This is problematic, as an exploit-based attack that manually downloads malware will, of course, do so without setting the quarantine attribute. This attribute is set by the application that downloaded the binary (e.g. In its current implementation, XProtect only scans binaries that contain a quarantine attribute. Another obvious downside to XProtect’s signature-based malware detection scheme is that new malware will never be detected.īesides the weaknesses in the detection scheme used by XProtect, it is plagued by other design issues. The malware will remain undetected and will be able to execute. For one, a slight change in the malware (the renaming of a file, or a recompilation to change the hash), will prevent a match, and thus detection, from being made. While the benefit of such an exact match/detection scheme is zero false positives, there are several major downsides. The highlighted entry in Figure 2 aims to detect the OSX/LaoShu.A malware by matching a SHA1 hash and a filename (‘worty’).

Figure 2. XProtect’s signature for LaoShu.A.

Apple anti malware