22

With OS X malware increasingly in the news (see the Flashback Trojan issue), is there anything that I should do to increase the security of my Mac and reduce my exposure to malware?

What I'm doing so far:

  • keep up with OS X system patches
  • installed an antivirus package and kept up with the associated updates
  • separated my regular user login and the admin login
  • keep third party software up to date (Firefox, Flash, etc.)
  • research, scan, and limit the things I download
  • use adblocking and JS block browser extensions

Is there more that I could reasonably do to improve my machine's security? Any tips/suggestions for software or security best practices would be appreciated.

Improve this question
5
  • 4
    For maximum security, unplug your machine. Machines that are powered down and have no connection to any input devices generally avoid malware. Sadly, anything that can serve as a source of desirable input can also serve as a source of undesirable input. As the answers below correctly observe, there are many practices that improve security, but it's all a trade-off: maximum security is completely unusable, and maximum usability compromises security. What trade-off is right for you may not be the right answer for someone else (which doesn't mean this isn't a good question -- it is).
    – Daniel ♦
    Commented Apr 10, 2012 at 1:48
  • 2
    @Daniel, I wonder if there's a way to rephrase that useful point yet avoid the "don't use your machine" canard.
    – Reid
    Commented Apr 10, 2012 at 18:58
  • @Reid If I could think of how to do that, I'd post it as an answer, not a comment. :-)
    – Daniel ♦
    Commented Apr 10, 2012 at 19:57
  • @DanielL, you raise a good point - there's only so much that a machine can be secured before it's unusable.
    – JW8
    Commented Apr 10, 2012 at 20:33
  • For link purposes: apple.stackexchange.com/q/141/8546 apple.stackexchange.com/q/7558/8546 apple.stackexchange.com/q/12638/8546 apple.stackexchange.com/q/37642/8546 apple.stackexchange.com/q/45931/8546
    – Graham Perrin
    Commented Apr 10, 2012 at 22:35

7 Answers 7

Reset to default
20

Web browsing

The largest potential danger comes from the "Internet". My Mac is online most of its operating time and web browsers are among the most used applications on my Mac.

Therefore, the most important rules are:

  • surf the web carefully
  • don't just download any software you find

Browser choice

The browser choices, configurations and extensions offers various options to configure your security and privacy.

I like to use Chrome because it's known for having

  • strict sandboxing
  • updates itself, its extensions and flash plug-in automatically
  • open extension design

Safari's extension design is more restricted, causing the JavaScriptBlocker for Safari not to be as functional as similar extensions for Chrome or Firefox: e.g. Web Bugs are not blocked.

Chrome is considered quite safe. It did not get exploited at the Pwn2Own hacking contest three years in a row (2009-2011). 2012 is the first year a team presented the use of a zero-day-exploit in Chrome.

The German Federal Office for Information Security (BSI) (similar to the NIST in the U.S.) recommends the use of Chrome because of its sandboxing technology and auto-updates.

Java

Chrome has disabled Java by default and asks you every time when it's required to run. You can disable Java for Safari as well. You won't miss it most of the time:

  • Safari Preferences → Security → uncheck Enable Java
  • Open /Applications/Utilities/Java Preferences.app → uncheck Enable applet plug-in and Web Start applications

Other options

  • System Preferences → General → check Automatically update safe downloads list

Open Safari downloads manually:

  • Safari Preferences → General → uncheck Open "safe" files after downloading

Flash and PDF viewer

Download Adobe flash only from the official website. However, you don't need to update it manually anymore. The latest Flash update for Mac adds auto-updates.

In Safari, you can use the ClickToFlash extension to manually allow flash to run in your browser.

You don't need to use Adobe's PDF viewer. Apples's preview works in Safari as well. You can remove the Adobe plug-in here:

  • /Library/Internet Plug-ins/AdobePDFViewer.plugin

Passwords

For creating passwords you can use the Password Assistant provided by OS X. Go to /Applications/Utilites/Keychain Access.app → click the plus at the bottom left → click the key symbol.

enter image description here

Adblock lists

The Adblock and Adblock Plus extensions offer lists to improve your privacy and security.

