Microsoft can't (in Europe)

Let's just be clear this is not Antivirus software.

  • It does not actively scan the systems Hard Disk or Memory
  • It is not a separate application
  • It does not detect Viruses or Worms

What it does do is check the contents of a mounted disk image before it opens it and checks for two very specific files.

To call this an Antivirus is a huge stretch. It isn't even comparable to Windows Defender.

Let's just be clear this is not Antivirus software.

  • It does not actively scan the systems Hard Disk or Memory
  • It is not a separate application
  • It does not detect Viruses or Worms

What it does do is check the contents of a mounted disk image before it opens it and checks for two very specific files.

To call this an Antivirus is a huge stretch. It isn't even comparable to Windows Defender.

Well it is an antivirus as long as it checks the contents of the files and looks for viruses, thus the name Anti-virus. You don't have to have antivirus resident in memory in Windows either, but you apps do because they want to make sure that they prevent action even if you ran the file.

Norton AntiVirus only runs in memory on my computer to check for emails too (which will undoubtedly happen on OSX if it hasn't already). It's not differnet than AV apps on Windows checking in zip/rar archives and comparing it to the library of viruses. If anything the necessity due to Windows being highly targeted system means that the preventive measures and libraries or viruses are much wider and the heuristic methods of catching viruses have improved, something that OSX is yet to face.

Edited by Boz
Well it is an antivirus as long as it checks the contents of the files. You don't have to have antivirus resident in windows in Windows either, but you apps do because they want to make sure that they prevent action even if you ran the file.

Norton AntiVirus only runs in memory on my computer to check for emails too (which will undoubtedly happen on OSX if it hasn't already). It's not differnet than AV apps on Windows checking in zip/rar archives.

It doesn't even check for or remove Viruses. Since when did an Anti-Virus no longer detect or remove Viruses?

And in-fact this doesn't remove any type of file. It does a very rudimentary check and tells the user. That is it.

Possibly related..

http://developer.apple.com/releasenotes/Ma...MacOSX10_5.html

Quarantine

Applications that download files from the Internet or receive files from external sources (such as email attachments) can use the Quarantine feature to provide a first line of defense against malicious software such as Trojan horses. When an application receives an unknown file, it should add quarantine attributes to the file using new functions found in Launch Services. The attributes associate basic information with the file, such as its type, when it was received, and the URL from which it came. When the user tries to open a file that has quarantine attributes associated with it, Mac OS X inspects the file and automatically prevents known malicious files from being opened. For other files, the system asks the user what to do about the file, providing the user with information found in the quarantine attributes. If the user approves the opening of the file, the quarantine for that file is lifted.

If you are developing a web browser or email program, or if your software somehow deals with files from unknown sources, you should use the Quarantine feature as part of your program?s basic security procedures. Quarantine is part of the Launch Services API, which is itself part of the Core Services framework. For more information about the Quarantine API, see the LSQuarantine.h header file in that framework.

It doesn't even check for or remove Viruses. Since when did an Anti-Virus no longer detect or remove Viruses?

And in-fact this doesn't remove any type of file. It does a very rudimentary check and tells the user. That is it.

Well that just makes it a bad anti-virus not a non-anti virus. The fact that it checks against the library of viruses to make sure you didn't catch is the definition of anti-virus program. That's how Windows anti-virus programs work too. They check your files and archives to make sure you don't have a known virus but also include a smarter heuristic methods that help prevent from those viruses that are unknown. Of course, if you are infected on OSX I'm not sure what you are to do. Reinstall the OS?

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Windows ME was worse.
    • Dude, im talking about simply disable it from settings app. Because of the eu regulation, you could disable it here for years.
    • One big question about Mars was answered thanks to Einstein's 100 year old theory by Sayan Sen Image via DepositPhotos Scientists at the U.S. National Institute of Standards and Technology (NIST) have calculated how time passes on Mars compared with Earth, adding detail to how timekeeping would need to work beyond Earth’s orbit. The study, published in The Astronomical Journal, found that clocks on Mars run an average of 477 microseconds, or millionths of a second, faster per day than clocks on Earth. A microsecond is one millionth of a second, a very small unit used in precise scientific timing systems such as atomic clocks, which measure time using consistent atomic behavior. This difference is not constant. Because Mars moves around the Sun in a non-circular path (an eccentric orbit, meaning its distance from the Sun changes over time instead of staying fixed) and is affected by gravity from other bodies, the daily difference can vary by as much as 226 microseconds over a Martian year. The study also identifies smaller repeating changes of about 40 microseconds per day linked to synodic cycles (repeating periods that describe how planets line up with each other as they orbit the Sun from different positions). These longer patterns affect how time differences slowly rise and fall. To make these estimates, researchers compared Mars with Earth and the Moon. The work looks at relativistic proper time (the time actually measured by a clock depending on its speed and the strength of gravity where it is located, as described in Einstein’s relativity). This shows that each world has its own slightly different “rate” of time. This becomes more important as space missions expand into cislunar space (the region between Earth and the Moon) and toward Mars. On Earth, time systems rely on atomic clocks and satellites, which stay closely synchronized for navigation and communication. The study is based on Albert Einstein’s theory of relativity, which shows that time is affected by gravity and motion. Stronger gravity makes clocks run slower, while weaker gravity makes them run faster. “The time is just right for the Moon and Mars,” said NIST physicist Bijunath Patla. “This is the closest we have been to realizing the science fiction vision of expanding across the solar system.” A day on Mars is about 40 minutes longer than on Earth, and a Martian year lasts 687 Earth days. But the main question is not just about days and years, but how fast time itself passes. An atomic clock placed on Mars would function normally, but compared with one on Earth, the two would slowly drift apart due to differences in gravity and motion. This requires careful calculation of what is similar to a time-zone difference across planets. Researchers modeled Mars using a reference surface and included gravitational effects from the Sun, Earth, the Moon, and other planets. This includes a multi-body gravitational system (often described as a three-body or four-body problem, where predicting motion becomes difficult because multiple large objects all pull on each other at the same time through gravity). Mars also follows a Keplerian orbit (an idealized elliptical orbit based on simple gravitational laws that assume smooth motion, before adding real-world disturbances from other bodies). In addition, the researchers accounted for solar tides (small changes in gravitational force caused by the Sun that slightly distort planetary motion and timing, especially in systems involving Earth and the Moon). These combined effects are described as relativistic proper-time offsets (small but measurable differences in elapsed time between locations caused by gravity and motion), which must be included when comparing clocks across planets. “But for Mars, that’s not the case. Its distance from the Sun and its eccentric orbit make the variations in time larger. A three-body problem is extremely complicated. Now we’re dealing with four: the Sun, Earth, the Moon and Mars,” Patla explained. “The heavy lifting was more challenging than I initially thought.” Although the differences are extremely small, they matter for navigation and communication systems that depend on precise timing. Even modern networks on Earth, such as mobile systems, rely on timing accuracy at very small fractions of a second. Communication between Earth and Mars currently takes about four to 24 minutes or more depending on planetary positions, meaning signals are not real-time. A shared and accurate time system could help future missions reduce confusion in navigation and data exchange. “If you get synchronization, it will be almost like real-time communication without any loss of information. You don’t have to wait to see what happens,” Patla said. Researchers note that fully developed interplanetary communication networks are still far in the future. However, understanding how time behaves across planets helps prepare for those systems. “It may be decades before the surface of Mars is covered by the tracks of wandering rovers, but it is useful now to study the issues involved in establishing navigation systems on other planets and moons,” said Neil Ashby. “Like current global navigation systems like GPS, these systems will depend on accurate clocks, and the effects on clock rates can be analyzed with the help of Einstein’s general theory of relativity.” Patla added that the results also help improve understanding of time itself under relativity. “It's good to know for the first time what is happening on Mars timewise. Nobody knew that before. It improves our knowledge of the theory itself, the theory of how clocks tick and relativity,” he said. Source: NIST, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • TeraCopy 4.0 Build 26 by Razvan Serea TeraCopy is a compact program designed to copy and move files at the maximum possible speed, also providing you with a lot of features. Copy files faster. TeraCopy uses dynamically adjusted buffers to reduce seek times. Asynchronous copy speeds up file transfer between two physical hard drives. Pause and resume transfers. Pause copy process at any time to free up system resources and continue with a single click. Error recovery. In case of copy error, TeraCopy will try several times and in the worse case just skips the file, not terminating the entire transfer. Interactive file list. TeraCopy shows failed file transfers and lets you fix the problem and recopy only problem files. Shell integration. TeraCopy can completely replace Explorer copy and move functions, allowing you work with files as usual. TeraCopy is free for non-commercial use only. For commercial use you need to buy a license. The paid version of the program includes the following features: Copy/move to your favorite folders. Save reports as HTML and CSV files. Select files with the same extension/folder. Remove the selected files from the copy queue. TeraCopy 4.0 Build 26 changelog: Added support for receiving files via the LocalSend protocol. Improved exception handling and automated bug report upload. Fixed several minor bugs and small memory leaks. Build 26 (June 24) Fixed a rare exception when a transfer completed. Features added since version 3.17: Enhanced speed graph. New multi-threaded copy engine. Support for copying to multiple targets. Queue system for managing multiple copy operations. Support for receiving files via the LocalSend protocol. TeraCopy entry in the modern Windows Explorer context menu. Integrated toolbar in the title bar. Why receive LocalSend transfers with TeraCopy? Handle file conflicts: Skip, overwrite, or rename files when a file with the same name already exists. LocalSend always creates another copy, which can waste time and disk space, especially when resuming an interrupted transfer. Filter unwanted files: Apply ignore lists or remove files manually before accepting a transfer, so unnecessary files are not downloaded. Better performance on fast networks: In tests over a 10 Gbps connection, TeraCopy received files several times faster than the standard LocalSend app on Windows. Download: TeraCopy 4.0 Build 26 | 14.5 MB (Freeware, paid upgrade available) View: TeraCopy Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Briefly used Turbo Pascal (and Turbo C++) in 97 and soon after that I bought PC magazine that included a full version of Delphi 2. I still use Delphi today, some 29 years later.
  • Recent Achievements

    • Grand Master
      Jaybonaut went up a rank
      Grand Master
    • One Year In
      Philsl earned a badge
      One Year In
    • Dedicated
      Scoobystu earned a badge
      Dedicated
    • First Post
      Tom Schmidt earned a badge
      First Post
    • One Month Later
      D0nn13 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      453
    2. 2
      +Edouard
      177
    3. 3
      PsYcHoKiLLa
      124
    4. 4
      Michael Scrip
      78
    5. 5
      Xenon
      76
  • Tell a friend

    Love Neowin? Tell a friend!