News for hackers. Stuff that matters.
Re:macOS Kernel Extensions are officially deprecated by smcleod on Wednesday February 05, 2020 @05:04PM (#22251433)
I really hope that this is the final nail in the coffin for third party Anti Virus vendors.

It's been really worrying to see large enterprises that have moved from Windows to macOS and carry their thinking that the need to install a third party AV product (which in turn often acts as a near-unrestricted way into the kernel).

Re:macOS Kernel Extensions are officially deprecated by highlandinfo on Wednesday February 05, 2020 @05:32PM (#22251645)
Not sure how you'll feel about the EndpointSecurity user-space framework, specifically designed to provide replacement functionality for anti-malware vendors (https://developer.apple.com/documentation/endpointsecurity)...
Re:macOS Kernel Extensions are officially deprecated by floatingatoll on Wednesday February 05, 2020 @06:16PM (#22251894)
That sounds a lot less fragile than patching the kernel directly.
Re:macOS Kernel Extensions are officially deprecated by anaisbetts on Wednesday February 05, 2020 @06:40PM (#22252048)
Sending every I/O operation through userspace and back again is going to be _glacially_ slow, good luck macOS
Re:macOS Kernel Extensions are officially deprecated by duskwuff on Thursday February 06, 2020 @01:26AM (#22253871)
A lot of existing antivirus software was already doing that -- and yes, it was glacially slow. But at least doing this through a first-party interface means it probably won't block the rest of the system quite as badly.
Re:macOS Kernel Extensions are officially deprecated by 0az on Wednesday February 05, 2020 @05:11PM (#22251472)
I can't wait until I can uninstall University-mandated AV. I'm still waiting for Jumpshot to respond to my CCPA inquiry.
Re:macOS Kernel Extensions are officially deprecated by jedieaston on Wednesday February 05, 2020 @05:27PM (#22251601)
You don't have to worry about that anymore...

https://www.jumpshot.com/

Re:macOS Kernel Extensions are officially deprecated by yjftsjthsd-h on Thursday February 06, 2020 @12:50AM (#22253720)
That is ironically one of the nicest, cleanest, most to-the-point pages I've ever seen on the web. ...I'm not sure what to do with this.
Re:macOS Kernel Extensions are officially deprecated by kyleee on Thursday February 06, 2020 @01:41AM (#22253935)
What was jumpshot?
Re:macOS Kernel Extensions are officially deprecated by r00fus on Wednesday February 05, 2020 @05:06PM (#22251442)
Does this also doom the corporate spyware that's in almost every large enterprise Mac deployment, or does that install without KE?
Re:macOS Kernel Extensions are officially deprecated by jedieaston on Wednesday February 05, 2020 @05:28PM (#22251612)
Define "spyware".

JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.

Re:macOS Kernel Extensions are officially deprecated by floatingatoll on Wednesday February 05, 2020 @06:27PM (#22251961)
JAMF additionally permits the provisioning server to run arbitrary scripts on the endpoints, using an installed daemon that implements functionality beyond what MDM offers.
Re:macOS Kernel Extensions are officially deprecated by yoz-y on Wednesday February 05, 2020 @05:29PM (#22251617)
What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?
Re:macOS Kernel Extensions are officially deprecated by self_awareness on Thursday February 06, 2020 @12:29AM (#22253640)
So what's the alternative for third party AV vendors? Do you have any suggestion for my parents?
Re:macOS Kernel Extensions are officially deprecated by yjftsjthsd-h on Thursday February 06, 2020 @12:52AM (#22253730)
> So what's the alternative for third party AV vendors

Probably, "die." I'm not sure we'll miss them; that whole market is sketchy, and more obsolete every year as the OS gets more secure on its own.

Re:macOS Kernel Extensions are officially deprecated by self_awareness on Thursday February 06, 2020 @06:51AM (#22255332)
How does that answer my question?

I would like to know what is the alternative today, not 10 years from now.

Re:macOS Kernel Extensions are officially deprecated by yjftsjthsd-h on Thursday February 06, 2020 @01:47PM (#22258927)
In seriousness: Why do you need a third party AV today?
Re:macOS Kernel Extensions are officially deprecated by self_awareness on Friday February 07, 2020 @12:38AM (#22263503)
Several reasons.

1. My parents lost money in the Internet. They treat scam messages ("you've been hacked, we have discriminating stuff against you, give us bitcoins and we don't tell anyone") seriously. They wanted to buy some wonder drug that didn't even exist. Now they contact me in every case that involves money on the Internet, and since several years there were a few other cases where I had to say "don't do it, this is a scam". So I'm effectively performing the role of a human thirdparty AV.

2. My girlfriend has been hit with a clickjacking compaign. She was crushed; I want to lessen the chance of this happening ever again. I've also educated her about it and how it works, so she will probably not do it anymore, but in the scale of whole humanity, the "let's teach them how to defend" is not a good strategy for trying to eliminate some harmful event, there will always be people that will resist learning.

3. I want to help with limiting spreading malware. If I'm using AV, this means that I influence the environment I live in so that everyone sees lower malware spread. This means people like you can wonder what is the point in AV tools, since you probably don't know even 1 person that had been hit with malware attack. Similar to vaccines I guess.

Re:macOS Kernel Extensions are officially deprecated by smcleod on Thursday February 06, 2020 @01:08AM (#22253790)
You shouldn’t be installing third party antivirus on macOS (or BSD/Linux for that matter), they are little more than another path the kernel and root user space. MacOS has its own built in malware / virus protection.
Re:macOS Kernel Extensions are officially deprecated by self_awareness on Thursday February 06, 2020 @07:00AM (#22255375)
What should I say to my parents when they enter a website that advertises some kind of diabetes wonder drug and they download some crap and try to run it? That they shouldn't install AV because it potentially opens an attack vector? Do you think they will know what it means?

Also, do you mean XProtect? https://eforensicsmag.com/72717-2/