Why macOS anti-malware scans can behave oddly
eclecticlight.co
Why macOS anti-malware scans can behave oddly
1–10 of 46 posts
Re: Why macOS anti-malware scans can behave oddly
#2I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
Re: Why macOS anti-malware scans can behave oddly
#3[deleted]
Re: Why macOS anti-malware scans can behave oddly
#4"Instead it records those events in the log, and in Ventura and later makes them available to third-party software through Endpoint Security events."
Sounds like what malware did for decades
Re: Why macOS anti-malware scans can behave oddly
#5"Instead it records those events in the log, and in Ventura and later makes them available to third-party software through Endpoint Security events." Sounds like what malware did for decades
In this case, it's for enterprise MDM and MDR software agents that have device-level trust after the device has been enrolled (e.g., Apple Business Manager, Microsoft Intune, Kandji, Jamf).
Re: Why macOS anti-malware scans can behave oddly
#6I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently)
Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from going back to sleep and since it was stored in my bag it would heat up until the overtemperature safety shutoff and drain the battery in the process.
Re: Why macOS anti-malware scans can behave oddly
#7I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
this is a really terrible idea.
Re: Why macOS anti-malware scans can behave oddly
#8I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…
In this case its the execution that was bad. If the MacOS would wake silently knowing the purpose is to scan and do nothing else, all the useless stuff for it could (and should) be kept off. Then such thing could not happen.
Re: Why macOS anti-malware scans can behave oddly
#9I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
As somebody who sometimes puts slept laptops into bags, No! A laptop ever waking itself from sleep is an abomination.
Re: Why macOS anti-malware scans can behave oddly
#10I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.
this is a really terrible idea.
Macs already do this for other things, e.g. downloading updates. The feature is internally called "DarkWake" and exposed to the user as "Power Nap" (https://support.apple.com/en-ca/guide/mac-help/mh40773/mac).
I would note that there's definitely a reason that macOS hasn't attached anti-malware scanning (or similar things, e.g. Spotlight indexing) to DarkWake wakeups, though.
The other things DarkWake does are all IO-bound (network activity, disk activity) with a bounded workload size (the size of the update); while anti-malware scans would be CPU-bound (lots of hashing for signature checking) with an unbounded workload size (however much stuff you have on your HD.)
Doing IO-bound activity, just on some efficiency cores, in their base power state, for a minute or two, is fine; even if the laptop is in your bag, it won't heat up, any more than your phone heats up in your pocket. Doing "real work" in the same situation is not fine.