Safe mode on MacOS :D

[ced89]

Hi,
on regularly basis I need to go in safe mode with Windows due to the AV, the safe mode is the only way to rescue the machine at the next upgrade or software update, usually I perform a system restore.

Does the Mac have these kind of issues with popular AntiVirus?

 

[IWT]

Does the Mac have these kind of issues with popular AntiVirus?

No. Because Macintosh products don't need AV in the way that you mean.

That is, there are no "true" viruses in the wild which affect Macs. But malware and ransomware are a different story. We tend to recommend DetectX Swift app (free) to rid yourself of any malware and Intego's VirusBarrier Scanner which is free from the App Store which scans for similar intrusions including ransomware.

So there is absolutely no need to install any AV like Sophos, Norton, Avast and the like. Apart from slowing down your Mac, they are difficult to remove later on.

AV for Windows is a totally different matter.

Ian

 

[ced89]

No. Because Macintosh products don't need AV in the way that you mean.

That is, there are no "true" viruses in the wild which affect Macs. But malware and ransomware are a different story. We tend to recommend DetectX Swift app (free) to rid yourself of any malware and Intego's VirusBarrier Scanner which is free from the App Store which scans for similar intrusions including ransomware.

So there is absolutely no need to install any AV like Sophos, Norton, Avast and the like. Apart from slowing down your Mac, they are difficult to remove later on.

AV for Windows is a totally different matter.

Ian

Thank you.
I disagree on Malwares, apparently there are many out there...
Especially in development etc, I'll be downloading a lot of code, packages etc, there is no OS that doesn't need an Antivirus...

VirusBarrier is not free, it's also quite expensive.

 

[Raz0rEdge]

I'm a developer and download lots of stuff and don't use antivirus software.

 

[MacInWin]

Thank you.
I disagree on Malwares, apparently there are many out there...
Especially in development etc, I'll be downloading a lot of code, packages etc, there is no OS that doesn't need an Antivirus...

VirusBarrier is not free, it's also quite expensive.

VirusBarrier Scanner is free in the Mac App Store. Search for it, download it, install it. Done. But don't install it as resident. Not needed. Just scan maybe once a quarter or half year.

And you can disagree about malware, but that doesn't change the fact that right now there are zero viruses for macOS and the malware that is there is easily removed with tools like VirusBarrier Scanner and DetectX Swift.

But you do what you think you need to do.

 

[chscag]

VirusBarrier Scanner is free in the Mac App Store. Search for it, download it, install it. Done. But don't install it as resident. Not needed. Just scan maybe once a quarter or half year.

He needs to buy a Mac first.....

 

[MacInWin]

He needs to buy a Mac first.....

There is that...

 

[Randy B. Singer]

I disagree on Malwares, apparently there are many out there...

Reference? (And please don't cite a source that it trying to sell anti-virus software.)

there is no OS that doesn't need an Antivirus...

Many computer users make the mistake of thinking that because Windows and the Macintosh look very similar that they are very similar. They are very different under the skin. The Macintosh is based on Unix, which places very high priority on security and always has. Windows was designed for consumers, and it has all sorts of gaping security holes; most egregiously, individual apps will execute code without asking for permission.

See:

Is Windows inherently more vulnerable to malware attacks than OS X?

www.infoworld.com

There may be as many as over FIVE MILLION!!! (going by the number of definitions in the ClamAV database) examples of malware for Windows:

ClamAV - Wikipedia

en.wikipedia.org

....and over 95,000 new threats for Windows *EVERY DAY*!!!

Outtakes from Sophos threat report

Sophos has a new threat report out today. Here are some of the interesting bits.

www.csoonline.com

It's a little out of date, but here is a list of malware for the Macintosh:

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Note that of the well less than 100 pieces of malware for the Macintosh that have existed, all of them are either extinct in the wild, or the macOS has been hardened against them.

Also, the macOS has a bunch of layers of anti-malware software already built-in:

XProtect/File Quarantine/Gatekeeper/MRT/SIP

Protecting against malware in macOS

On devices with macOS, malware defenses are structured using the followingApp Store, or Gatekeeper combined with Notarization, and XProtect.

support.apple.com

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Safely open apps on your Mac - Apple Support

macOS includes a technology called Gatekeeper, that's designed to ensure that only trusted software runs on your Mac.

support.apple.com

Mountain Lion: Hands on with Gatekeeper

With Mountain Lion, Apple is creating a new way for Mac developers to sign their apps and adding a new set of options for users in the Security & Privacy preference pane. Here's how Mountain Lion's new Gatekeeper feature works.

www.macworld.com

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Just what do XProtect and MRT protect your Mac from?

