Is MacOS susceptible to ransomware attacks? On a recent episode both David and Stephen said they do not run antivirus software. Sophos, a macOS antivirus software claims it can prevent ransomware attacks.
Thoughts?
Theoretically itās possible.
Practically itās unlikely.
3 Likes
Never ran an antivirus on either macOS or Windows for the last 15 years. Computers do not viruses from the air. They are as clean as their inputs.
Itās possible if a user with admin rights installs software and overrides all the warnings and safety measures Apple put in place.
Or a person with admin rights who doesnāt update their software. Most ransomware spreads using vulnerabilities in operating systems (usually in Windows but it could be possible in theory on Macs)
Iāve seen it at work. Some ransomeware is cross platform and relys on nothing more than a person running something by mistake, thinking theyāre opening an attachment or some such thing, no admin rights necessary.
2 Likes
The following Macworld page on Can Macs get ransomware and how to stop a ransomware attack seems to offer a clear overview.
1 Like
Iāve never run antivirus on any Mac Iāve owned. Antivirus causes more problems than it solves.
Itās definitely possible, but not something I lose sleep over, as I take precautions.
I run Malwarebytes on my two machines, and Malwarebytes and Sophos on my girlfriendās laptop, as she seems more susceptible to malware, etc. (I had performance issues with Sophos on mine.)
I also periodically run a scan for Malware with CleanMyMac.
I also keep a backlog of backups, in the event my data were encrypted without my knowledge.
So I think it boils down to:
- What can you afford to lose?
- Business records?
- Research data?
- Family photos?
- Candy Crush high scores?
- How exposed are you?
- Do you have 3-2-1 backups?
- Are you connected to the internet?
- How easily fooled are you into installing āsystem scanā software, etc.?
There are probably other factors Iām not thinking of at the moment.
1 Like
Malwarebytes is good but only works for web browser attacks.
Sophos finds and blocks malicious code. Finds it in email attachments, downloads, external storage the second you connect it etc etc.
Agreed.
Good article. Thanks for the pointer.
1 Like
I keep most of my data in the cloud. Does this offer any protection against these sorts of ransomware attacks? Can they lock out my data in DropBox, iCloud or my workās MS One Drive thing?
You couldnāt be more wrongā¦ Thatās just not how the program works. What purpose would that serve?
I am not going to argue about that. Figure it out yourself.
Um. what? No. MalwareBytes has a real-time scanner that will check files that come in from whatever manner. However, thatās only available in the paid version.
(I also donāt run MalwareBytes real-time scanner because I found the CPU impact way too high and the actual threats way too low.)
āRansomWhereā
I keep meaning to recommend the oddly-named RansomWhere which is a free program from Patrick Wardle.
RansomWhere tries to detect ransomware-like activity automatically without looking for a specific piece of malware. Quoting its product page:
Letās try to generically thwart OS X ransomware via math!
By continually monitoring the file-system for the creation of encrypted files by suspicious processes, RansomWhere? aims to protect your personal files, generically stopping ransomware in its tracks.
I have run this before, and there are some false-positives, but it pops up a warning which allows you to continue as long as you know that the activity is safe.
The benefit of this approach is that it can potentially catch new ransomware malware before itās discovered anywhere else.
I also did not notice any time of system-slowdown by using RansomWhere.
1 Like
Cloud data isnāt protected if itās synced locally.
Letās say you have iCloud Drive data. Ransomware hits your computer, and encrypts everything. Your iCloud data now helpfully syncs with the iCloud server, and the iCloud server now has encrypted data.
The only real saving grace would be if your data was large enough that the sync couldnāt complete, or if the ransomware locked your computer before the sync happened.
If your cloud provider offered versioning you could probably do a rollback, but it would likely be much more hassle than being able to restore from a local backup of some sort.
1 Like
Okay. Iām no āexpertā but I know a little bit. So youāre saying an EDR thatās being deployed at major enterprises, schools, hospitals etc. only protects against one threat vector? Do you know how EDRās work?
So how does Sophos āfindā malicious code? Hereās a hint; neither Malwarebytes or Sophos āfindsā any code. Generally speaking they analyze file metadata against known malware and look for āindicators of compromiseā. If they find an indicator they associate it back to the file and then block the malicious file from running.
Iām not going to argue with you. Youāve showed your hand by posting affiliate links and trying to justify it because youāre giving āfree adviceā; ā your words. No affiliate link this time, but it didnāt stop you from piping up and making a baseless claim. Be well āexpertāā¦
Hey @tjluoma,
I have a friend who has his whole business data on Dropbox, tens of years of designs and graphic files, and he asked me what the latest of protection from ransomware in the Mac world. Because, of course, as a designer, his shop is mostly Mac-based.
Have you been running RansomWhere lately, on newer version of the OS and Apple Silicon?
The latest release from Patrick Wardle is dated 06/11/2018 and I am always a little worried of running code which is 3 1/2 years old on my M1-powered MacBook Air.
For the job I do, I run SentinelOneās EDR, but itās an enterprise product, and not one suitable for home use, or for small/medium businesses.
Many thanks for any suggestion on this topic!
Bye, Luca
Regardless of the malware questions/issues, Iād recommend you ask your friend āwhyā their whole business data is on Dropbox. What problem are they fixing? Collaboration? Business Backup? Disaster Recovery?
If the latter two it would be good to think again as Dropbox doesnāt really help, and probably hinders, esp. if data their exclusively (which I hope not ā¦ just noticing).