Mac running with non-standard permissions....your Mac may be insecure

Question

Hello, 
 Just got a pop up from Sophos Endpoint saying:" Please contact your system administrator. (I don't have one). Your Mac is running with non-standard permissions on key directories and your Mac may be insecure. Reference knowledge base article # 131959. 
 Can anyone please explain this to me? What should I do? 
 
 Many thanks.

Susan Frykberg · Answer

Yes, I just got this too, last night. Updated Sophos and did a system scan (2 issues), but this morning when I came on again, got the same message. Had a look at a previous discussion on 131959 it but it looked like it was for coders, not me (yet). Look forward to solving this. Thanks, Susan

Rodolfo Rosales · Answer

Please see 
 https://community.sophos.com/products/endpoint-security-control/f/sophos-endpoint-software/109120/i-have-the-same-problem-re-131959/393267#39326713 
 where I suggest an answer [it worked for me] that requires minimal computer savvy.

Peter Moorhouse · Answer

Tracey P said: 
 Hi, I am not-so-computer savvy, but I am very willing to correct issues on my own when given clear instructions. I'm wondering if anyone has come up with anything to fix this? 'tis the season for online payments, but I am afraid to buy anything online because I don't know if this is a serious threat, or just some kind of "quirk," meaning the message will keep popping up, but I have nothing to actually worry about. 
 PLEASE ADVISE!! THANK YOU. 
 
 Hi, 
 I too have this same message on my Mac (El Capitan) & see that several others have reported the same problem. 
 Do Sophos monitor these discussions? It would appear not or they might have responded & tried to explain what the message means & put our minds at ease. 
 In my experience, all contact with help desks & computer geeks is very confusing, because they seem to not understand that, those seeking assistance may not have the same depth of computer knowledge that they have & use terminology which is not helpful to a computer illiterate such as me. 
 I want to check my on-line bank account but don't know from the Sophos message whether it is safe to log on. 
 If anyone can help, I would be very grateful.

Rodolfo Rosales · Answer

Hi, I need to point out that I am no expert at all. I discovered this by sheer luck, when trying to track an error that I thought was caused by CCC (Carbon Copy Cloner), and the tech help at CCC (best customer service I've ever seen, no kidding) gave me the key idea that solved this problem. This said, here are two grains of salt: 
 "Idea #1" Note that the Mac allows you to check a box that says "ignore ownership on this volume". You cannot do this from the boot volume, but you can do it to the other volumes. Now, if you ever started from another volume, and this got checked in your regular start up volume, what happens is that the way ownership gets displayed changes. In particular, you get no "wheel", but see "staff". If you have never used multi-boot [i.e.: more that one operating system with several partitions in your HD], then this would not apply to you. 
 "Idea #2". This, I think, is the more likely cause of your trouble. The "Get Info" window allows you to add or subtract ownership [the + and - buttons below the permissions area]. Maybe "wheel" got subtracted, somehow --- either by you or by some software installer with a bug [not through the Get Info window, of course; there are other ways to change permissions]. Try to put it back, using the + button, and then give it the correct permissions. 
 Good luck. This message is very annoying. Worse, there is actually a vulnerability involved, so you should try to correct it. Worse case scenario, call support at Sophos and bring a carload of patience with you.