A detailed listing of malware currently blocked or removed by Apple’s tools built into macOS from El Capitan onwards.

eclecticlight.co

LockRattler 4.1 for El Capitan, Sierra, and High Sierra is now finally released

Now provides complete details of security updates, and simple tools to check for and install any pending updates.

eclecticlight.co

https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/

Finally, we are here on a discussion list with a reported 276,732 members. How many of those members are reporting being ravaged by a malicious bit of malware? Compare that to what you see on even a small Windows discussion list. Note that this situation exists even though the vast majority of Mac users don't have any sort of anti-virus software installed (beyond what is included in the macOS).

VirusBarrier is not free, it's also quite expensive.

VirusBarrier Free Edition (free)

‎Intego VirusBarrier Scanner

‎Free antivirus and malware security for your Mac! Intego Virus-Barrier Scanner can scan and remove Mac and Windows malware with a single click. VirusBarrier Scanner will detect any infected files which you might have downloaded or gotten in your inbox. This way your Mac is always kept safe and...

itunes.apple.com

 

[ced89]

Reference? (And please don't cite a source that it trying to sell anti-virus software.)



Many computer users make the mistake of thinking that because Windows and the Macintosh look very similar that they are very similar. They are very different under the skin. The Macintosh is based on Unix, which places very high priority on security and always has. Windows was designed for consumers, and it has all sorts of gaping security holes; most egregiously, individual apps will execute code without asking for permission.

See:

Is Windows inherently more vulnerable to malware attacks than OS X?

www.infoworld.com

There may be as many as over FIVE MILLION!!! (going by the number of definitions in the ClamAV database) examples of malware for Windows:

ClamAV - Wikipedia

en.wikipedia.org

....and over 95,000 new threats for Windows *EVERY DAY*!!!

Outtakes from Sophos threat report

Sophos has a new threat report out today. Here are some of the interesting bits.

www.csoonline.com

It's a little out of date, but here is a list of malware for the Macintosh:

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Note that of the well less than 100 pieces of malware for the Macintosh that have existed, all of them are either extinct in the wild, or the macOS has been hardened against them.

Also, the macOS has a bunch of layers of anti-malware software already built-in:

XProtect/File Quarantine/Gatekeeper/MRT/SIP

Protecting against malware in macOS

On devices with macOS, malware defenses are structured using the followingApp Store, or Gatekeeper combined with Notarization, and XProtect.

support.apple.com

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Safely open apps on your Mac - Apple Support

macOS includes a technology called Gatekeeper, that's designed to ensure that only trusted software runs on your Mac.

support.apple.com

Mountain Lion: Hands on with Gatekeeper

With Mountain Lion, Apple is creating a new way for Mac developers to sign their apps and adding a new set of options for users in the Security & Privacy preference pane. Here's how Mountain Lion's new Gatekeeper feature works.

www.macworld.com

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Just what do XProtect and MRT protect your Mac from?

A detailed listing of malware currently blocked or removed by Apple’s tools built into macOS from El Capitan onwards.

eclecticlight.co

LockRattler 4.1 for El Capitan, Sierra, and High Sierra is now finally released

Now provides complete details of security updates, and simple tools to check for and install any pending updates.

eclecticlight.co

https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/

Finally, we are here on a discussion list with a reported 276,732 members. How many of those members are reporting being ravaged by a malicious bit of malware? Compare that to what you see on even a small Windows discussion list. Note that this situation exists even though the vast majority of Mac users don't have any sort of anti-virus software installed (beyond what is included in the macOS).




VirusBarrier Free Edition (free)

‎Intego VirusBarrier Scanner

‎Free antivirus and malware security for your Mac! Intego Virus-Barrier Scanner can scan and remove Mac and Windows malware with a single click. VirusBarrier Scanner will detect any infected files which you might have downloaded or gotten in your inbox. This way your Mac is always kept safe and...

itunes.apple.com

Thanks for the message.
I knows the stuff about Unix, but as a foundation in infosec, I don't agree that you don't need an AV, or anti phishing solution on top of everything, that's the easiest way to get robbed all your accounts, just to start.

2nd simple example, if you use something like lastpass or simply the browser to store your passwords, you can be pretty sure that some crap in javascript can pull out all your accounts. I don't do it, but I just mentioned 2 simple examples of the same attack vector, that is a simple javascript script.

Before someone mentioned about the user space vs the kernel space, well on my iPhone a popular commercial AV runs in user space, and I expect it to run in the same way on a Mac, as you can see, not only VirusBarrier is designed specifically for a Mac and with the same concept of VirusBarrier or Detectx .

