Sophos grabbed headlines last week when it declared that one in five Macs was subject to malware. So I decided to download the software and give it a try myself to see what it could come up with. I was one of the 20 percent. But there’s a catch, so read on.
As a matter of historical fact, Macs have been less likely to get infected by malware than their Windows cousins. Macs remain more secure than Windows to this day. That’s not to say that there are no malware threats on the Mac – indeed there are. But they happen infrequently enough to be the exception to the rule.
Still, that doesn’t mean that Macs don’t get exposed. In fact, if you get any reasonable amount of spam in your inbox, chances are that malware has entered your Mac’s gravitational pull like a rogue asteroid bound for the inner solar system. That’s because malware is a matter of fact in spam – if it’s not a phishing attempt to scam you out of your bank account information, the rogue e-mail often contains a payload – an attachment you’re encouraged to open. If you’re a Windows user.
But along the way, filtering algorithms used by mail software do an increasingly effective job making sure you never see these e-mails. I see spam and junk only rarely with my primary e-mail addresses.
So where was the Sophos software finding these malignant tumors in my e-mail circulatory system? Gmail, specifically. In the junk bucket.
I ended up uninstalling Sophos. I found the whole process too disruptive, from the installation to the initial scan to the constant maintenance activity. Quite frankly, the payoff wasn’t worth the effort – it was just to verify that the system I have in place is working.
I don’t need to be warned every time I get a malware payload in the junk folder of one of my mail accounts. I am already using effective enough tools (in the form of junk filtering on both client and server) to rid myself of that threat.
If the malware threat to the Mac develops, it’ll be time to rethink this strategy.
One other thing: If I was a corporate citizen in a heterogeneous computing environment, this story would have ended very differently. In fact, under those circumstances, I’d be crazy not to have some sort of anti-malware filtering in place.
I’m not entirely convinced about the corporate citizen argument either. Why would the existence of your machine in a group of Windows machines, all most likely with anti-malware installed, increase the likelihood of those machines becoming infected with Windows viruses? I did ask Sophos (informally, on Twitter) what proportion of the Windows malware code they found on Macs was capable of self-executing if merely copied to a Windows system, but they didn’t answer.
I’d hope your Mac would be part of some kind of comprehensive data management ecosystem, at the very least. Whether that means installing something locally or not, the Mac can still benefit from layers of protection on the server end.
there are two issues in corporate:
1) Regulations and interpretations of said regulations that say “Thou Shalt”. It is FAR easier to just shut up and shalt than try to justify a large exemption for a lower probability of malware. Really.
2) if you do have to deal with things like Word and Acrobat, you are, not may, but are going to, at some point, get infected files from clients, partners, vendors, etc. Pointing fingers feels good, but doesn’t de-fuck your setup when that happens. A decent anti-malware setup, (Sophos is my choice here) makes that much simpler. You can’t simply order the rest of the world to provide your herd immunity, it really doesn’t work that way.
for home use on a mac, the answer gets a bit fuzzy based on a number of factors. For corporate use, it actually makes a lot of sense.
Also, the whole “it’s not REAL malware” stuff. “No true Scotsman” is idiotic no matter where it’s brought up. If you need word to get your work done, and Word’s not working because you have a macro virus hosing up your day, the fact it’s not self-replicating or a “real” virus is of precisely zero value, help, or consolation. Twee propellerhead arguments about defining “real” malware so narrowly that nothing actually qualifies is a distraction from the real world and many, many people wish geeks would knock that shit off, it’s causing harm.
I agree with this. If the malware was designed for Windows, I would be VERY surprised if it was able to execute on a Mac. The only “good citizen” argument that I believe holds merit is if you got an email with malware, and the email was interesting enough that you forward it to your friends who have Windows systems. Some malware messages have pretty clever systems for tricking you into clicking on its links, but I’ve never seen one that would trick me into manually forwarding it to friends.
So, I guess I don’t know of any valid argument for needing anti-virus software on the Mac to do anything other than protect your own machine.
I too tried Sophos. It found over 30 threats on my Mac: in the Junk folder. All were Windows executables, so harmless to me. Nevertheless, I attempted to ‘heal’ the threats. Sophos crashed. When it relaunched, I tried healing just one of the threats. Sophos crashed.
Within 24 hours my Mac had frozen. It happened during the night when my Mac was idle. That hadn’t happened in years. Totally frozen, except for the mouse cursor. Couldn’t even force quit. Only a hard reset worked.
That happened a few more times over the next several days.
I uninstalled Sophos. My Mac has been fine ever since.
but you don’t want to be a carrier… just because you’re immune to the disease, doesn’t mean you can’t pass it on.
So if these malicious email attachments are all targeting Windows, and OSX is getting nailed for simply having them in a spam directory. Sophos, for its part, is trying to convince the world that OSX is “infected” or is, at the very least a “carrier” since it’s possible to forward these emails to others (presumably running windows).
Isn’t the same true for any device capable of running an email client? I can forward the same infected or malicious message from an Android or an iPhone or Blackberry. Ignoring a Windows emulator like Wine, in no (demonstrated) case will the attached executable infected or compromise the underlying non-Windows system. In other words every device capable of sending/receiving/fowarding email becomes a carrier. Do we now need antivirus chewing up cycles on our phones now too?
Again, I would hope your information infrastructure includes some front-line support to keep this from being a problem, like effective e-mail filtering.
Sophos is so freaking slow that I can’t do a complete scan on my Mac Pro (with 16 gigs of RAM) in a week! If they were competent, they would make the software work fast in the background.
The only thing it ever found was an old, old, application that I was using in the mid-90s called slideshow.exe that I used to put on CDs with my digital portfolio when I was applying for jobs at newspapers. I forgot that old application was even still in my folder holding that old portfolio.
So, it’s dog slow, and the only thing it ever found on my hard drive wasn’t even a dangerous file. It did stop one application embedded in a web page from doing something on my computer one time. So it’s not totally worthless, but there must be something out there faster and more useful!
Yes. It´s called “life”…. I think,,,
I’ve been running Sophos on my iMac for over a year and never had any of the problems you experienced. It took a while for the first scan to run through a couple of million files but after that the on access scans has operated silently in the background.
I’ve found ClamXav to be a nice un-intrusive and free AV for the Mac. It has a checkbox to allow you to toogle mail scanning on and off. For exactly the reason you explained, I work with that turned off, and I’ve found that there is no daily maintenance work with ClamXav. I have it set to auto-update definitions once a day, and to run the Sentry on my home dir. I watch it’s little icon wiggle a bit every time I save or alter a file, but that’s really my only awareness that it’s doing anything.
Sophos usually runs unintrusively for us, and only occasionally freezes during an update.
Once in awhile it finds a threat within an email, usually attached to a foolish joke forwarded by older Windows users like my father-in-law.
The biggest response it ever turned up was within several years-old DEVONthink Pro archives on my wife’s computer.
+1 This was exactly my experience with Sophos for Mac.