RANGER GAMEZ

Apple Device Support · chapter 16 of 18

Month 8: Malware Monday

In this chapter Objectives 6.3, 6.4, 6.5, 6.6, 6.7, 6.11

  1. Apple's multi-layer malware defense
  2. Gatekeeper and runtime protection
  3. How notarization protects macOS
  4. How XProtect detects and removes malware
  5. The purpose of Location Services
  6. Administrator vs standard user accounts on Mac
  7. Three layers against malware
  8. Gatekeeper and runtime protection
  9. Notarization
  10. XProtect
  11. Admin, standard, guest, sharing only
  12. Practice questions
  13. Chapter recap

Objective 6.3

Apple's multi-layer malware defense

Three layers

Apple structures malware defense in macOS in three layers.

  • 1. Prevent launch or execution: the App Store, and Gatekeeper combined with notarization
  • 2. Block malware that appears on Macs, to halt its spread: XProtect, with Gatekeeper and notarization
  • 3. Remediate malware that has run: XProtect removes it

Exam tip FileVault, SIP and privacy permissions protect data too, but the three malware layers are prevent, block, remediate.

Check yourself 1A user asks how macOS defends against malware. Which three layers make up Apple's malware defense in macOS? Choose three.

  1. Prevent launch or execution of malware
  2. Encrypt all network traffic
  3. Block malware from running on user systems
  4. Remediate malware that has executed
  5. Scan every file in iCloud Drive each night
  6. Require a firmware password at startup
Show the answer

Answers: A. Prevent launch or execution of malware, C. Block malware from running on user systems, D. Remediate malware that has executed

Apple structures macOS malware defenses in three layers: prevent launch or execution, block malware from running on user systems, and remediate malware that has executed.

Objective 6.4

Gatekeeper and runtime protection

What Gatekeeper checks

When a user opens an app, plug-in or installer from outside the App Store, Gatekeeper verifies it's from an identified developer, notarized by Apple and not altered, and asks for approval the first time so the user isn't tricked into running code disguised as a document. It may open apps from a randomized, read-only location so bundled malicious plug-ins can't load.

Exam tip Privacy & Security > 'Allow apps downloaded from': App Store, or App Store and identified developers. MDM can lock it.

Overrides and runtime protection

If the user is sure an app is safe, Privacy & Security > Open Anyway saves an exception (unless MDM prevents it). Runtime protection shields system files, resources and the kernel from apps, and App Store apps are sandboxed: they reach other apps' data only through macOS APIs. Gatekeeper's online checks never include the user's Apple Account or device identity.

Check yourself 2A user opens an app he downloaded from a vendor's website. Which three things does Gatekeeper verify? Choose three.

  1. That it comes from an identified developer
  2. That it was bought from the Mac App Store
  3. That it is notarized by Apple
  4. That it hasn't been altered
  5. That it uses less than 1 GB of memory
  6. That the user is an administrator
Show the answer

Answers: A. That it comes from an identified developer, C. That it is notarized by Apple, D. That it hasn't been altered

When software from outside the App Store is downloaded and opened, Gatekeeper verifies that it's from an identified developer, notarized by Apple to be free of known malicious content, and hasn't been altered.

Check yourself 3Kibble & Co. wants the front desk Macs to open only apps from the App Store. Which setting does this?

  1. Privacy & Security > Allow apps downloaded from: App Store and identified developers
  2. Privacy & Security > Allow apps downloaded from: App Store
  3. Screen Time > Content & Privacy > App Store only
  4. General > Software Update > Automatic Updates
Show the answer

Answer: B. Privacy & Security > Allow apps downloaded from: App Store

Under Security in Privacy & Security, 'Allow apps downloaded from' offers App Store, or App Store and identified developers. Organizations can also set this with device management.

Check yourself 4Sam is sure a vendor's app is safe, but macOS won't open it. Where can he allow it, if IT permits?

  1. Terminal: csrutil disable
  2. System Settings > General > Login Items
  3. Disk Utility > First Aid
  4. System Settings > Privacy & Security > Open Anyway
Show the answer

Answer: D. System Settings > Privacy & Security > Open Anyway

Open Anyway in Privacy & Security saves the app as an exception after the user confirms. Device management can block this override.

Objective 6.5

How notarization protects macOS

Apple's malware scan for downloads

Developers who distribute Mac apps outside the App Store submit them for notarization. Apple scans for known malware and issues a ticket, usually attached to the app so Gatekeeper can verify it even offline. Apple can issue a revocation ticket for an app later found malicious; revocations arrive far more often than XProtect updates. Mac App Store apps aren't notarized (they go through App Review).

$ spctl --assess --type execute -v \
  /Applications/LabelMaker.app
.../LabelMaker.app: accepted
source=Notarized Developer ID

Exam tip spctl shows source=Mac App Store for App Store apps, and 'rejected' for downloads that aren't notarized.

Check yourself 5What is notarization?

  1. Apple's review of every app in the Mac App Store
  2. A certificate that lets an app skip Gatekeeper's checks on every Mac
  3. Encryption of an app's files on disk
  4. Apple's malware scan of apps distributed outside the App Store
Show the answer

Answer: D. Apple's malware scan of apps distributed outside the App Store

Developers who distribute Mac apps outside the App Store submit them for notarization. Apple scans them for known malware and, if none is found, issues a notarization ticket that Gatekeeper uses.

Check yourself 6Which reaches Macs faster when Apple acts against a malicious app: a notarization revocation or a new XProtect signature?

  1. The XProtect signature, because it always ships with macOS system updates
  2. They always arrive together
  3. The revocation, because revocation updates arrive much more often
  4. Neither; both need a macOS update
Show the answer

Answer: C. The revocation, because revocation updates arrive much more often

macOS checks for new revocation tickets in the background, much more often than even the background updates that push XProtect signatures (Apple says notarization updates via CloudKit sync are much more frequent).

Objective 6.6

How XProtect detects and removes malware

Built-in antivirus

XProtect uses YARA signatures that Apple updates automatically, independent of macOS updates (checked daily). It checks when an app is first launched, when an app changes, and when signatures update. Known malware is blocked, moved to the Trash and the user is alerted. A remediation engine removes infections, and a behavioral engine spots unknown malware.

  • Check versions: Option + Apple menu > System Information > Software > Installations (XProtectPayloads...)
  • Force an update (admin): sudo xprotect update

Check yourself 7How does macOS get new XProtect signatures?

  1. Only with major macOS upgrades, such as moving to the next yearly release
  2. Only when the user runs a scan by hand
  3. Automatically and independently of macOS updates, checked daily
  4. From the App Store, as an app update
Show the answer

Answer: C. Automatically and independently of macOS updates, checked daily

Apple updates XProtect signatures automatically, independent from system updates. By default, macOS checks for these updates daily.

Check yourself 8XProtect finds known malware on a user's Mac. What happens?

  1. The Mac restarts in safe mode
  2. It's blocked, moved to the Trash and the user is alerted
  3. Apple Support calls the user
  4. The file is encrypted where it is
Show the answer

Answer: B. It's blocked, moved to the Trash and the user is alerted

XProtect blocks known malware, moves it to the Trash and alerts the user. The user may be asked to share the sample with Apple.

Objective 6.7

The purpose of Location Services

What it is for

With the user's permission, Location Services lets apps and websites use cellular, Wi-Fi, GPS networks and Bluetooth to find the device's location, so they can show maps, directions and nearby recommendations. Find My needs it to show a lost device on a map. Users turn it on in Setup Assistant or in Privacy & Security, and choose per app.

Exam tip MDM can skip the Location Services pane in Setup Assistant but can't turn Location Services on.

System Services on a Mac

On a Mac, Privacy & Security > Location Services > System Services Details lists system uses: Location-Based Suggestions (Siri and Safari Suggestions), Significant Locations (places that matter, encrypted, clearable) and Find My Mac. If Setup Assistant skipped Location Services and MDM didn't set a time zone, the user is asked to set it.

Check yourself 9Rosa's iPhone is lost, and Find My can't show it on a map. Which setting must have been on for Find My to locate it?

  1. Personal Hotspot
  2. Location Services
  3. Background App Refresh
  4. iCloud Backup
Show the answer

Answer: B. Location Services

To find a lost device on a map, Location Services needs to be turned on. Find My is available with a personal (unmanaged) Apple Account.

Objective 6.11

Administrator vs standard user accounts on Mac

Four local account types

Each account type has its own level of access.

  • Administrator: installs software, changes system settings, manages users. Usually the first account made in setup
  • Standard: everyday use; own settings and installed apps; asks for an admin name and password for system changes
  • Guest User: no password, can't install apps or change settings; data deleted at logout
  • Sharing Only: reaches shared files or services over the network only

Rosa: So the driver install asks for Maya's password because I'm a standard user.

Maya: And that's on purpose.

Exam tip Apple recommends at least one admin, but a standard account for daily work: fewer risks and accidental changes.

Check yourself 10Which Mac user account usually has administrator privileges?

  1. The Guest User account
  2. The first account created during Mac setup
  3. Any account that signs in to iCloud
  4. Every account that was given a password hint when it was created
Show the answer

Answer: B. The first account created during Mac setup

Typically, the first account created during the Mac setup process gets administrator privileges. Later accounts can be standard or administrator.

Go deeper

More on the objectives in this chapter, in the same exam-ready detail.

Objective 6.3 · Describe Apple's multi-layer defense that helps protect against malware in macOS.

Three layers against malware

Prevent, block, remediate

Apple builds macOS malware defense in three layers.

  • Prevent launch: the App Store, plus Gatekeeper combined with notarization, stop malware from opening even once
  • Block: if malware shows up on Macs, it's identified and blocked fast (XProtect, Gatekeeper, notarization revocations)
  • Remediate: XProtect removes malware that managed to run

Exam tip Exam trap: FileVault and SIP protect data and the system, but they aren't the three malware layers.

Objective 6.4 · Describe how Gatekeeper technology and runtime protection help ensure that only trusted software runs on Mac.

Gatekeeper and runtime protection

What Gatekeeper checks

For apps, plug-ins and installers from outside the App Store, Gatekeeper verifies an identified developer, notarization and that the code hasn't been altered, and asks the user to approve the first launch. It can open apps from a randomized, read-only location so bundled plug-ins can't load. Setting: Privacy & Security > Allow apps downloaded from (App Store, or App Store and identified developers). Override once: Open Anyway in Privacy & Security, unless MDM blocks it.

Runtime protection

System files, resources and the kernel are shielded from apps. App Store apps are sandboxed and reach other apps' data only through macOS APIs. Gatekeeper's online checks never include the user's Apple Account or device identity.

Objective 6.5 · Describe how notarization helps protect macOS from malware in apps distributed outside the App Store.

Notarization

Apple's scan for downloads

Developers submit apps distributed outside the App Store. Apple scans for known malware and issues a ticket, usually attached to the app so Gatekeeper can verify it offline. Apple can issue a revocation ticket later; macOS checks for these in the background, much more often than XProtect updates. Mac App Store apps aren't notarized: they go through App Review.

spctl --assess --type execute -v <app>
App Store app:   accepted, source=Mac App Store
Notarized app:   accepted,
                 source=Notarized Developer ID
Not notarized:   rejected

Objective 6.6 · Describe how XProtect helps detect and remove malware from macOS.

XProtect

Signatures that update on their own

XProtect uses YARA signatures updated automatically, independent of macOS updates (checked daily). It checks at an app's first launch, when an app changes, and when signatures update. Known malware is blocked and moved to the Trash, and the user is alerted. A remediation engine cleans infections; a behavioral engine finds unknown malware.

  • Versions: Option + Apple menu > System Information > Software > Installations
  • Force an update (admin): sudo xprotect update

Objective 6.11 · Distinguish between administrator and standard user accounts on Mac.

Admin, standard, guest, sharing only

Who can do what

Administrator: installs software, changes system settings, manages users (usually the first account created). Standard: everyday use, own settings and installed apps; system changes ask for an admin name and password. Guest: no password, no installs, data deleted at logout. Sharing Only: remote access to shared files or services only.

Exam tip Apple's advice: keep at least one admin, but work day to day in a standard account.

Practice questions

Answer in your head, then open the answer. Ranger’s Device Doctor has 653 questions like these for Apple Device Support, with mock exams.

Question 1A standard user wants to reset another user's forgotten password from Users & Groups. What happens?

  1. He must enter an admin name and password
  2. He can reset it with his own password
  3. He can reset it after restarting in safe mode
  4. He can reset it if FileVault is off
Show the answer

Answer: A. He must enter an admin name and password

Managing other user accounts, including resetting passwords, needs an administrator. A standard user can change only their own settings.

Question 2Mr. Barkley asks where his Mac stores the places that matter to him for suggestions in Maps and Calendar, and how to clear them. Where should Priya look?

  1. Privacy & Security > Analytics & Improvements > Analytics Data
  2. General > Storage > System Data > Location files
  3. Apple Account > iCloud > Find My Mac > Location History
  4. System Services Details > Significant Locations
Show the answer

Answer: D. System Services Details > Significant Locations

On Mac, System Services Details in Location Services includes Significant Locations, which lets the Mac learn places that matter. Entries can be removed or the history cleared.

Question 3Apple describes malware defense in macOS as three layers. What is the goal of the first layer?

  1. Prevent malware from launching or executing even once
  2. Remove malware that has already run
  3. Encrypt the startup disk
  4. Back up files so that malware can't destroy or encrypt them
Show the answer

Answer: A. Prevent malware from launching or executing even once

The three layers are: prevent launch or execution of malware, block malware from running on user systems, and remediate malware that has executed. The first layer aims to stop malware from launching even once.

Question 4Which technologies form the first layer of macOS malware defense, keeping malware from launching even once?

  1. FileVault and the firewall
  2. XProtect's remediation engine
  3. The App Store, plus Gatekeeper combined with notarization
  4. Time Machine and iCloud Backup, which keep clean copies of files
Show the answer

Answer: C. The App Store, plus Gatekeeper combined with notarization

The first layer inhibits the distribution of malware and prevents it from launching: that's the goal of the App Store, and Gatekeeper combined with notarization.

Question 5Malware is somehow already on several Macs. Which layer of macOS malware defense quickly identifies and blocks it to stop it spreading?

  1. Preventing launch or execution
  2. Blocking malware from running on user systems
  3. Encrypting the data volume so malware can't read it
  4. Remediating malware that has executed
Show the answer

Answer: B. Blocking malware from running on user systems

The second layer makes sure that if malware appears on any Mac, it's quickly identified and blocked, both to halt spread and to remediate Macs it reached. XProtect adds to this layer along with Gatekeeper and notarization.

Practice it in Ranger’s Device DoctorThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

Apple, iPhone, iPad and Mac are trademarks of Apple Inc. Ranger Gamez is not affiliated with or endorsed by Apple. The practice questions are written to the published exam objectives; they are not real exam questions.