Malware makes headlines regularly these days, and although Macs are targeted far less than Windows PCs, Mac users still need to remain vigilant. A particularly serious type of malware is called ransomware because once it infects your computer, it encrypts all your files and holds them for ransom.
Luckily, despite the virulence of ransomware in the Windows world, where there have been major infections of CryptoWall and WannaCry, only a few pieces of ransomware have been directed at Mac users:
Realistically, don’t worry too much. But it’s likely that malware authors will unleash additional Mac ransomware packages in the future, so we encourage you to be aware, informed, and prepared.
First, let’s explain a few key terms and technologies. Apple’s Gatekeeper technology protects your Mac from malware by letting you launch only apps downloaded from the Mac App Store, or those that are signed by developers who have a Developer ID from Apple. Since malware won’t come from legitimate developers (and Apple can revoke stolen signatures), Gatekeeper protects you from most malware. However, you can override Gatekeeper’s protections to run an unsigned app. Do this only for apps from trusted developers. Even if you never override Gatekeeper, be careful what you download.
Apple’s XProtect technology takes a more focused approach, checking every new app against a relatively short list of known malware and preventing apps on that list from launching. Make sure to leave the “Install system data files and security updates” checkbox selected in System Preferences > App Store. That ensures that you’ll get XProtect updates. Similarly, install macOS updates and security updates soon after they’re released to make sure you’re protected against newly discovered vulnerabilities that malware could exploit.
Also consider running anti-malware software like Malwarebytes Premium or Mac Internet Security X9. That’s not absolutely necessary, like anti-malware solutions are for Windows, but doing so can provide peace of mind, particularly if you regularly visit sketchy parts of the Internet or download dodgy software.
Although regular backups with Time Machine are usually helpful, KeRanger tried to encrypt Time Machine backup files to prevent users from recovering their data that way. Similarly, a bootable duplicate updated automatically by SuperDuper or Carbon Copy Cloner could end up replacing good files with encrypted ones from a ransomware-infected Mac, or a future piece of ransomware could try to encrypt other mounted backup disks as well.
If you ever are infected with ransomware, don’t panic, and don’t pay the ransom right away. Contact us so we can help you work through your options, which might entail restoring from a backup or bringing files back from older cloud storage versions. There are even descriptors for some Windows ransomware packages, and such utilities might appear for hypothetical Mac ransomware as well.
To reiterate, there’s no reason to worry too much about ransomware on the Mac, but letting Apple’s XProtect keep itself up to date, staying current with macOS updates, and using an Internet backup service will likely protect you from what may come.
That’s it from this week’s simply blog! Make sure to stay tuned for more useful security tips!