Snow Leopard’s Anti-Malware Feature Explained

Yesterday we reported that Mac OS X 10.6 Snow Leopard, due for release coming Friday, contained some form of malware and/or virus protection. Since the scope of this protective measure was not yet known – nor if it even existed at all – I thought it would be best to write another post detailing that yes, it’s real, and yes, it’s all relatively crude.

The feature works by looking at malware definitions in the /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist file. This file currently only lists the two “most common” trojans (“least uncommon” would be better, I guess), but it should be trivial for Apple to update this file to combat variants of these trojans or even new pieces of malware altogether, if the need ever arises.

The feature builds on something introduced in Mac OS X 10.4 Tiger, which scanned files downloaded with Safari and several other applications and automatically opened them if deemed safe. This new anti-malware feature, therefore, inherits some of the key limitations of said feature.

For instance, it only works with a relatively small number of applications (Safari, Firefox, iChat, Entourage, Mail, and Thunderbird); any files downloaded with any of the other ten billion million applications capable of doing so are not scanned. In addition, files which come in through CDs or USB drives are not scanned either. As you can deduct from this, it cannot scan entire drives for malware either.

This feature seems like a quick ‘n’ dirty hack, implemented to battle the two most common trojans on the Mac. Of course, at this point in time, the Mac doesn’t really require die-hard continuous protection. Still, it’s good to know Apple is taking baby steps in combating the few pieces of malware out there.


  1. 2009-08-26 11:17 pm
    • 2009-08-27 1:40 pm
  2. 2009-08-27 12:15 am
  3. 2009-08-27 12:26 am
    • 2009-08-27 7:39 am
      • 2009-08-27 10:52 am
  4. 2009-08-27 1:27 am
    • 2009-08-27 8:48 am
  5. 2009-08-27 1:59 am
    • 2009-08-27 6:44 am
    • 2009-08-27 8:02 am
    • 2009-08-27 10:36 am
  6. 2009-08-27 3:29 am
    • 2009-08-27 4:42 am
  7. 2009-08-27 5:00 am
    • 2009-08-27 5:56 am
      • 2009-08-27 6:09 am
    • 2009-08-27 12:22 pm
  8. 2009-08-27 7:36 am
  9. 2009-08-27 8:12 am
    • 2009-08-27 10:08 am
      • 2009-08-27 11:32 am
  10. 2009-08-27 10:06 am
  11. 2009-08-28 1:47 pm