3

I read this Apple Support page that they use XProtect to scan for known viruses.

I cannot find any evidence that XProtect is getting new definitions or scanning anything.

Where can I find the logs and if it's in unify then how do I persist them?

How do I know Apple really scans for known malware and isn't just making that claim?

Improve this question
4
  • 2
    eclecticlight.co/?s=xprotect
    – Marc Wilson
    Mar 3 at 22:26
  • I can understand the desire to check things for yourself, but there are a ton of security researchers who spend all day going over MacOS with a finetooth comb. If Apple was making security claims that weren't matched by the reality, it would be all over the tech press.
    – benwiggy
    Mar 4 at 17:52
  • @benwiggy To be fair to the OP, Apple has a history of announcing a security feature with great fanfare and a year of two later letting it slide into obscurity. As an example, Gatekeeper Configuration Data has not been updated in over 2 years and is no longer active eclecticlight.co/2021/03/06/…
    – Gilby
    Mar 4 at 22:31
  • My auditors, customers, and board of directors need more information than "just trust apple." We'll need to show that the solution works, updates, and is running on everyone's system. Otherwise I may need to install a third party antivirus solution which is not good for anyone :-)
    – Jonathan
    Mar 5 at 0:48

2 Answers 2

Reset to default
8

This answer is in addition to @jksoegaard's answer showing how to report on usage on XProtect. I am providing the evidence regarding updates to XProtect.

System Information shows all the installations related to XProtect. Here are mine since I last did an erase and reinstall:

XProtect

If you prefer Terminal output you can use system_profiler -json SPInstallHistoryDataType, but the output needs further processing to get it into a manageable form. [Thanks to @mustaccio for this.]

And, I know there is another XProtect update today. This is reported by Howard Oakley's SilentKnight

SilentKnight

The changes in today's update are discussed here XProtect Update

Improve this answer
4
  • This shows me that the config data is updated and history of updates. ps -ef | grep -i xprotect | grep -v grep shows me it is running. Do you know how I can access the information in Software->Installations using the terminal?
    – Jonathan
    Mar 5 at 0:46
  • No, I don't, sorry.
    – Gilby
    Mar 5 at 4:35
  • 3
    @Jonathan system_profiler -json SPInstallHistoryDataType for example.
    – mustaccio
    Mar 5 at 15:55
  • @mustaccio Thanks, I have inserted your comment into my answer.
    – Gilby
    Mar 5 at 22:09
9

You can find the logs by running:

log show --predicate 'subsystem == "com.apple.xprotect"'

To persist them, you could just save it into a file, like this:

log show --predicate 'subsystem == "com.apple.xprotect"' > mylogs.txt

You can find XProtect's various security definitions in this folder:

/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/

For example look at XProtect.plist and XProtect.yara. If you want to prove to yourself that these are actually updated by Apple - take a copy of them. Then compare that copy to your files a month or two later.

If you're still very suspicous that perhaps Apple is just claiming to scan for malware, while actually not doing so - even when that would include making fake documentation for it, fake software for it, fake definition files, and fake update processes for the same - you can just check that it does for yourself. Sounds like it would almost be more work for Apple to fake scanning for malware rather than actually doing it -- while at considerably risk of any system expert or programmer exposing them. Doesn't make sense, but if you really want - noone's stopping you.

Checking for yourself could include actions such as intentionally introducing a malware file (inactivated) to the system, and checking that the XProtect detects it. You could also do code analysis on the XProtect binaries to make sure that it does what Apple says it does.

Improve this answer
6
  • 4
    You may wish to point the OP to the EICAR test file - it's a small MS-DOS binary that is benign (its only action is to print a string to the console) but most antivirus vendors include in their definitions to allow for safe testing.
    – nanofarad
    Mar 4 at 15:32
  • I don't see the history of updates or the current scan results in these logs. Heck, I don't have anything in the logs that match - I'm guessing they have already flushed out. Good idea on the EICAR test file @nanofarad.
    – Jonathan
    Mar 5 at 0:40
  • @nanofarad how would I use the EICAR to trigger xprotect - it is not an application binary that mac would execute and therefore xprotect wouldn't scan it, correct?
    – Jonathan
    Mar 5 at 0:45
  • @Jonathan I'd expect that a competent malware scanner would likely (but not necessarily) scan things other than native executables for the local system. There's still a chance of a false negative here, but if it's detected then you have your answer without needing to do anything involved and risky.
    – nanofarad
    Mar 5 at 0:58
  • 1
    @nanofarad Here is evidence I was wrong: /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist has reference to eicar.com
    – Gilby
    Mar 5 at 5:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .