0

Curious about this since I recall reading once that 3rd party Android AV apps are useless because of the OS' lack of API hooks for them (which Windows has). Is this true of OS X also, or not?

2
  • Can you cite a source on the Android issue? I've never heard of an OS needing special API hooks specifically for antivirus or other security software.
    – Spiff
    Apr 19, 2016 at 19:02
  • I used the wrong terminology when I said "API." My source is HTG FTA: >To provide real-time protection, antivirus applications use “file system filter drivers” to intercept file access requests and scan those files for malware before they’re allowed to run or otherwise be accessed. If the antivirus application detects a problem, it can block the access and use its low-level permissions to immediately delete or quarantine the malware.
    – jdrch
    Apr 20, 2016 at 1:48

2 Answers 2

0

It's important to note that "hooks" for AV software are actually just attack vectors that a virus would normally use to infect your system. Android's (and iOS's) lack of these hooks is actually a good thing. Rooting (or jailbreaking) a mobile device actually allows apps to bypass the sandbox that exists for normal apps that don't require root access.

The answer to your question is yes, OS X has these "hooks" because it is a fully-featured desktop OS. OS X attempts to sandbox applications as much as it can, but there are mechanisms to install kernel extensions, etc. that are needed to support some applications. As such, there is also antivirus software for Macs that also use these mechanisms to guard your system against malware that may also try to use them as an attack vector.

1
  • From the link you provided in one of your other comments: "Adding enough permissions for antivirus apps to function would also open new paths for malware to take advantage of those same low-level permissions." Goes to what I was saying: Antivirus hook=malware attack vector.
    – Wes Sayeed
    Apr 24, 2016 at 18:17
1

On OS X, with system administrator access, you can install kernel extensions (kexts; for example, device drivers are typically kexts), which load and run as part of the kernel, with all the privileges of the kernel (which is everything). So Yes, on OS X, there's basically nothing that anti-malware or other security software can't do.

Smartphone OSes are different for some apps. App store apps are often required to run in a sandboxed (isolated, protected, restricted) environment where they can't mess with anything outside of their own sandbox. On some smartphone OSes, sideloaded apps might not have the same restrictions. Or if you "jailbreak" your OS to remove restrictions, you can run apps with very few restrictions. Sandboxed anti-malware or other security software would need special APIs ("hooks") to allow them to do things outside of their sandbox, like receiving notifications anytime any file anywhere in the filesystem changes, so it can be re-scanned for viruses.

On OS X, Mac App Store apps are sandboxed and can't install kexts or require administrator or root privileges. So it's possible that anti-malware or other security software sold through the Mac App Store might not have the capabilities of similar Mac software sold outside of the Mac App Store.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .