Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Occasionally, answers on this site include software recommendations. Let’s assume a "legitimate developer" pretends to have created a useful application that is (secretly) capable of doing harm. How can I be sure I do not install something that contains malicious code or a root kit, especially if it is closed-source software?

share|improve this question

3 Answers 3

up vote 7 down vote accepted

Sadly, malicious code can be so small and obfuscated in an infinite number of ways so you can't simply make a rule to test a package to tell if it's good or bad.

Statistically, people have established some guidelines like trying to know the source (typing in the web address directly and not trusting a link, not downloading it from an alternate site, insisting that it be code-signed and verifying the package check sum before installing executables), but these are indirect remedies.

Apple maintains a page with links to most security information here:

Additionally, you could insist that all software that you run is signed by a legitimate developer to reduce the likelihood that someone has added a key logger to the game you just downloaded.

Lastly, after several delays, Apple has released GateKeeper to effectively sandbox software so that it has to explicitly list the things that it does (like access the address book, or modify files without user interaction) so that you can only let the system run code that obeys the sandbox rules. From a consumer perspective, you can prevent all code from running while you do whatever checks you feel are appropriate before allowing that code to run on your Mac.

share|improve this answer
    
It seems, though, that GateKeeper does not integrate with sandboxing at all. The apps it allows just need to be signed by the developer, it does not enforce sandboxing. (Apps purchased from the App Store are sandboxed now) –  Thilo Aug 27 '12 at 1:07
    
You are correct. On 10.8, the gatekeeper control panel allows you to specify signed apps which don't necessarily need to use sandboxed API. The apps on the app store are also in transition. Not all are sandboxed, but are being steered that way as time goes on. –  bmike Aug 27 '12 at 1:26

There is no surefire solution, but there are some simple steps you can take that in practice are effective:

  • Turn on Gatekeeper.

    It should be on by default, but if you want to be sure: go to System Preferences, then Security and Privacy, and then click "Mac App Store and identified developers". Like this:

screenshot of Gatekeeper

  • Try to get your software through the Mac App Store, whenever possible. This is much safer than getting software through the web.

  • When installing an app through the Mac App Store, take a quick look at the reviews, the number of people who have installed it, and the brand. If it has bad reviews or very few reviews, and if very few people have installed it previously, you might want to be cautious. If in addition you've never heard of the brand, you might be even more careful.

    While there are no absolute guarantees in life, software that has good reviews and many installs is very unlikely to be malware. It is very rare for malware to make it onto the market, and when it has happened, it tends to get removed fairly quickly -- and I would expect this to be especially true for widely used software.

  • If you are forced to install software from outside the Mac App Store, be extra careful. This is your primary risk factor.

    • Only download software using https. Check that the browser address bar shows https (not http) and/or has a nice background glow.

    • Only install software from trusted sources: i.e., major brands that you recognize or who have been recommended to you by folks you trust to give you good computer advice.

    • Don't install sketchy stuff. Don't install pirated software. Don't install free file-sharing software. Don't download and install stuff off of bulletin boards and file-sharing sites. These applications are at much greater risk of containing malware, spyware, or other bad stuff.

    • If you are configuring a computer for someone who is not very software-literate, who you are worried might get fooled into installing bad stuff, and who probably won't need to install new software off the web for any legitimate purpose, you could configure Gatekeeper to only allow applications downloaded from the Mac App Store. This will provide extra protection against malware, at some cost in flexibility in where you can get your software from.

  • Make regular backups. Install and enable Time Machine. It is a simple and painless way to keep good backups. And good backups are great, last-ditch safeguard if you should suffer security problems: while you don't want to get infected by malware (it's a hassle and no fun), if it does happen, at least you should have backups of all your data.

Don't bother with anti-virus software. It doesn't add enough value. If you use Mac OS X's built-in protections, and exercise some good judgement when installing software, you are very likely to be fine.

And, don't get overwhelmed or too scared by the malware stuff. By selecting a Mac, you're already at significantly lower risk than most other users. And, by following the advice above, you've further reduced your risk. While nothing in life is risk-free, the risk is pretty low. Use good judgement, and you will almost surely be fine.

share|improve this answer

Run Sophos and keep it up to date. It's free and it doesn't slow your system down like we've probably all experienced on windows machines. Just sits up in the menu bar, doing it's thing, minding it's own business.

share|improve this answer
    
I'd be careful about Sophos. A recent paper exposed a number of huge vulnerabilities created by installing Sophos, including disabling of buffer overflow protection on some systems. Sophos confirmed that these are serious concerns but hasn't been particularly proactive about fixing them. My reading is that Sophos protects against known, garden-variety attacks but could be extremely vulnerable to a targeted attack or to future Sophos-specific exploits. –  octern Dec 11 '12 at 20:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.