nCity Security

OSX Login Accounts and FileVault Security:
: System Preferences -> Accounts pane is where you setup and password-protect each user account (admin is default for single user). Setup of a second administration account is recommended, even on single-user machines, rationale being that the ability to login thru a second account may allow access to a damaged primary account. Establishing a root account might be a good idea, too, but is not required.


The Accounts pane also provides access to FileVault under its Security button:

: FileVault uses 128-bit encryption to encode all contents of each user's Home Folder. This protects sensitive files by requiring encryption key, preventing unauthorized access even if computer is lost or stolen. Password login may be also be required on startup, to open specified files, and after a preset period of inactivity (unattended machine).

Virus Protection:: Pre-OSX viruses were quite rare, especially when compared to the tens of thousands of viruses, worms, Trojan horses, spyware, adware, and macro viruses still targeting the frail DOS/Windows/XP operating systems. But, just because you use a Mac, that doesn't mean you can ignore the risk entirely. We've serviced many System 7 thru OS9 machines that fell victim to the Autostart 9805 worm, Sevendust, even the ancient nVir virus, one of the first-ever Mac viruses (so old, in fact, the only file it could still infect was Internet Explorer).
: There are many ways to minimize your exposure, but nothing beats a quality anti-virus program for providing peace of mind. Norton Anti-Virus (NAV) from Symantec is the best choice. Every anti-virus utility requires monthly updates, but NAV makes it simple and Symantec is _the_ authority on viruses and security. If a real OSX virus ever appears, you can be sure Symantec will be right behind Apple with a response. (Links to Symantec are posted below and on our Links page.)
: OSX viruses are virtually nonexistent today. Early OSX vulnerabilities included a pair of "proof of concept" demonstrations quickly addressed by Apple, including a self-starting Dashboard "widget" under Tiger that now requires permission to activate. Other potential vulnerabilities have been identified and eliminated by Apple with security updates before any problem could occur. UNIX was designed with security at its core - to the great benefit of the Mac platform - but Mac users may still be capable of spreading Windows viruses without being affected. Macro viruses affecting MS applications (Word, Excel, Office apps, IE, OE, etc.) are the single largest virus category (more below), and specific MS applications run on a Mac might still be vulnerable.
: NOTE: Running Windows on a Mac (using BootCamp, Parallel, or similar formatting utility) does _not_ mean the Microsoft partition is protected in any way. DOS/Windows/XP is just as vulnerable on a Mac as it is on a PC.
: In addition to the very real threat posed by real viruses, there are also a lot of hoaxes going around via email, and it helps to know what is - and what is not - a virus.....

What is a virus?: The primary characteristic of any virus is its ability to copy itself to every writable volume it comes in contact with. This includes hard disks, floppies, Zip disks, tape, you name it. Even read-only CDs and DVDs can have viruses prerecorded on them. (A popular magazine once distributed thousands of CDs before discovering they were infected with the Autostart 9805 worm; fortunately, it turned out to be a harmless variant incapable of doing any real damage - except to the magazine's reputation.) All it takes is to mount a volume, insert a disk, or open an email attachment. Viruses are malicious by design. They might masquerade as a legitimate file or be invisible, and you probably won't know you have one until it's too late and damage has been done. Here are a few virus subcategories you may have heard of:

The Worm. Almost always destructive, a worm tunnels through targeted or random data, destroying code as it goes. Invented in 1978 by researchers at Xerox PARC, the worm was originally defined as, " ...a computer program that searches out other computer hosts, then copies itself and self-destructs after a programmed interval." Needless to say, there aren't as many harmless variants (so defined) as there are destructive ones.
The Trojan Horse (like the legend) secretly tags along with another file. This type might wait quietly to be triggered by some action, event or date before doing whatever it was designed to do. Some merely put up a message or image onscreen when triggered, and might self-delete when finished. Others may only interfere with specific functions, or they may cause total destruction depending on designer's intent.
The Macro Virus. "Macros" are a function of certain commercial programs, mostly (if not all) Microsoft products. A macro is - or at least, was - a great convenience in these programs, allowing you to record a series of actions that may then be played back to perform those same actions automatically. Naturally, one can also create a macro that does damage, and that's what a macro virus is. It relies on the presence of a particular application program to function, like Word or Excel, and uses the program to do its damage. There are tens of thousands of these, they are application-specific and cross-platform.
Key Loggers, Spyware, Adware. These small programs are surreptitiously deposited on your computer by email attachment, by clicking an internet link, or they may be attached to other programs. These are designed to track and report keystrokes, take screen shots, and/or monitor communications and activity. The objective may be to steal passwords and account access, target advertising at you, or they may be programs manually installed by someone close-by with the intent of spying on computer usage.
Zombies. This term refers to computers commandeered for use in orchestrated attacks, usually against a targeted web site (known as a denial of service attack), or they may be used to propagate spam. While not technically a virus, unattended zombie machines have become a considerable factor in the spread of all sorts of malicious nonsense.

General signs and symptoms of virus infection:: Processing speed slows down over a relatively short period of time; frequent freezes and errors; background activity tying up the CPU; disappearing storage space for no apparent reason; odd messages or weird screens; generic icons; files that suddenly refuse to open or are unrecognized. There are almost as many symptoms as there are viruses.....

What a virus isn't:: For those dimwits out there who aren't bright enough to write a real virus - or even a macro virus - there's always the hoax. Typically delivered by email, here's an example that was widespread in 2001 and resurfaced again (almost word-for-word) in 2004. Aimed at PCs, it was titled "Virus Alert!":
My address book was infected with a virus. Yours might be too. The virus is called jdbgmgr.exe To check if yours is, follow these directions and it will take care of it. It cannot be detected by anti-virus programs. It sits quietly for 14 days before damaging the system. It is sent automatically by messenger and address book, whether or not you send e-mails. This is something I had no control over because I received it by being in someone else's address book. The good news is that it is easy to get rid of. Here's how:: It goes on with step-by-step instructions for searching your "C drive" to hunt down this ".exe file" and delete it - which, of course, is how the damage is done - you do it yourself. These hoaxes usually encourage you to forward them to everyone you know, or they may use contacts from your address book to spread themselves as real viruses often do. This particular hoax is still making the rounds in a variety of email messages, targeting the same "jdbgmgr.exe" PC file.
: Some hoaxes can be quite convincing. Usually, parsing message headers and investigating the named virus will expose a hoax, but for pre-OSX machines (and all Windows PCs) an up-to-date virus scan is the only solution. To investigate a virus or hoax, enter its name into Symantec's virus database or CIAC HoaxBusters, U.S. Dept. of Energy.

Why are Koreans scanning my ports?: If you've spent any time connected to the internet without a firewall, you've probably been 'probed' many times without your knowledge. Open ports are an invitation to crackers and thieves. Protection options include hardware routers, software firewalls, or both. Routers redirect data to a different IP (Internet Protocol) address, making your computer more-or-less invisible behind it. Software firewalls can intercept and stop port scans and various types of attack, with the additional benefit of telling you when it happens and where it's coming from.
Reducing exposure and increasing Security:

Use a Macintosh running OSX.
Avoid all Microsoft programs. Macro viruses in overwhelming numbers are cross-platform and (more-or-less) unique to Microsoft; avoiding MS apps will greatly reduce your risk by eliminating macros altogether. (No controversy here: It's a matter of fact, not a matter of opinion. Tens of thousands of cross-platform macro viruses exist, all targeting MS apps.)
You've probably heard it a thousand times: "Don't open email attachments!" If you use a Mac, you have little to fear from attachments, but Windows attachments may still infect PCs if forwarded from a Mac.
Do not use links in emails. Email headers and addresses are easily forged (a practice known as "spoofing"), so be aware that the "from" address on an email is not to be trusted. Links in emails (known as "phishing" links) can lead to serious trouble, account and identity theft. If you must follow up an email, type the real address into your browser or use a bookmark instead of clicking any links.
Don't share disks. If the only disks you load into your drives are well known commercial products, or disks you have formatted yourself, you'll reduce your exposure from this type of transmission to zero. (There have been cases of commercial disks having viruses hidden in them, but these are _extremely_ rare.)
Disable unused services (telnet, FTP) and web-related utilities that may provide an opening. Turn off QuickTime's AutoPlay options (OS9 QuickTime control panel) to block out variants A-F of the Autostart 9805 worm.
Install System and security updates as they become available (use Software Update under Apple menu, also available in your System Preferences).
Use a firewall. If you have an analog (56K) modem, there are software firewalls available that do an outstanding job. If your connection is digital (DSL, cable, satellite, LAN), your Mac is always online and a firewall-equipped router is highly recommended.
Using login password protection and Apple's Keychain will keep unauthorized people out of your machine and away from sensitive files. Encryption options are also available, for use in emails and for encrypting files on your hard drive.
Limit unauthorized access to the Terminal. Create a guest login account with limited privileges (well below admin status).

Test your security online:: Symantec has a great web site for investigating real viruses, hoaxes and various threats, plus an online utility for testing your system's vulnerability: Symantec Security Response.

Check machine's recent history:

This info is provided for parents and others who may be concerned about a machine's use and recent history, including internet usage.

Recent Items menu:

Found under the Apple menu, Recent Items can be used to record and review the most recently used applications and documents (default = 10 each).

"Clear Menu" item at bottom erases this list.

Check System logs.

The Apple menu's "About This Mac" pane has a "More Info" button leading to System Profile. Near the bottom of System Profile's list of options are a group of log files, including system logs, app logs and error logs. (The terminal window is a good place to look around, too, if familiar with UNIX.)

Recent items (OSX) under Apple menu.

Sherlock, Sherlock2 (OS9):

Search for files by date created and/or date modified to produce a list of all files used during a given time span. Open Sherlock, select your hard drive in the top of Sherlock's window, and use the popup menu marked "Custom..." The "Edit..." button next to this menu produces a complete array of search options.

Find (File menu, OSX):

Sporting an exhaustive list of search options, Find can be used to search any and all volumes, folders and files by an impressive assortment of criteria.

Checking modified files in Sherlock
The Find window:

: Select area to search in top half of Find window. Plus (+) and minus (-) buttons in lower half of window add/remove search criteria. Here, Find is set up to locate files created and modified today (today's date), including invisible files. (NOTE: Invisible files are created by the OS, many utility programs, browsers and other apps. They number in the hundreds, are no cause for alarm, and are best left alone.)

Browser Cache:: Unfortunately, examining cache files in OSX is a little more difficult than it was under OS9 and earlier Systems where cache files were neatly stored and readily accessible.

: Browsers can be examined in detail using browser, location and session histories (as set in browser preferences). Browsers also create temporary cache files that can be examined individually, but there may be hundreds of these and they are only bits and pieces of recently visited web pages. The Safari menu includes an "Empty Cache..." command to delete these internet cache files.

Privacy Note:: Even if all of the above settings have been cleared and cache files deleted, the data remains until overwritten and may still be retrieved using costly processes beyond the scope of this discussion. Privacy concerns prevent nCity from engaging in such activities unless attempted under proper authority of law enforcement and/or court order.

nCity Home..........Solutions...........Technical..........Services...........Courses...........Links..........nCity Forum