Doug Lhotka

Technical Storyteller

Opinions and commentary are mine, and do not reflect those of my employer.

(C) Copyright 2019-2023
Doug Lhotka.
All Rights Reserved.
Use of text, images, or other content on this website in generative AI or other machine learning is prohibited.

Rotten Apples: Mac Anti-malware

By

(c) Depositphotos / eggheadphoto

Macs get Malware.  There, let the flames begin.  There’s still an impression that Macs are somehow immune and you don’t need any sort of protection.  While it’s true that viruses are very rare, malware (i.e. anything I don’t want running on my system) is quite common.  So what’s the state of Mac Antimalware these days?

Back when I ran windows, buying antimalware software was a no-brainer.  But the mac has been different – there’s far less malware, the OS is harder to infect (though Windows 10 closed a lot of the gap), and Apple does a decent job with XProtect of killing the truly malicious software that’s been discovered.  If you remove Java and Flash (you should) and stay off the seedy side of the Internet, your risk of infection is pretty low.

Yet in the past month, I’ve removed malware from two of my friends’ macs.  One was a bit out of date (and had several infections) but the other was current and fully patched.  In both cases it was a form of adware – something that monitored all internet traffic, phoned home, and inserted ads on web pages.  At least one appears to have been installed from a malicious phishing link, but the others infection path wasn’t clear.  After removing it, they both asked me about installing antimalware software, and that’s a challenge.

Over the past year I’ve been searching for a solution that would provide key features:

  • Antiphishing (privacy friendly URL filter)
  • Antimalware (including adware)
  • Stable
  • Low overhead
  • Proactive updates before Apple updates break things with new releases
  • Priced based on the risk (i.e. lower than Windows – but don’t expect free)
  • No spyware/adware/etc

Unfortunately, in my search, I’ve yet to find a package that does it all.  I looked at nearly every vendor, including Norton, Kaspersky, Bitdefender, Intego, Trend Micro, Sophos, ESET and Malwarebytes among others.

None of them provided privacy-friendly anti-phishing.  All did a pretty good job at antimalware, but only some covered adware.  Most caused stability and performance impacts that weren’t acceptable.  Some were good at being current, others were really bad.  The best were overpriced for the risk, and a number of free ones had things that made me wonder about privacy.  There were a couple I didn’t even look at let alone install (not listed above), as they are nearly malicious in their own right and require nuking the machine from orbit to remove.

In the end, I picked an updated version of my old standby – and the one I used to remove the adware: Malwarebytes.  They’ve recently added real-time protection/prevention capabilities, which is a big boost.  On the mac, I think it’s moderately overpriced versus the risk and functionality, but not grossly so.   A privacy friendly URL filter remains a wish-list item.  For the threat that I see, which is primarily adware, it’s the most optimal overall solution for personal or small business use.

1Password Revisited

By

(c) Depositphotos / @ kjpargeter

A few months ago, AgileBits, the makers of 1Password, made some changes to their licensing model, which created a lot of confusion and concern.  I wrote about those here: https://douglhotka.com/2017/07/12/1password-and-the-loss-of-local-sync/ and took 1Password off my recommended list.  Since then I’ve collected new information, and re-evaluated things.  Short answer, it’s back on the list, with a caveat.  Read on for details.

First, as I said back then, I’m not addressing the subscription licensing change.  That’s the wave of the future, and we all need to get used to renting software.   My employer is moving that direction, Adobe and Microsoft are already there.  While subscription licensing and cloud services need not be related, a company has to look at their customer base and make business decisions on where to invest limited resources – a small firm like AgileBits has to focus their spend.  So let me walk through the current options in 1Password with both my new information, reflections, and their business drivers in mind.

Most Secure, Least Convenient, Limited Platforms

Local vaults, no cloud service.   Assuming the use of a strong passphrase.  This keeps the encrypted vaults within our own control, at the price of dealing with local network connectivity issues, and simply remembering to do the sync in the first place.  We also have to make sure we have a disaster recovery copy offline somewhere, only sync on secure networks and so forth.  Most secure, most control, pretty clunky to use.  Only available on MacOS and iOS.

I’ve used this since day one, and is what caused the outcry earlier this year.  The announcement made it pretty clear that local vaults are not a strategic future feature.  As the Register noted, they aren’t killing them, just letting them die by neglect.  New users on Mac and iOS can turn it back on, but it’s awkward, and requires first setting up a cloud vault.

Least Secure, More Convenient

Using a local vault with DropBox syncing is the least secure option.  The sole line of defense is the strength of the master passphrase, and improvements in cryptanalysis, bugs in the implementation, or social engineering attacks can put your entire vault at risk.  While syncing is more convenient, the security tradeoffs have always been too great, and I’ve never recommended this.  If Agile needs to eliminate one capability, this would be the one I’d pick….well, after the next one.

Just don’t.

Using an in-browser (non-plugin) web client is a risky proposition, and I don’t recommend it.  The browser is the most compromised piece of code on your machine.  I use a separate browser for critical stuff (banking/healthcare) than for general browsing for example.  In the case of accessing your passwords with a browser window, my recommendation is: Just don’t – especially on a computer you don’t own and control.  And absolutely never on a public computer.  That’s like licking the seat in an outhouse.

Secure, Very convenient – Secure Enough? 

