Apple's Craig Federighi: Mac malware state "Non Acceptable" and why iOS != Mac

[WolframaticAlpha]

Summary

The Apple-Epic is really interesting. Craig Federighi, the head of Apple's Software, recently said that the company is not satisfied with the level of Malware on the mac. Federighi said his own family members have encountered malware on macOS. He also justified Apple's closed off app distribution on iOS, by analogizing iOS as a kidfriendly version of osx. 

 

Quotes

Quote

Hairforce one: Yeah, it’s certainly how we’ve done it on the Mac and it’s regularly exploited on the Mac. iOS has established a dramatically higher bar for customer protection. The Mac is not meeting that bar today. And that’s despite the fact that Mac users inherently download less software and are subject to a way less economically motivated attacker base. If you took Mac security techniques and applied them to the iOS ecosystem, with all those devices, all that value, it would get run over to a degree dramatically worse than is already happening on the Mac. And as I say, today, we have a level of malware on the Mac that we don’t find acceptable and is much worse than iOS. Put that same situation in place for iOS and it would be a very bad situation for our customers.

Also Fed: I think of it is as if the Mac is a car — that you can take it off-road if you want, you can drive wherever you want. And that comes with as a driver, you gotta be trained, there’s a certain level of responsibility in doing that, but that’s what you wanted to buy. You wanted to buy a car. With iOS, we were able to create something where children — heck, even infants — can operate an iOS device, and be safe in doing so. So it’s a really different product.

Quote

For years, Apple has consistently knocked Windows for its malware issues, claiming macOS is by far the more secure desktop operating system. However, faced with a legal battle that could decide the future of its business, the company offered a surprising admission: macOS has its own malware problem. The acknowledgement came from Apple Senior Vice President of Software Engineering Craig Federighi, who testified on Wednesday in the company’s antitrust case with Epic Games

My thoughts

Mixed feelings. Android has shown that an open source ecosystem can work for a mobile phone. But again, most users are < redacted >. And I respect the decision that they want to block downloading stuff from Safari. But I believe that Apple should allow stuff like the Epic games store on the iphone. People don't get a ton of viruses from stuff like steam.

 

My main takeaway is that you can neither have a completely locked down system, nor can you have a completely open system. iPhone was a glorified ipod with calls and a browser in it's first rendition. Over time, it has become a miniaturized computer. Android was buggy and unpolished af in it's first versions, but now it's become a clean OS with good degree of polish(stock rivalling that of ios)

 

Federighi's bluntness on the matter of Mac security surprised me. Apple is really tightlipped on that matter. The mac app store is the best desktop app store imo(Linux app stores are better UI-wise and publishing wise, but proprietary sw is limited over there). I personally only had gotten a virus once, because of a practical prank played on me by my friends. Other people on the mac do get viruses, federeghi's family included. But unless you do troglodyte stuff, you'll be fine on windows and mac. Recent reports are showing that macs are getting more viruses than windows, so apple has some serious work to do. If the mac becomes the premier computer due to the M1, apple may not be larping about it's security anymore(on the mac) 

 

 

I would love it if apple puts a developer mode on the iphone. Your warranty will be voided, but you can do anything.

 

Sources

 The level of Mac malware is not acceptable, says Apple’s Craig Federighi at Epic trial - The Verge

Apple exec Craig Federighi calls the state of Mac malware 'not acceptable' | Engadget

Edited May 20, 2021 by LogicalDrm

[Guest]

I don't mind Apple's walled (software) garden, but I do think they need to understand that evolution necessitates change. Their concept of "we started it, it's ours" is simply not how it works anymore.

[Ashleyyyy]

i understand Craig's point perfectly. his point was that if you allow software installs from a number of places compared to jsut the app store like iOS, you get a much higher chance of malware. these are simple facts, i don't understand why you are confused about it @WolframaticAlpha

 

you can actually enable an "ios" mode on macOS kinda. this button is in the settings: 

and if you only allow from app store, then the OS will refuse to execute any app that wasn't installed from there. however since the Mac App Store is kinda like Windows's store at the moment in that it doesn't have a lot of common software people install, almost nobody uses this feature. however, if you want more security, it is available in macOS. 

[Helpful Tech Witch]

1 hour ago, WolframaticAlpha said:

I would love it if apple puts a developer mode on the iphone. Your warranty will be voided, but you can do anything.

 

there is. it costs 100$, but it allows you to keep a sideloaded app (one that you loaded theough cydia) for over 7 days.

[DrMacintosh]

The Mac does have a malware problem. macOS has GateKeeper and “Xprotect.” Effectively that means once a Mac is infected, the OS has no tools to attempt to defend itself or isolate threats. At least none that are user facing and evident. 
 

They’re right though. iOS and macOS are two fundamentally different things. They may have the same lineage, but they’re like brothers. Two of the same genetic material yet completely separate in terms of aspirations and personality. 
 

