Mac security question

Question

Hey all, I am a very security-minded person and have this question. The most critical function that malware needs to accomplish is to make itself automatically start up every time you boot. This is the act of "infecting" your computer. Because if it stops running and just sits on your hard drive like a bump on a log after you reboot, then it is a pretty lame bit of malware. In Windows, at least up to XP (I don't know much about Vista/7) a very easy and convenient way for malware to accomplish this task is by creating a registry entry to start it up at reboot. The registry is a great place for this, because it is soooo frickin' huge and difficult to understand that it is easy for a virus to hide an entry in there. The way to circumvent this in windows is to run only with a non-administrative account, which takes away privileges to write into the registry. Now, on to the Mac part of my question. As far as I can tell, there are at least two ways to make a program automatically start at boot. You can right click on the program on your dock, and select "start at login" or something like that. Another way is to go to your system preferences and select the programs to restart at boot. My question is this: is there a system file somewhere that reflects these actions, which take place graphically? And can you prevent this file from being modified? My thinking is that there has to be a file somewhere, and if a virus wanted to infect your Mac, all it needs to do is modify this file. I would like to inspect these file(s) and make sure there's nothing that is auto-starting that shouldn't be there. I also have a related question. Are only programs from your Applications folder allowed to auto-start? This would be a good security measure, because you need admin privilege to put a program in the Applications folder. And as a side note: there is one thing that Mac does wrong, following Microsoft Windows' bad example. After you install the OS, the default account has administrative privilege! Most people probably don't know/don't care enough to create a non-admin account for daily use, therefore making themselves vulnerable just like the Windows users who run in admin mode. It is because of this that I believe Macs are just as vulnerable as Windows machines, and Macs are just not targeted because virus writers are too lazy to go after the last 10% of existing computers. I am trying to close this hole on my own machines by running only in non-admin mode, but i would like to understand the auto-start mechanism to confirm that I am safe.

Answer 1

cubicle slave wrote:
Hey all, I am a very security-minded person and have this question. The most critical function that malware needs to accomplish is to make itself automatically start up every time you boot. This is the act of "infecting" your computer. Because if it stops running and just sits on your hard drive like a bump on a log after you reboot, then it is a pretty lame bit of malware. In Windows, at least up to XP (I don't know much about Vista/7) a very easy and convenient way for malware to accomplish this task is by creating a registry entry to start it up at reboot. The registry is a great place for this, because it is soooo frickin' huge and difficult to understand that it is easy for a virus to hide an entry in there. The way to circumvent this in windows is to run only with a non-administrative account, which takes away privileges to write into the registry.
Not really. Windows has such a lax security model that malware can easily get the privileges it needs to install and run - even if you can't.
Now, on to the Mac part of my question. As far as I can tell, there are at least two ways to make a program automatically start at boot. You can right click on the program on your dock, and select "start at login" or something like that. Another way is to go to your system preferences and select the programs to restart at boot.
There are a number of ways to start programs at boot. Except for user account login items, these methods are not accessible from System Preferences. You need to know your way around the Terminal to find them.
My question is this: is there a system file somewhere that reflects these actions, which take place graphically?
They are:
~/Library/LaunchAgents
/Library/LaunchAgents
/Library/LaunchDaemons
/Library/StartupItems
/System/Library/LaunchAgents
/System/Library/LaunchDaemons
/System/Library/StartupItems
I don't know of any graphical interface to them.
And can you prevent this file from being modified?
Only the root user can modify the most of those directories. You can modify your own ~/Library/LaunchAgents and System Preferences > Accounts > your account > Login Items. Of course, any time you give your admin password to some installer program, you are giving that installer program root privileges.
My thinking is that there has to be a file somewhere, and if a virus wanted to infect your Mac, all it needs to do is modify this file. I would like to inspect these file(s) and make sure there's nothing that is auto-starting that shouldn't be there.
That is true, but there are no Mac viruses that can do that. There are a couple of Trojan Horses that ask for your admin password and will do malicious things in those directories if you give them your admin password. Also, those directories are pretty obscure. You have to be pretty savvy with software to be able to tell who installed what.
I also have a related question. Are only programs from your Applications folder allowed to auto-start?
No. Any program can be run at startup. Most startup programs are not in the Applications folder.
And as a side note: there is one thing that Mac does wrong, following Microsoft Windows' bad example. After you install the OS, the default account has administrative privilege! Most people probably don't know/don't care enough to create a non-admin account for daily use, therefore making themselves vulnerable just like the Windows users who run in admin mode.
This is true.
It is because of this that I believe Macs are just as vulnerable as Windows machines, and Macs are just not targeted because virus writers are too lazy to go after the last 10% of existing computers.
It is more complicated than that. There are trojans on both platforms that will ask for your admin password so they can do nasty things. The difference is that a well-written Window virus doesn't need to ask for your admin password. Those viruses have more privileges than even the admin user does. The Mac has a tighter security model and no virus has yet found a way around it. There are plenty of people trying, but they just want bragging rights. It isn't really laziness per se. It isn't a good return on investment. Macs are so much more difficult to crack that true virus writers usually don't bother, only people who want publicity.
I am trying to close this hole on my own machines by running only in non-admin mode, but i would like to understand the auto-start mechanism to confirm that I am safe.
You are already in the top 10% of safe users on the top 10% of safe computers. You're fine.