12 ms·
Apple support forums confirm malware explosion
- passingbyhi 15y ago> I'm researching anti-malware solutions for Mac. Sophos free for Mac: http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition.aspx http://www.sophos.com/en-us/products/free-tools/sophos-antiv... Avast (beta) free for Mac: http://forum.avast.com/index.php?topic=78646.0 http://forum.avast.com/index.php?topic=78646.0 ClamXav (free) for Mac: http://www.clamxav.com/ http://www.clamxav.com/
- noelchurchill 15y agoUgh it's finally happened.
- niels_olson 15y agowhat, exactly, has finally happened?
- noelchurchill 15y agoDid you the article? Serious malware on the mac.
- lotusleaf1987 15y agoWoof: http://daringfireball.net/2011/05/wolf http://daringfireball.net/2011/05/wolf
- podperson 15y agoHis links to the Apple forums to "confirm" what a big deal this is: "I have never found more than one or two in-the-wild reports. This time, the volume is truly exceptional." I went to the forums and searched for Mac Defender, Apple Security, and Mac Protector and found a few dozen posts. Plenty of people posting straightforward solutions. Definitely a nice piece of linkbait.
- gcr 15y agoHow is this new? http://macscan.securemac.com/spyware-list/ http://macscan.securemac.com/spyware-list/
- niels_olson 15y agoThanks. That was sort of my point. That and the ambiguity in the answer I was responding too.
- panacea 15y agoPermit me not to freak out over a trojan. There's no conceivable way to protect perfectly against self-install malware.
- jasonlotito 15y agoWhat? Yes there is. There are multiple solutions. 1. AV program catches the attempt, prevents the installation. 2. Much simpler from Apple's perspective: prevent installation from outside the App Store.
- panacea 15y ago0 day?
- niels_olson 15y agoI did, actually. Before I responded to you. Your comment was, however, thoroughly ambiguous. What "it"? Your response here doesn't exactly convince me to be more concerned than I was last week.
- jarin 15y agoIf I remember correctly, this isn't the first OS X trojan by any means.
- noelchurchill 15y agoYesterday I spent several hours going through discussions.apple.com and collecting requests for help from Mac users who have been affected by this issue. I found more than 200 separate discussion threads, many of them from people who have been tricked into installing this software and are desperately trying to remove it. It started with four posts on April 30; this past weekend there were 42 unique, new discussion threads on this subject. I am not unfamiliar with Apple’s forums. I’ve done similar searches in the past, especially after reading some of those same posts that Gruber called out from 2008. I have never found more than one or two in-the-wild reports. This time, the volume is truly exceptional. This appears to be the first widespread malware attack.
- younata 15y agoThere's been serious malware on the mac for ages. You have to be doing some really stupid things to get it, e.g. illegally downloading software, several porn sites do it, etc., It looks as if it's now requiring much less stupidity to get malware on the mac, but that's really all that's changed. Email scams are now considering the fact that I might be using a mac.
- rb2k_ 15y agoIsn't it still programms that the user explicitly has to install? If normal users keep their random application installing limited to the app store they should be fine. If you DO install "video players" from porn sites or download stuff off the pirate bay, you might end up with malware...
- podperson 15y agoExactly. Nothing will protect you from stupidity.
- noelchurchill 15y agoI think part of the problem is that people have been sold on the idea that Macs are safe and "there aren't any viruses for the Mac." There is this ill conceived notion that naive users hold that they aren't at risk so they'll more more inclined to install malware without thinking about or understanding the consequences.
- podperson 15y agoOnly someone who believes there are viruses for the Mac are going to fall for this scam, since it's "free antivirus software". From TFA: EB: So customers who get hit by this are installing it and giving their admin password? AC: Yes.
- pygy_ 15y agoThere are a lot of programs that require the admin password in order to be installed, for them to be installed system-wide... Usually, a single user install would be enough, but they don't provide the option (or I couldn't find it). As a consequence, users are trained to give their password to random apps, and they end up not paying attention anymore to which app they give it to.
- dholowiski 15y agoSeatbelts protect you from stupidity. So does antivirus on windows, when it works.
- Tichy 15y agoJust in time to pave the way for App Store only installs on OS X.
- cookiecaper 15y agoIt's kind of disappointing overall, because package management has always been the solution to this kind of problem. You tell users "never install anything you don't find in the repo", but now it seems somehow tainted. I guess maybe it's that nobody cares about it until Apple can make 30% of your software's retail price through it. I'm glad that systems are finally getting the same kind of package management that we have enjoyed on Linux for well over a decade, but it's a serious bummer that it has to come with such scammy-feeling commercialistic trappings before it can be brought to the masses. It's hard to put my finger on the feeling exactly.
- endgame 15y agoIs it the feeling that it won't be easy (if it's possible at all) to get Free Software on these systems?
- blantonl 15y agoYou advocated and disparaged the App Store concept, and then you railed against capitalism. Regardless of how you perceive the App Store concept, you cannot deny that it works, and it works well. Frankly, what's wrong with a package management system that charges consumers and pays commissions to the host?
- drivebyacct2 15y agoYou're missing the point. The App Store is not a package management system. In Ubuntu, I never, ever install one-off DEBs. Every single piece of software is installed through a repo. I'm able to trust that software and I don't let other apps get root privileges unless I grant them and know what's going on. The Apple App Store is not a package management system. It's a store. Developers have to relinquish control and money to have their apps listed there. Thus, many apps must still be installed manually. It's not an open ecosystem and it's not really fair to compare them. Synaptic and trusted repositories saves me from malware because there is no reason not to use them. There are many reasons not to use Apple's.
- bdittmer 15y agoExplosion? From this article it looks it's a single piece of malware that people are having trouble with. Hardly an explosion.
- sjs 15y agoPretty typical from zdnet. That site is mostly garbage. Just as Gruber doesn't say nice things about Microsoft and/or Windows, neither do Ed Bott and Mary Jo Foley say nice things about Apple and/or OS X. Ed Bott's Windows Expertise: http://www.edbott.com/weblog/ http://www.edbott.com/weblog/ Ed Bott's Microsoft Report: http://www.zdnet.com/blog/bott http://www.zdnet.com/blog/bott Mary Jo Foley's All About Microsoft: http://www.zdnet.com/blog/microsoft http://www.zdnet.com/blog/microsoft You can safely ignore 95% of everything these guys say about what they perceive to be the opposition. They make Gruber's bias look like child's play.
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- rbanffy 15y ago1 is infinitely larger than zero... Until last week, Mac malware was as common as unicorns. Now there is one. And, as pointed out, Safari's default behaviour of running stuff it deems safe automatically is very dangerous.
- hollerith 15y ago>Until last week, Mac malware was as common as unicorns. Now there is one. That might be true if "malware" includes only exploits that call attention to themselves and disseminate indiscriminately. But OS X has many times been the first OS to fall in the pwn2own competition, and since there has long been a market in OS X exploits, clearly some Mac have been being compromised.
- thaumaturgy 15y agoOur small shop had to clean up one of these yesterday. It's not hard, for now, but there are all sorts of really neat hidey-holes in MacOS for these kinds of things, and so far this piece of malware has been evolving pretty fast. It's changed names three times, and it first started propagating as a fake JavaScript alert on sites that looked like a Windows screen; now there's a pretty reasonable Finder mock-up doing the dirty deed instead. It doesn't help that there's a setting in Safari to automatically run "safe" downloads. I'm intensely curious about how far this thing goes. If it were to, say, start hooking into launchctl ... well, that would be interesting indeed.
- cbf 15y agoIt doesn't help that there's a setting in Safari to automatically run "safe" downloads. This feature has always struck me as a cordial invitation from Apple to trick their users via some means or other.
- flomo 15y agoIt used to be worse. Early versions of Safari would automatically execute a shell script as part of a "safe" download. They 'fixed' it by changing the disk image spec rather than the Safari feature. This type of exploit probably reflects how much thought was put into the feature. The "safe download" social engineering attack was outlined years ago, so it's somewhat surprising it took this long to widely exploited.
- kennywinker 15y ago>They 'fixed' it by changing the disk image spec rather than the Safari feature. Which was the right thing to do, by the way. I don't want disk images running shell scripts when they are mounted manually OR automatically.
- jdq 15y agoThe piece reads more like he is trying to defend himself after being called out by Gruber.
- ceejayoz 15y agoThe really terrifying thing about this is how easily malware writers are able to slip their downloads into major web sites. I got the MacDefender alerts on MSNBC.com.
- nkassis 15y agoAd networks will doom us all.
- RexRollman 15y agoAgreed. And this kind of thing is why I install NoScript on Firefox these days.
- teilo 15y agoI run a mac-heavy shop. About 40 of them at present. The naysayers who want to downplay this as business as usual are wrong. I have had three cases of this within two weeks at my company. Prior to that time, I have not had a single piece of Mac malware infect my machines over a period of 8 years. This is not business as usual. I expect to find a whole lot more of this in the near future, and for the first time since I've managed IT at this company, I'm researching anti-malware solutions for Mac.
- rbanffy 15y ago> I'm researching anti-malware solutions for Mac. I'd advise you to educate your users (as not to enter their passwords every time the computer asks them for no apparent reason), run proper backups and check Safari (and other browser) defaults.
- teilo 15y agoAs an alternative to anti-malware? You're kidding, right? Do you really think that Mac users are inherently less gullible than Windows users? I have been in this business long enough to know that there are always certain users who will click anything that pops up on their screen, no matter how clearly you try to convince them otherwise. If education solves your future Mac virus problem, then more power to you. But that's just not the real world.
- cosgroveb 15y agoGullibility isn't even necessary to have machines get infected by malware. There have been cases in the past of ad networks serving ads infected by flash zero days. You don't have to run a downloaded executable to get an infected machine.
- 27182818284 15y agoExactly. I'm not worried about downloading an email, most of the non-savvy users I know understand not to do that anymore, I'm worried about something like Flash being the vector of the virus.
- dkl 15y agoAnyone know if it is just Safari that allows infection? What about Chrome?
- bradleyland 15y agoThe infection doesn't actually occur within Safari. When you click a link, your browser is redirected to a file download. The default behavior in Safari is to unpack and run "safe" downloads. So, what happens is: 1. You click a link in Safari 2. The installer package is downloaded 3. Safari unpacks it and executes the installer Note: you are not infected yet 4. The user completes the installer wizard, entering their password along the way 5. The computer is "infected" This sucks, but it's not a drive-by infection. Yet. Chrome does not unpack and run downloads, so you'd have to execute the downloaded package yourself.
- watmough 15y agoHeh, I just got an email that did a remarkable job of appearing exactly like a typical Apple Store email. Be careful out there folks. You don't know what's on the other end of that link.
- miniklop 15y agoi use this firewall www.protemac.com/netmine few months no problems or attaks)!