How we rank antivirus providers To help you choose the perfect antivirus partner for your security needs, you have the option to sort and filter the antivirus providers we have showcased. You can sort this list by Most Popular, Recommended and Lowest Price. Most popular is based on total number of unique outbound clicks over the last 7 days.

We receive advertising revenue from some of the antivirus providers listed and this impacts the recommended order in which the webmaster chooses. Lowest price is for the plan which we link to and may not necessarily be the lowest price option available.

Santa Santa is a binary whitelisting/blacklisting system for macOS. It consists of a kernel extension that monitors for executions, a userland daemon that makes execution decisions based on the contents of a SQLite database, a GUI agent that notifies the user in case of a block decision and a command-line utility for managing the system and synchronizing the database with a server. Santa is not yet at 1.0.

We're writing more tests, fixing bugs, working on TODOs and finishing up a security audit. It is named Santa because it keeps track of binaries that are naughty or nice.

Santa is a project of Google's Macintosh Operations Team. Docs The Santa docs are stored in the directory. A Read the Docs instance is available here:. Admin-Related Features. Multiple modes: In the default MONITOR mode, all binaries except those marked as blacklisted will be allowed to run, whilst being logged and recorded in the events database. In LOCKDOWN mode, only whitelisted binaries are allowed to run.

Event logging: When the kext is loaded, all binary launches are logged. When in either mode, all unknown or denied binaries are stored in the database to enable later aggregation. Certificate-based rules, with override levels: Instead of relying on a binary's hash (or 'fingerprint'), executables can be whitelisted/blacklisted by their signing certificate.

You can therefore trust/block all binaries by a given publisher that were signed with that cert across version updates. A binary can only be whitelisted by its certificate if its signature validates correctly, but a rule for a binary's fingerprint will override a decision for a certificate; i.e. You can whitelist a certificate while blacklisting a binary signed with that certificate, or vice-versa.

Path-based rules (via NSRegularExpression/ICU): This allows a similar feature to that found in Managed Client (the precursor to configuration profiles, which used the same implementation mechanism), Application Launch Restrictions via the mcxalr binary. This implementation carries the added benefit of being configurable via regex, and not relying on LaunchServices. As detailed in the wiki, when evaluating rules this holds the lowest precedence. Failsafe cert rules: You cannot put in a deny rule that would block the certificate used to sign launchd, a.k.a. Pid 1, and therefore all components used in macOS. The binaries in every OS update (and in some cases entire new versions) are therefore auto-whitelisted. This does not affect binaries from Apple's App Store, which use various certs that change regularly for common apps.

Likewise, you cannot blacklist Santa itself, and Santa uses a distinct separate cert than other Google apps. Intentions and Expectations No single system or process will stop all attacks, or provide 100% security. Santa is written with the intention of helping protect users from themselves.

People often download malware and trust it, giving the malware credentials, or allowing unknown software to exfiltrate more data about your system. As a centrally managed component, Santa can help stop the spread of malware among a large fleet of machines. Independently, Santa can aid in analyzing what is running on your computer. Santa is part of a defense-in-depth strategy, and you should continue to protect hosts in whatever other ways you see fit.

Get Help If you have questions or otherwise need help getting started, the group is a great place. Please consult the and as well. Security and Performance-Related Features. In-kernel caching: whitelisted binaries are cached in the kernel so the processing required to make a request is only done if the binary isn't already cached. Userland components validate each other: each of the userland components (the daemon, the GUI agent and the command-line utility) communicate with each other using XPC and check that their signing certificates are identical before any communication is accepted. Kext uses only KPIs: the kernel extension only uses provided kernel programming interfaces to do its job. This means that the kext code should continue to work across OS versions.

Santa Google's New Enterprise Malware Watchdog For Mac Windows 10

Known Issues Santa is not yet at 1.0 and we have some known issues to be aware of:. Santa only blocks execution (execve and variants), it doesn't protect against dynamic libraries loaded with dlopen, libraries on disk that have been replaced, or libraries loaded using DYLDINSERTLIBRARIES. As of version 0.9.1 we do address that were exploited in some versions of macOS. We are working on also protecting against similar avenues of attack. Kext communication security: the kext will only accept a connection from a single client at a time and said client must be running as root.

We haven't yet found a good way to ensure the kext only accepts connections from a valid client. Database protection: the SQLite database is installed with permissions so that only the root user can read/write it. We're considering approaches to secure this further. Scripts: Santa is currently written to ignore any execution that isn't a binary.

Santa Google's New Enterprise Malware Watchdog For Mac

This is because after weighing the administration cost vs the benefit, we found it wasn't worthwhile. Additionally, a number of applications make use of temporary generated scripts, which we can't possibly whitelist and not doing so would cause problems. We're happy to revisit this (or at least make it an option) if it would be useful to others. Documentation: This is currently limited. Tests: There aren't enough of them. Sync Servers.

The santactl command-line client includes a flag to synchronize with a management server, which uploads events that have occurred on the machine and downloads new rules. There are several open-source servers you can sync with:. An AppEngine-based server that implements social voting to make managing a large fleet easier. A simple golang server that serves hardcoded rules from simple configuration files. A centralized service that pulls data from multiple sources and deploy configurations to multiple services. Alternatively, santactl can configure rules locally (without a sync server).

Screenshots A tool like Santa doesn't really lend itself to screenshots, so here's a video instead. Building with Xcode. Git clone cd santa # Build a debug build. This will install any necessary CocoaPods, create the # workspace and build, outputting the full log only if an error occurred. # If CocoaPods is not installed, you'll be prompted to install it. # # For other build/install/run options, run rake without any arguments rake build:debug Note: the Xcode project is setup to use any installed 'Mac Developer' certificate and for security-reasons parts of Santa will not operate properly if not signed. For more details on building see the document.