0

Often I am required to connect to public wifi or open files that others send me. Doing so opens me up to possible credential theft as well as possible viruses or malware.

Thus far I have done my best to lock down the system by enabling firewall, installing a reputable malware scanner (Malwarebytes), and enabling device encryption.

What would be the next step to keeping my device safe against threats or is what I have implemented be satisfactory for a general user? What common attacks could my system be open to?

Harrison G
  • 67
  • 6
  • We’re not supposed to discuss specific vendors here but in the case of OSX only know of closed source solutions. ESET is good for malware protection, and locking down endpoint works well with JAMF. If any open source solutions are out there, I would interested too. – SysRisk Nov 19 '20 at 11:16
  • Have you considered working through a [STIG](https://www.stigviewer.com/stig/mac_osx_10.6_workstation/) or [CIS](https://www.cisecurity.org/benchmark/apple_os/) baseline? – phbits Nov 19 '20 at 20:51

1 Answers1

2

Fix your attack vectors

You identified that your behavior opens you up to attacks. Instead of trying to counteract these attacks, make them impossible in the first place.

Instead of using an open access point, consider connecting your phone via USB and use your phone's internet access instead. Alternatively, consider investing in a SIM card adapter for your laptop so you can connect to the internet like that directly.

As for opening files, what nature are these files? Images, archives, executables, etc...?

Depending on their nature and their requirement for confidentiality, uploading them to VirusTotal before opening them may already be enough. If they're confidential executable files, consider creating a virtual machine environment to run them in.

Edit: You've mentioned that you primarily open images, PDFs and spreadsheets, so I will give a bit more information on each.

Images are usually harmless, since they don't execute any code. While there are indeed images designed to exploit vulnerabilities in the libraries that decode image data, such as Bannerbomb on the Wii and Stagefright on Android, these are usually very rare. With an up-to-date operating system, you should not be affected - or at least, just as affected as everyone else.

Spreadsheets are a bit more dangerous, since spreadsheets can contain macros. Excel and CSV files can contain malicious formulas, which lead to remote code execution. While this is indeed severe, spreadsheet software these days warns you several times that this is really dangerous and you should only allow that if you trust the document and its source. Spreadsheet software can also be configured to never allow DDE, which is used in these kinds of exploits.

Furthermore, since you mentioned you were on MacOS, Apple has its own spreadsheet software called "Numbers". I have to admit that I don't know anything about Numbers or the possible ways to exploit it. However, I would assume that the situation is similar to other spreadsheet software.

PDF files are even more dangerous, since they can embed all kinds of data. This question goes into detail about the dangers of PDF files. The mitigation is again to keep your reader software up-to-date and to check with VirusTotal if you are unsure about the file.