Sophos UTM Home Edition and UTM Essential Firewall

[TraderStf]

Don't know where to add this two free applications...

UTM Home Edition
https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
Free Home Use Firewall is a fully equipped software version of the Sophos UTM firewall, available at no cost for home users – no strings attached. It features full Network, Web, Mail and Web Application Security with VPN functionality and protects up to 50 IP addresses.

Requires a dedicated newly formatted PC, not a Mac.
I like this feature: can use multiple Internet connections at the same time, giving you more bandwidth.

UTM Essential Firewall
https://www.sophos.com/en-us/products/free-tools/sophos-utm-essential-firewall.aspx
Free version of the Sophos UTM software and offers fundamental security functions to help protect any business network. Start today and implement a firewall into your company’s IT environment—without charge and no strings attached.

[drduh]

Sorry, but I don't like Sophos products after reading Tavis Ormandy's "Sophail" report, nor AV solutions for Mac in general. Therefore, I would rather not recommend these products for advanced users.

[TraderStf]

I don't know where we can talk a bit without reopening an issue... please tell me.

What do you to protect you or your correspondants/colleagues against viruses on email, usb drive...?
Common sense is not enough, some malware are quite hidden and as most people are in hurry, overloaded, lack of time to do all secure steps to be safe... there is no other solutions than AV or similar.

Today, malware are even coming from

• official sources like Google Play Store, Apple App Store yispecter malware.
• old-style macro viruses, in apps like MS Office, which start to reappear.

Not having an AV is quite irresponsible, even if seldomly some are the targets of attacks.
AV are protecting more than they are adding new risks. If you go by that principle, you should get rid of all popular software as they would be the first target as they will provide more victims.

Thanks,

[drduh]

I disagree - advanced users may be increasing attack surface by running AV software, such as Sophos products. The current anti virus offerings for Mac which I've seen have seen are poorly written (e.g., references to Windows registry keys in the code) and I would rather not recommend them, and instead give practical advice for avoiding compromise. I agree one size doesn't fit all, so I will leave this issue open for comment for a little while.

I have ClamXav installed but only run it every 3 months or so. It doesn't have live protection, so it shouldn't grab resources when not running. Now, admittedly, I don't know how good the code or threat detection are.

I regard AV as snakeoil and agree with @drduh

@jzorn As an addendum, I've caught malware on the Mac. Of course I knew I was downloading something I really wanted from a shaky source.

I don't claim there is no malware for Mac OS X. I'm just saying that AV won't necessarily protect you from it but might give you a false feeling of safety.

[TraderStf]

ClamXav is quite weak, specially if you go six-feets under...
http://www.av-comparatives.org
https://www.av-test.org/

Be careful, like for VPN, Hostings or AV, lot of review sites are just affiliates crap.

BitDefender on Mac, Window$ and Android is really nice, all tests are very good and updates are fast.
Free Avast (web, mail, file) is great on mac.
Both are 'invisible' and use almost no resource.

Avast does not go well with LittleSnitch for the Web protection.
All internet accesses are reported as from Avast proxy... annoying.
For the web, ublock, ghostery are ok on top of those include in almost all browsers.
It is up to you if you are very paranoid or not ;-)
I also tried AVGuard, also a proxy, which is an application, so covers all browsers, no need of plugin.
Same problem that Avast with LittleSnitch.

If you had never used ad blockers, most have also list of malware sites, not just ads or trackers.

I have remove avira, sophos and avg, I think because not stable and avg not very effective.

There is also http://www.virustotal.com, check files and url with 50+ AV.

[TraderStf]

It is different if you are alone with your mac, of if you have exchanges with poor window$ victims.
Precautionary principle, an 'important' AV company will always react faster, update its AV, than a single user who has to figure out what to do, specially if he is not security addicted.

Latest Avast RCE

I do not recommend using AV. Also, I don't follow the protection-for-others reasoning.

[TraderStf]

And what do you do with this kind of threat?
http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/

It happens on Google Play and App Store... what's next, printer drivers.
Remember, I think, HP was infected and several 'official' disks were spreading malware.

If I remember correctly, XCodeGhost and applications infected by XCodeGhost were not picked up by AV anyways - AV would have not helped you.

[TraderStf]

But affected developers/apps or apple/ms/google/hadware-manufacturers... would not/never react as fast as and 'good' antivirus company, which can stop the spreading and warn/clean already infected user's devices.

good = a company big enough to have either lots of feedbacks or employees to enhance their AV asap.
AV companies are now sharing some info to avoid mayhem.

See Google plans to change how updates/patches are made to Android, without having to wait for phone-manufacturers which in most cases send an 'oem' updates months after, no matter how dangerous is the problem...

The daily news about malware and Co is frightening...
https://www.exploit-db.com
http://www.scmagazine.com