Anyway, the original question was, is there any safe mode for having an AV like in Windows at each update?
If they all run in user space, I don't expect anything like that.
By design, I think it can only run in user space, or in that sort of admin mode maximum, that it's not the kernel space of the full root account.
On my Mac for work I can take control of root, but I'm not sure if it's the master root account, I need to find a way to test it, probably modifying the root folder structure, it should be enough to create a folder there.

 

[MacInWin]

Aaaaannnnd, you didn't give an example of any of your claims. Some theoretical-possible-might be-javascript somewhere is not an example, just a bogeyman.

 

[ced89]

Reference? (And please don't cite a source that it trying to sell anti-virus software.)



Many computer users make the mistake of thinking that because Windows and the Macintosh look very similar that they are very similar. They are very different under the skin. The Macintosh is based on Unix, which places very high priority on security and always has. Windows was designed for consumers, and it has all sorts of gaping security holes; most egregiously, individual apps will execute code without asking for permission.

See:

Is Windows inherently more vulnerable to malware attacks than OS X?

www.infoworld.com

There may be as many as over FIVE MILLION!!! (going by the number of definitions in the ClamAV database) examples of malware for Windows:

ClamAV - Wikipedia

en.wikipedia.org

....and over 95,000 new threats for Windows *EVERY DAY*!!!

Outtakes from Sophos threat report

Sophos has a new threat report out today. Here are some of the interesting bits.

www.csoonline.com

It's a little out of date, but here is a list of malware for the Macintosh:

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Note that of the well less than 100 pieces of malware for the Macintosh that have existed, all of them are either extinct in the wild, or the macOS has been hardened against them.

Also, the macOS has a bunch of layers of anti-malware software already built-in:

XProtect/File Quarantine/Gatekeeper/MRT/SIP

Protecting against malware in macOS

On devices with macOS, malware defenses are structured using the followingApp Store, or Gatekeeper combined with Notarization, and XProtect.

support.apple.com

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Gatekeeper (macOS) - Wikipedia

en.wikipedia.org

Safely open apps on your Mac - Apple Support

macOS includes a technology called Gatekeeper, that's designed to ensure that only trusted software runs on your Mac.

support.apple.com

Mountain Lion: Hands on with Gatekeeper

With Mountain Lion, Apple is creating a new way for Mac developers to sign their apps and adding a new set of options for users in the Security & Privacy preference pane. Here's how Mountain Lion's new Gatekeeper feature works.

www.macworld.com

Tech Guides - The Safe Mac

Mac Malware Guide ↗ Mac Performance Guide ↗ Adware Removal Guide ↗

www.thesafemac.com

Just what do XProtect and MRT protect your Mac from?

A detailed listing of malware currently blocked or removed by Apple’s tools built into macOS from El Capitan onwards.

eclecticlight.co

LockRattler 4.1 for El Capitan, Sierra, and High Sierra is now finally released

Now provides complete details of security updates, and simple tools to check for and install any pending updates.

eclecticlight.co

https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/

Finally, we are here on a discussion list with a reported 276,732 members. How many of those members are reporting being ravaged by a malicious bit of malware? Compare that to what you see on even a small Windows discussion list. Note that this situation exists even though the vast majority of Mac users don't have any sort of anti-virus software installed (beyond what is included in the macOS).




VirusBarrier Free Edition (free)

‎Intego VirusBarrier Scanner

‎Free antivirus and malware security for your Mac! Intego Virus-Barrier Scanner can scan and remove Mac and Windows malware with a single click. VirusBarrier Scanner will detect any infected files which you might have downloaded or gotten in your inbox. This way your Mac is always kept safe and...

itunes.apple.com

Thanks for the website The Eclectic Light Company , impressive quality of information about everything on Apple, from how to turn on the device to how to perform malware and forensic analysis!!!

 

[ced89]

Aaaaannnnd, you didn't give an example of any of your claims. Some theoretical-possible-might be-javascript somewhere is not an example, just a bogeyman.

Right, but... Javascript is so powerful to act deep into the OS, it's an incredible disease! I experienced this in Windows, as a matter of power, I'm not sure if it can interact with drivers also on Apple, not even sure about Linux, without AppArmor I would say it's still possible.

 

[IWT]

Right, but... Javascript is so powerful to act deep into the OS, it's an incredible disease! I experienced this in Windows, as a matter of power, I'm not sure if it can interact with drivers also on Apple, not even sure about Linux, without AppArmor I would say it's still possible.

@ced89: I don't doubt the sincerity of your statements and, as a friendly forum, we welcome comments from all-comers. But if you are right and Apple products are at serious or, at least, significant threats, why have we not heard about this - not just here, but across the world?

Apple is a trillion dollar company and wouldn't half the world be only too glad to knock Apple down if this was a significant threat or vulnerability?

Ian

 

[MacInWin]

I'm not sure if it can interact with drivers also on Apple

In Big Sur, it cannot. The system files in Big Sur are both unavailable to external users, but encrypted as well. Is it "possible?" Sure, anything is possible, but the internal security of macOS, as we have been saying to you, is such that right now there aren't any known vectors for javascript, or any other malware, to penetrate. So a/v companies don't even know where to put the warning sensors. And that is why A/V software as resident is of no valuable use to the Mac. When/if the first true virus for modern macOS is discovered, it will be trumpeted to the world. And not just by A/V companies trying to sell something. It will be front page material for just about every publisher (print/electronic) out there.

If you are so worried about javascript, you can turn it off in Safari Preferences.

 

[ferrarr]

The only way some of those situations will happen is if the "attacker" has hands on access to the device, while it is unlocked. If you can avoid that, you don't need to worry.

 

[NSMacGuru]

As to the OP:

Safe Mode on a Mac. I'm surprised you didn't just search, given that you're a developer and well-educated in matters of infosec. I'm not being sarcastic - I'm genuinely surprised that you're asking!

Hold down the SHIFT key on boot.

There' a secondary "safe" mode as well - immediately after logging-in, hold SHIFT and it will disable any "Startup Items" in that user account (the things listed under "Login Items" on the Accounts preference pane).

The process is slightly different if you have a newer M1 Mac. See this Apple Support Document.

 

[Raz0rEdge]

As to the OP:

Safe Mode on a Mac. I'm surprised you didn't just search, given that you're a developer and well-educated in matters of infosec. I'm not being sarcastic - I'm genuinely surprised that you're asking!

Hold down the SHIFT key on boot.

There' a secondary "safe" mode as well - immediately after logging-in, hold SHIFT and it will disable any "Startup Items" in that user account (the things listed under "Login Items" on the Accounts preference pane).

Your confusion is understandable since the OP doesn't even have a Mac, so all of their questions are purely hypothetical at this point in preparation of someday actually using the Mac.

 

[ced89]

As to the OP:

Safe Mode on a Mac. I'm surprised you didn't just search, given that you're a developer and well-educated in matters of infosec. I'm not being sarcastic - I'm genuinely surprised that you're asking!

Hold down the SHIFT key on boot.

There' a secondary "safe" mode as well - immediately after logging-in, hold SHIFT and it will disable any "Startup Items" in that user account (the things listed under "Login Items" on the Accounts preference pane).

The process is slightly different if you have a newer M1 Mac. See this Apple Support Document.

Thanks, but I was asking if the Mac is affected by such AV compatibility issues , it would be quite annoying to deal with these issues from the first upgrade.

May I ask if there is any restore point there? I mean, on the local disk.
For what I see online, you can restore only from time machine, but time machine is supposed to store the snapshots on an external drive, unless you add an additional partition on the local disk, after resizing.

 

[MacInWin]

May I ask if there is any restore point there? I mean, on the local disk.
For what I see online, you can restore only from time machine, but time machine is supposed to store the snapshots on an external drive, unless you add an additional partition on the local disk, after resizing.

No. Stop thinking Windows. TM, by default, makes a backup every hour. It stores snapshots on the internal drive if the external drive configured for TM isn't there. When the drive is detected, TM consolidates the snapshots and makes a backup that is inclusive of the snapshots, then deletes them. At the end of the backup, it makes one more snapshot of the system as it exists at the time of the end of the backup. (It does that because at the time of the start of the backup, it selects which files/folders to back up. Things can change while the backup is underway, so a snapshot is taken at the end of the backup to make sure anything that changed during the backup is captured for the next backup. So, there will always be at least one snapshot on the drive, maybe more if it's been more than an hour since the backup drive was mounted. But no "restore points" like Windows.

 

[hoody]

Wow, it's a while since I saw an op being so argumentative after asking a question and getting helpful answers. I'm an ex windows user and haven't looked back since changing to Apple nearly nine years ago. I have (like others) no AV software. I scored some malware a while ago and Malware Bytes got rid of it. I now use Detect x Swift and virus barrier scanner: nothing else. I bought an iMac and a refurbished (from apple) MBA in 2014 and haven't looked back. Being very far from a competent user, the only problems I've had have, apart from one, been down to me and they've been sorted out with great help from members on here. Windows! I had near constant problems and bills to get them fixed up. Coughing up for AV and a technician to sort things out when they went wrong. My only suggestion for the op is to get hold of a mac, get used to it and maybe buy one if you're happy with the way it performs.