I think you’d have to be a fool to think that criminals wouldn’t develop significantly more malware for iOS if ways are given for tech illiterates to side load apps. The way around that is simple though, lock out non-app store apps by default. Just like the Mac. Put the blame on the user (where it 100% should be) for willingly going “off-road” and getting stuck in the mud. 

[Commodus]

I know many people here would reject Federighi and insist that iOS be completely flexible, but he does have a point. Enthusiasts forget that most of the phone market isn't dominated by hardcore users, it's dominated by everyday people who wouldn't know app permissions from a hole in the ground — and shouldn't have to.

 

Now, it would be nice if iOS had an "I know what I'm doing, lose the restrictions" toggle, but I suspect companies and governments would abuse that (China loves how easy it is to surveil Android phones). Maybe an in-between option where it allows third-party stores that meet certain stringent criteria, so you have a choice of apps but don't have to contend with the glut of malware and junk apps you find on some third-party Android shops.

[Granular]

Living in solitary confinement jail cell makes you very secure from home invaders.

Doesn't make for a healthy life worth living though.

[Sauron]

1 hour ago, Commodus said:

I know many people here would reject Federighi and insist that iOS be completely flexible, but he does have a point. Enthusiasts forget that most of the phone market isn't dominated by hardcore users, it's dominated by everyday people who wouldn't know app permissions from a hole in the ground — and shouldn't have to.

Which is why those people can use the app store and those who want to should be able to work around it. Android doesn't allow sideloading by default either, it's understood that if you do it you should have some idea of what you're doing. I haven't heard of a single person accidentally enabling sideloading and installing malware on their android phone.

1 hour ago, Commodus said:

Now, it would be nice if iOS had an "I know what I'm doing, lose the restrictions" toggle, but I suspect companies and governments would abuse that (China loves how easy it is to surveil Android phones).

As though they couldn't do it right now on iphones... do you really think apps that come from the apps store have no tracking in them? Sideloading doesn't change this in any way. It's already been shown that Apple doesn't even check the apps it hosts all that well, they just don't care as long as you're making them money.

2 hours ago, Commodus said:

Maybe an in-between option where it allows third-party stores that meet certain stringent criteria, so you have a choice of apps but don't have to contend with the glut of malware and junk apps you find on some third-party Android shops.

Why would Apple want to give anyone explicit permission to bypass their store and give away their middle man role? This whole thing is only a debate specifically because Apple doesn't want to do that. If they are given any say in this they just won't do it.

 

As for third party android shops, far from all of them are as bad as you're painting them out to be. There will be parties that are interested in making a third party app store for ios and that also have a vested interest in not staining their reputation by distributing malware; epic is one of them but there are plenty of others.

 

And also forget shops for a second - it's ridiculous that people can't just go on github and try out some wonky foss app on their phone if they want to. It's (supposed to be) their phone, especially given how pricey it is - it's none of Apple's business if I decide I want trash apps on my phone. Oh, and if iphones had any options for software recovery this would be even less of a problem.

2 hours ago, DrMacintosh said:

I think you’d have to be a fool to think that criminals wouldn’t develop significantly more malware for iOS if ways are given for tech illiterates to side load apps. The way around that is simple though, lock out non-app store apps by default. Just like the Mac. Put the blame on the user (where it 100% should be) for willingly going “off-road” and getting stuck in the mud. 

Exactly, just let people take responsibility for what they do with their phone. If you make it unusable through unsupported actions nobody expects Apple to offer you support. Nobody else in the space has a problem with this, including Apple with their other system as you pointed out.

[captain_to_fire]

While Apple has more than a decade of experience in designing fast ARM chips, Microsoft has been dealing with malware since 1986 and they’ve made improvements to make Windows more malware resistant. Even looking at Apple’s documentation of XProtect, it is not as robust as Windows Defender

 

 

[Fnige]

11 hours ago, Commodus said:

Now, it would be nice if iOS had an "I know what I'm doing, lose the restrictions" toggle, but I suspect companies and governments would abuse that (China loves how easy it is to surveil Android phones). Maybe an in-between option where it allows third-party stores that meet certain stringent criteria, so you have a choice of apps but don't have to contend with the glut of malware and junk apps you find on some third-party Android shops.

Some form of app stores on the app store which could follow slightly different rules (slightly more lax but covering stuff like moderation (dont keep malware) or something along those lines) where you get the exposure of being on the default app store while still maybe being able to manage your own store and get most likely more profit from that.

 

Probably possible but I may be a bit too optimistic thinking that it could ever happen

[RejZoR]

3 hours ago, captain_to_fire said:

While Apple has more than a decade of experience in designing fast ARM chips, Microsoft has been dealing with malware since 1986 and they’ve made improvements to make Windows more malware resistant. Even looking at Apple’s documentation of XProtect, it is not as robust as Windows Defender

 

 

Microsoft constantly brags how advanced Windows Defender is, but really it's pretty dumb antivirus. Maybe the stuff they have going on on their side is advanced, but on user's end it's incredibly dumb. Allegedly it has behavior blocker. Never ever seen a single detection. Had to ask people around and managed to get provided with 2! documented events of it. For other AV's that have behavior blockers you can see countless examples of it in action. Anti-ransomware blocking? Totally useless because their whitelist is pure trash or their implementation since it just doesn't work, never worked and apparently never will because it has been broken since its inception from years ago. Getting constant blocking on legit files is annoying as hell. avast! has same tech that actually works. Whitelisted apps are allowed to modify protected files, others are not. Then there is HTTP scanning and anti-phishing, other antiviruses scan HTTP traffic in all browsers to prevent exploits and block phishing sites. WD only has anti phishing capability in Edge with no HTTP scanning anywhere. And there is also performance issue with WD. It's incredibly slow and taxing for all systems, from lowest end to highest end. It's so bad I need to have avast! installed on my ASUS Transformer so I don't have several seconds long pauses when executing pretty much anything. With avast!, same apps take half a second to execute. It's been this way from before when it was not even called Windows Defender yet. And in all these years Microsoft hasn't done anything to make ANY of above better. You'd expect them to do better given it's Microsoft and not some small 3rd party developer.

[captain_to_fire]

4 minutes ago, RejZoR said:

Anti-ransomware blocking? Totally useless because their whitelist is pure trash or their implementation since it just doesn't work, never worked and apparently never will because it has been broken since its inception from years ago

That's controlled folder access which is good at blocking ransomware but yes, it does have frequent false positives. But even without CFA, you can increase your protection by enabling application-based reputation, and if you're using Windows 10 Pro you can manually tweak the cloud protection level [here] [here] and attack surface reduction via Group Policy. They're all in my signature below.

5 minutes ago, RejZoR said:

With avast

Had much worse privacy concerns because of their not so anonymous telemetry was sold to third parties but didn't got alot of negative PR compared to Kaspersky which got a lot of negative press despite having no publicly available information that they are in bed with the Krelmin to spy on their users.

9 minutes ago, RejZoR said:

hen there is HTTP scanning and anti-phishing, other antiviruses scan HTTP traffic in all browsers to prevent exploits and block phishing sites. WD only has anti phishing capability in Edge with no HTTP scanning anywhere. And there is also performance issue with WD. It's incredibly slow and taxing for all systems, from lowest end to highest end.

Actually that can be a problem. With many antivirus programs they sit as "man in the middle" to intercept attacks, but that in itself can be a privacy concern, making XSS and clickjacking much easier.

14 minutes ago, RejZoR said:

And in all these years Microsoft hasn't done anything to make ANY of above better.

Why bother attacking a browser which has limited read and write permissions (ring 3) when all antivirus programs for Windows sit in ring 0 in its all glory? Antivirus vulnerabilities are not theoretical, there had been documented cases of these programs meant to protect are being targeted by hackers. TrendMicro's vulnerabilities allowed hackers to plant malicious files. The wikileaks vault 7 revealed that there is an underground black market of antivirus vulnerabilities. Sure majority of these antivurs vendors have bug bounties, but what's stopping a pen tester to sell their vulnerabilities to the highest bidder like a government agency? But then you might ask, what makes Windows Defender apart from others? Because at the moment, they're the only ones mitigating the risk of exploitation by putting the antivirus process (MsMpEng.exe) inside a sandbox container.  I'm sure @leadeater knows more about these more than me.

 

 

Though for our small business, I have deployed the cheapest tier of Bitdefender Gravityzone because Microsoft's business solutions for security is quite an overkill not to mention way too expensive for a mom and pop store with 7 computers.

[RejZoR]

Controlled Folder Access is useless annoying garbage. And you can't even remove the default folders which interfere with Steam. I'm not going to argue with usual bullshit around avast! privacy. It wasn't behind anyone's backs and all allegations of poor anonymization were all just claims with no evidence to support it whole outrage over it was dumb ass knee jerk reaction). Everyone keep saying how HTTP scanning is huge MITM risk yet there were hardly any such cases observed in real world. benefits are just greater than alleged issues AV's may cause.

[captain_to_fire]

6 minutes ago, RejZoR said:

I'm not going to argue with usual bullshit around avast! privacy. It wasn't behind anyone's backs and all allegations of poor anonymization were all just claims with no evidence to support it whole outrage over it was dumb ass knee jerk reaction).

No evidence? Then why would Avast CEO has to apologize that it happened behind their users backs?

 

[RejZoR]

Just now, captain_to_fire said:

No evidence? Then why would Avast CEO has to apologize that it happened behind their users backs?

 

Because users are dumb raging idiots and it's easier to just call it off, apologize and move on than trying to reason with them. Also how it can happen behind everyone's back when they were openly saying they are doing it. But you know, who ever reads anything before just quickly clicking ACCEPT right? That's as stupid as calling Google of collecting user data behind everyone's backs...

[GDRRiley]

15 hours ago, WolframaticAlpha said:

I would love it if apple puts a developer mode on the iphone. Your warranty will be voided, but you can do anything.

why should dev mode void it? if you needed an apple dev account attached that should be enough
if anything apple needs to be punished for their treatment of their "warranty " and repairing their devices, not have more ways to remove it

 

 

 

 

[captain_to_fire]

Just now, RejZoR said:

Because users are dumb raging idiots and it's easier to just call it off, apologize and move on than trying to reason with them. Also how it can happen behind everyone's back when they were openly saying they are doing it. But you know, who ever reads anything before just quickly clicking ACCEPT right? That's as stupid as calling Google of collecting user data behind everyone's backs...

It is still Avast's fault because their so-called telemetry anonymization is flawed. They claimed to their users that they have anonymized and depersonalized their telemetry data. But it was found out that even with the so-called "anonymized telemetry", it can still be traced back to the user [here].

[leadeater]

52 minutes ago, captain_to_fire said:

Antivirus vulnerabilities are not theoretical, there had been documented cases of these programs meant to protect are being targeted by hackers. TrendMicro's vulnerabilities allowed hackers to plant malicious files.

Add to that list Symantec and Windows Defender, they also had vulnerabilities which allowed code execution at one point in their lives.

[captain_to_fire]

16 minutes ago, leadeater said:

Add to that list Symantec and Windows Defender, they also had vulnerabilities which allowed code execution at one point in their lives.

Yes, but the point I made is that of all the antivirus programs as far as I know, Microsoft is the only one who made an effort to reduce the chances of being exploited by placing it in an sandbox since 2018 though it is not turned on by default. Perhaps nowadays other vendors followed their example. ¯\_(ツ)_/¯

[Video Beagle]

1 hour ago, GDRRiley said:

why should dev mode void it? if you needed an apple dev account attached that should be enough
if anything apple needs to be punished for their treatment of their "warranty " and repairing their devices, not have more ways to remove it

And you've made apple's argument for them.

If they're held liable for every stupid thing an idiot does with their phone, they're going to lock out as many opportunities for idiots to do things.

[RejZoR]

44 minutes ago, captain_to_fire said:

Yes, but the point I made is that of all the antivirus programs as far as I know, Microsoft is the only one who made an effort to reduce the chances of being exploited by placing it in an sandbox since 2018 though it is not turned on by default. Perhaps nowadays other vendors followed their example. ¯\_(ツ)_/¯

Yeas, because anyone has time to sit and comb through some 500 million avast! users chasing their PUBLIC Twitter account. Ever thought they could do that anyway by just... visiting your account? If someone targets you that hard, they'd be doing that either way. Not to mention if you disabled data sharing in Privacy settings that were there since avast! 5.x from I don't know 2010, you weren't even affected by any of this. But hey, you do you.

[suicidalfranco]

> Act smug about how mac can't get viruses

> do nothing in terms of security cause can't get viruses

> years passes, marketshare rises

> malware start popping up

> device weak solutions to mitigate

> surprised pikachu on the status of macos malware

[WolframaticAlpha]

18 hours ago, Ashley MLP Fangirl said:

i understand Craig's point perfectly. his point was that if you allow software installs from a number of places compared to jsut the app store like iOS, you get a much higher chance of malware. these are simple facts, i don't understand why you are confused about it @WolframaticAlpha

 

you can actually enable an "ios" mode on macOS kinda. this button is in the settings: 

and if you only allow from app store, then the OS will refuse to execute any app that wasn't installed from there. however since the Mac App Store is kinda like Windows's store at the moment in that it doesn't have a lot of common software people install, almost nobody uses this feature. however, if you want more security, it is available in macOS. 

I had mixed feelings. I was not confused. And unlike windows, a lot of the software can be installed from the mac app store. It is quite better than windows.

[WolframaticAlpha]

5 hours ago, GDRRiley said:

why should dev mode void it? if you needed an apple dev account attached that should be enough
if anything apple needs to be punished for their treatment of their "warranty " and repairing their devices, not have more ways to remove it

 

 

 

 

Since you are doing stupid stuff on your iphone in dev mode, having your apple store fool of people who accidentally bricked their phones might be painful

[Ashleyyyy]

8 minutes ago, WolframaticAlpha said:

I had mixed feelings. I was not confused. And unlike windows, a lot of the software can be installed from the mac app store. It is quite better than windows.

i'm a fulltime Mac user, i know. but still like 90% of the software i use can't be installed from the App Store...