XProtect Report
| 0 Votes |
Versioning - This is the latest version.
| 1 | XProtect Report - Apple OS X | 3/4/2013 8:00:25 AM |
| 2 | XProtect Report - Apple OS X | 8/15/2013 11:21:22 AM |
| 3 | XProtect Report | 9/20/2013 9:22:04 AM |
| 4 | XProtect Report | 10/10/2013 8:43:52 AM |
| 5 | XProtect Report | 10/24/2013 9:12:22 AM |
Description
Learn more about this analysis online: http://bigfix.me/cdb/analysis/82
Analysis of Apple's XProtect Security System
- /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist
- /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist
Property Details
| 2994590 | |
| Production - Fully Tested and Ready for Production | |
| XProtect Report | |
| BESC | |
| Apple Mac XProtect | |
| hansen_m on 10/24/2013 9:12:22 AM | |
| hansen_m on 10/24/2013 9:12:22 AM | |
| 8711 Views / 7 Downloads | |
* Average over 0 ratings.
** Log In or Register to add your rating.
|
Properties
XProtect Meta LastModification
Period
6 hours
| * Results in a true/false |
if(not exists file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else if(not exists dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else if((not exists entries whose(exists keys of it AND exists values of it AND "LastModification" = key of it) of dictionary of it) of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else (((string of value of entry whose(exists keys of it AND exists values of it AND "LastModification" = key of it) of dictionary of it) of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") as string)
XProtect Meta Version
Period
6 hours
| * Results in a true/false |
if(not exists file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else if(not exists dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then error "none" else if((not exists entries whose(exists keys of it AND exists values of it AND "Version" = key of it) of dictionary of it) of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then error "none" else ((integer of value of entries whose(exists keys of it AND exists values of it AND "Version" = key of it) of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") as string)
XProtect Meta PluginBlacklist
Period
6 hours
| * Results in a true/false |
((key of it & " = " & string "MinimumPlugInBundleVersion" of dictionaries of values of it) of entries of dictionary "10" of dictionary "PlugInBlacklist" of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" as string)
XProtect Meta JavaWebComponentVersionMinimum
Period
6 hours
| * Results in a true/false |
if(not exists file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else if(not exists dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then "<No dictionary>" else if((not exists entries whose(exists keys of it AND exists values of it AND "JavaWebComponentVersionMinimum" = key of it) of dictionary of it) of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") then ERROR "none" else (((string of value of entry whose(exists keys of it AND exists values of it AND "JavaWebComponentVersionMinimum" = key of it) of dictionary of it) of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist") as string)
XProtect PlugInUpdateAvailable
Period
6 hours
| * Results in a true/false |
concatenation "; " of ((keys of it, (booleans of values of it) of entries of dictionaries of values of it) of entries of dictionary "10" of dictionary "PlugInBlacklist" of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" as string)
XProtect Malware Descriptions
Period
6 hours
| * Results in a true/false |
strings "Description" of dictionaries of values of array of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist"
XProtect Malware Count
Period
6 hours
| * Results in a true/false |
number of strings "Description" of dictionaries of values of array of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist"
XProtect File LastModification
Period
6 hours
| * Results in a true/false |
if(not exists file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist") then ERROR "none" else modification time of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist" as string
Apple Java Version
Period
6 hours
| * Results in a true/false |
if (not exists file "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist") then ERROR "Not Installed" else string "CFBundleShortVersionString" of dictionary of file "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist" as string
Oracle Java Version
Period
6 hours
| * Results in a true/false |
if (not exists folder "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin" OR not exists folder "/Library/PreferencePanes/JavaControlPanel.prefPane") then ERROR "Not Installed" else bundle version of folder "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin"
Adobe Flash Plugin Version
Period
6 hours
| * Results in a true/false |
if (not exists folder "/Library/Internet Plug-Ins/Flash Player.plugin") then ERROR "Not Installed" else bundle version of folder "/Library/Internet Plug-Ins/Flash Player.plugin"
Adobe Flash Plugin Blocked
Period
6 hours
| * Results in a true/false |
if (not exists folder "/Library/Internet Plug-Ins/Flash Player.plugin") then ERROR "Not Installed" else if (bundle version of folder "/Library/Internet Plug-Ins/Flash Player.plugin" as version < string "MinimumPlugInBundleVersion" of dictionary "com.macromedia.Flash Player.plugin" of dictionary "10" of dictionary "PlugInBlacklist" of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" as version) then True else False
Apple Java Plugin Blocked
Period
6 hours
| * Results in a true/false |
if (not exists file "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist") then ERROR "Not Installed" else if (string "CFBundleShortVersionString" of dictionary of file "/System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/version.plist" as string) as version < (string "MinimumPlugInBundleVersion" of dictionary "com.apple.java.JavaAppletPlugin" of dictionary "10" of dictionary "PlugInBlacklist" of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" as version) then True else False
Oracle Java Version Blocked
Period
6 hours
| * Results in a true/false |
if (not exists folder "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin" OR not exists folder "/Library/PreferencePanes/JavaControlPanel.prefPane") then ERROR "Not Installed" else if (bundle version of folder "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin" as version) < (string "MinimumPlugInBundleVersion" of dictionary "com.oracle.java.JavaAppletPlugin" of dictionary "10" of dictionary "PlugInBlacklist" of dictionary of file "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist" as version) then True else False
XProtect Updater Status
Period
6 hours
| * Results in a true/false |
if (not exists dictionary "com.apple.xprotectupdater" of dictionaries of file "/var/db/launchd.db/com.apple.launchd/overrides.plist") then "Enabled" else if (boolean "Disabled" of dictionary "com.apple.xprotectupdater" of dictionary of file "/var/db/launchd.db/com.apple.launchd/overrides.plist") then "Disabled" else "Enabled"
Installed Internet Plug-Ins
Period
6 hours
| * Results in a true/false |
((name of it as string & " = " & bundle version of it as string) of folders whose (name of it ends with ".plugin") of folder "/Library/Internet Plug-ins" as string)
Relevance
mac of operating system
Sharing
| Social Media: |
Comments
 |
|
| Added 'XProtect Updater Status' | |