The lists are named:

  • EasyPrivacy: privacy protection
  • Malware Domains: malware protection
  • Antisocial: blocks social integration.
Improve this answer
1
  • 1
    … surf the web carefully — I occasionally enable the WOT (Web of Trust) extension for Safari. I have not used it often enough to describe it as best practice, and I guess that other similar products/services exist, but it's a reasonably user-friendly collaborative approach to trust (and care).
    – Graham Perrin
    Commented Apr 11, 2012 at 0:08
10

Your first point ("Kept up with OS X system patches") is probably the most important. If you trace the history of exploits on OS X, most have come from:

  • Java
  • Flash
  • PDFs
  • Safari
  • Giving privileges to unknown apps or clicking on unknown links

I'm not a security expert, but it seems like limiting your exposure to those things will decrease your exposure significantly.

Java

Java shouldn't be installed if you don't need it, and should only be turned on for the time you use it, if you do need it.

Flash

The same is true for Flash. If Safari is your browser of choice, then grab Chrome and Switch to open pages with Flash in Chrome (and only the pages that require Flash). Chrome has a sandbox for Flash and is considered quite safe.

PDFs

Applying Apple's patches should (eventually) save you from any PDF exploits. Using OS X's Preview to view PDFs rather than Adobe Acrobat is a good idea, too.

Safari

Keeping your browser up to date and limiting the amount of extensions you use is a good idea. Safari has an "Open safe files after downloading" option. If you're tuning for security, that's best turned off. Safari also includes malware detection. The latest Chrome and Firefox also make good browser choices.

Giving privileges to unknown apps or clicking on unknown links

Being super careful with links you click on and apps that ask for admin privileges also helps stop trojans and malware from doing bad things. If a service has sent you an email notification about something you need to take action on, you may be better visiting the site using your own bookmarks and not by clicking a link if the email, if you're suspicious of the email's origin.

Many different and long passwords

Using something like 1Password to generate and store your passwords can help, because it means you have a different password for each service, and they can be a huge string of seemingly random letters and numbers. Here's one I just generated as an example: lyLEnrFDnoDoBoS90PJZ. Doing so also means you can ensure your main computer (and 1Password) passwords are never used for websites or web services.

Long passwords take a long time to hack for brute force attacks. And using different passwords for everything means that one compromised service won't give the attacker your password for other services.

There's quite a few alternatives to 1Password, including OS X's in-built keychain (which is free with OS X).

Follow Mac tech blogs

If all else fails, and there's some kind of exploit that you're vulnerable to, you'll want to find out as soon as possible. Chances are it'll be big tech news, so following a few popular Mac tech sites should notify you within a day or so of the issue and you can take the needed action. The recent Flashback trojan has been big news. I found out about it because I follow Daring Fireball and Macworld. (It uses a Java exploit, so disabling or not installing Java would have saved you in that case.)

Improve this answer
6
  • 2
    Hmm. Your answer is chock full of generally good advice, but much of it doesn't really answer the question. For instance, 1Password will help mitigate a compromise but doesn't make your mac itself more secure or resistant to malware getting installed.
    – bmike ♦
    Commented Apr 9, 2012 at 12:44
  • I'd say that using the same password for web services and your Mac admin password does make your Mac less secure. 1Password helps ensure you're using a different password everywhere.
    – Marc Edwards
    Commented Apr 9, 2012 at 14:13
  • Hmm - I guess it depends if you lump someone guessing your password and logging in remotely as "exposure to malware". From where I sit, disabling remote log in seems the better choice. The OP has already specified that the user account is not an admin account - so perhaps your advice there will help.
    – bmike ♦
    Commented Apr 9, 2012 at 14:51
  • The real issue here is the question has far too much answer for my personal tastes. It's more like a blog post - perhaps you and the OP might consider collaborating on an actual article for our blog on this?
    – bmike ♦
    Commented Apr 9, 2012 at 14:52
  • @bmike, didn't mean to include any answers in my question. I wanted to see if the experts in the forum were aware of anything else I should do to generally improve security - e.g., better firewall software, etc. Saw some things that I didn't think of, like running an instance in a VM.
    – JW8
    Commented Apr 10, 2012 at 20:34
8

That is more or less it. I also like to run potentially unsafe stuff in a VM of some kind (I use Parallels, but for this the free VirtualBox works well enough); Parallels 7 can automatically install a virtual Mac image from the Lion recovery image, which is very convenient for this kind of sandboxing. (Yes, running Lion in a VM is now legal.)