This is their new direction – storing vaults in the cloud, accessible by a local client or browser plugin.  Frankly, it gave me the willies, and my immediate reaction to their announcement was “heck no”.  I know how hard it is to get cloud services right, and it presents a much larger target than local vaults.  Their competitors have had multiple breaches, and I expect Agile to have one at some point (to be clear: I expect every cloud service to have one at some point).  For passwords, that’s catastrophic if the information can be decrypted.

On the flip side, for the vast majority of the user population, cloud storage, backup and sync, is a huge usability factor – it removes a ton of friction to adoption, and for those folks, there’s no question that using 1Password in the cloud is more secure than not using it at all!  Those of us willing to put up with the clunky local sync (either for personal or corporate reasons), are a tiny minority.  Security is all about tradeoffs – for me, I picked security over usability.  For others, it’s the reverse.  But is 1Password’s cloud good enough even for us tinfoil aficionados?

I had some friends ask me that question (particularly with their kids), so I took a deep look at the white paper on the security architecture for 1Password’s cloud service (https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf ) which goes into pretty gnarly detail. I’ve also had a good email exchange with a couple of folks at AgileBits, including their ‘Chief Defender of the Dark Arts’ (and thanks to them for taking the time).

The crypto design is pretty clever.  In addition to a master passphrase, it adds a unique secret key that never leaves the device.  That’s very different from the cloud-only/browser-only competition.  Since that key is generated by 1Password, they can ensure that it’s robust enough to withstand attack (versus a human generated master passphrase). I do wish they wouldn’t use the word ‘impossible’ in the white paper, though agree that this design makes it extremely unlikely (absent major implementation defects or improvements in cryptanalysis) that a brute force or dictionary attack on cloud-stored data could succeed.

This does introduce a risk if a user loses the secret key.  It’s critically important that it be kept safe and secure in case of a catastrophic loss of all devices.  That’s manageable as it’s only needed when setting up a new device, and a safety deposit box is your friend.

So in operation, using a client application (which talks to a browser plugin – not the in-browser option I mention above), that’s a pretty secure solution.  And it’s probably secure enough, even for a tinfoil fedora guy like me.  That is – once it’s setup.

Which brings us my last real concern.  Right now, the only way to create a new account and cloud vault is in-browser.  That’s probably the dirtiest, least secure, least trusted piece of code on any machine.  If you do the initial setup via a compromised browser, it’s game over.  In fact, when I had dinner with my friends to do their initial setup for 1Password for Families, I first did a machine scan using Malwarebytes and found three different adware packages on their Mac (yep, macs get malware).

I’ve reached out to Agile.  They understand the concern, and have expressed an interest/desire to move the signup process out of the browser, but it may be a while before that happens.   In the meantime, there’s a workaround, which is to do the setup from a known-clean/safe/secure system.  At a minimum, make sure you do a malware scan prior to signing up.  For my friends, I created a new OSX virtual machine using VMWare Fusion, and did the setup inside it.

So where does this leave us?  Right off, there’s no good local-sync alternatives out there (I looked).  Given that, I’d much rather use theirs than any alternative (including iCloud Keychain, LastPass, KeePassX, and all the rest).  Since I fully expect that local sync will go away at some point, I’ll make my family happy and make a slight tradeoff in security for vastly improved usability. I’m going to sign up for the service and have put 1Password back on my recommended list with a few points to note:

  • Choose a robust passphrase that you use nowhere else. Longer is better – 20 characters or more.  Using ‘funky shark tree airplane panda router’ is much better than fstapr (the old guidance to use the first letters of each word in a sentence)
  • I’m not a fan of unlocking my vault with TouchID, and recommend against using FaceID. I like using different mechanisms as layered security.
  • Make VERY sure the machine and browser are clean prior to signing up for the service, using travel mode, or other direct-on-the-web functions. A fresh/clean virtual machine is an excellent option.
  • Store the secret key in a secure, offsite location (or locations). Note that your own vault is not an option!

Thanks again to AgileBits’ staff for their help and openness.

Rent Cars? Smartphone? Don’t Connect it

By

I travel for business and while Lyft is a growing part of my travel plans, I still frequently rent cars.  And I carry a cigarette adapter and mini-phono cable to connect to the car speakers.  Yep, Bluetooth and USB connections are something to avoid.

I’ve done this for years, both because pairing can be problematic, but more importantly because un-pairing and wiping the infotainment system is often beyond my knowledge and/or time available when I return it.  Privacy international just wrote a report on the situation – it’s worth a quick read:  https://privacyinternational.org/sites/default/files/cars_briefing.pdf.  Connecting to a car – either via Bluetooth or USB may be convenient, but you’re leaving a lot of digital breadcrumbs (and a few loaves) behind.

None of this is a surprise, and keep in mind that GDPR doesn’t protect us here in the US.  It’s never a good idea to connect your phone to a strange device with a USB port or Bluetooth connection.  Apple’s taken steps in recent iOS versions to give you more control over what information is transmitted, but it’s not perfect.  For example, if you have the app for your own car on the phone, then rent a car from the same manufacturer, the app already has all the permissions needed to share your data.

So the net is that dumb connections are the only safe option when connecting your phone to a strange car.  That means separate power (http://www.belkin.com/us/p/P-F7U013/ for example) and a mini-phono patch cable.    The latter means that if you have an iPhone, you’ll need a Y dongle to get power and audio at the same time.   Unfortunately, more and more models no longer have an audio jack, and only offer USB connections, so that won’t work.  At that point I pull out my Bluetooth speaker and connect to it instead.  The rental car privacy/security use case is one neither the phone or car manufacturers handle well at all.