Improve this answer
1
  • 1
    Indeed - the OP has a nice set of practices so nothing I can see needs to be added to make his mac more secure.
    – bmike ♦
    Commented Apr 9, 2012 at 12:41
3

Use common sense. That is the most important thing to do when using any system, any time. I have been using Macs for about ten years. I have never installed any Firewalls or virus scanners, always worked in an admin account full-time, always downloaded and installed all kinds of apps and never have I had ANY problems regarding security.

Most of the "malware" there is out there for Macs aren't even serious viruses, but "photos" that suddenly ask for an administrator password, etcetera. You can get as paranoid as you wish with installing all kinds of protecting software, don't dare to download stuff etcetera, but really does that solve anything? I seriously doubt so. Installing security software that annoys you as a user is not the purpose of buying a Mac, that's something that belongs to e.g. Windows Vista.

The bottom line of this answer is, again, use your common sense. Think about what you download and install and what you give your admin pass to, but don't get all crazy and overprotect yourself. You can install the best security there is but as long as you keep the door open, this will not help you. Mac OS X has a pretty advanced security system already, installing ten others will not help you.

Improve this answer
1
  • good point about the malware asking for admin passwords.
    – JW8
    Commented Apr 10, 2012 at 20:37
2

The more you change your life to accommodate these "improvements" the more it's letting you effect you. Sure you now run a lower risk of contamination by some malware, but your system is crippled by anti virus scans, your passwords are epically long and irritating to type, you don't try as many new applications because ur paranoid, and you cripple your web browsing experience by deactivating java.

Don't be stupid, have common sense, and just relax a little.

Improve this answer
2
  • @XAleXOwnZX, good point - just wanted to see whether my current set up is "secure enough".
    – JW8
    Commented Apr 10, 2012 at 20:36
  • i don't think having a rugged, impractical computer bogged down to the core with "security" features constitutes the use of the word "improvement"
    – Alexander
    Commented Apr 11, 2012 at 2:13
1

… installed an antivirus package … JS block browser extensions …

HTTP data stream

If you find a reputable anti-malware product with a scanning engine that has access to the HTTP data stream, then you might take a less strict approach to blocking JavaScript.

Availability

Whether such a product exists for OS X, I don't know.

My current guess is that enterprise-oriented solutions will be easier to find than a platform-specific consumer-oriented solution.

Background

Malware, but only for a second in a day | Naked Security (2009-11-16):

… any scanning engine which has access to the HTTP data stream should be able to cope since it has all the relevant contextual data required at the time of rendering.

Brute-forcing aside, the only real way to tackle this problem is to use "Just in time" detection (otherwise known as on-access) …

In response to a microblog post, SophosLabs wrote:

… on access scans only scans files on-disk, not network traffic to the browser.

Detecting 'web bugs' — without scanning network traffic to the browser? (2010-11-10) gained a more detailed response from Sophos. A key point:

… the final landing site of almost all malicious code will be on permanent storage, prior to execution …

That leaves questions concerning other landing sites for malicious code — maybe beyond the scope of the opening question.

Summary and review

JW8, your six points seem well balanced at this time. Maybe think about data streams in a future review — the threat landscape, and the range of anti-malware products available to consumers, may change.

Improve this answer
1

The question does already contain a basic set of good practices.

I would like to add here 2 points:

Choose a safe file system

Install your running MacOS X on a Case sensitive, Journaled File system. Such a File system won't tolerate any application wich confuse a file named /tmp/w0rm.log with another one named /tmp/W0rm.log.

Then any poorly writen application and many crapwares won't be able to either install or will run in the wall. With such a sensitive file system, you will avoid and detect most of these dangerous applications.

Control your firewall

By command your firewall I mean this is a defense weapon. Then it isn't just a magic feature you have to turn on and all the bad direct attacks will be blocked.

Read your firewall logfile which is something like: /var/log/ipfw.log or /var/log/appfirewall.log and decide of the adapted corrective action depending on what kind of prey you find playing there:

  • analyse what are all these unknown connexions to a server you don't even know the name;
  • detect and block unwanted port scans;
  • detect and close unwanted services;
  • detect and close any remote control of your Mac;
  • detect uninvited neighbours on your wireless network or from the other end of the Internet (which is just 2 s away at the slow ping pace).
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .