10 ms·

Apple to support reps: 'Don't confirm Mac infections'

135 points by foob 15y ago

Garbage 15y ago
Original post - http://news.ycombinator.com/item?id=2564429 http://news.ycombinator.com/item?id=2564429
bonch 15y ago
It says right in the article that AppleCare doesn't cover what users do to their machines. Microsoft doesn't remove malware that Windows users install either. This thing is coming from Ed Bott's Microsoft column on ZDNet, where he's been hitting this hard for the second day in a row based on an "investigation" that involved him scouring the Apple discussion forums for a couple of hours. Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?
- illumin8 15y ago
  The Mac Defender malware is pretty harmless. It downloads as a zip file, and users must manually click through the entire installer just to get it installed. How many Windows viruses are delivered as a setup.exe where you have to click next about 3 times and enter your admin password just to install it? As usual anti-mac trolls love to jump on the bandwagon and bash the platform with one of the best security track records running.
  - lotusleaf1987 15y ago
    "[Bott] cited an internal document titled "About 'Mac Defender' Malware," which was last updated on May 16 and says that the trojan, which surfaced earlier this month and masquerades as legitimate security software for the OS X platform" I find it ironic that Bott's fear mongering is leading the naive to download shady anti-virus software that is actually adware. These articles are really just contributing to the problem by misinforming people. Ed Bott is the equivalent of Glen Beck.
    - innes 15y ago
      Ed 'Glen Beck' Bott is apparently more influential amongst non-technical Mac users than anyone might have expected!
  - deleted 15y ago
    [deleted]
  - Niten 15y ago
    Most Windows viruses these days have the exact same attack vector, simply tricking the user into installing them. All we're seeing here is that: (1) Despite the marketing, the Mac is not magically immune to these things any more than Windows is, and (2) now that OS X has obtained a reasonable market share it's finally become worth attacking. Neither of these things should be surprising to anyone, and hopefully the antimalware situation on OS X will improve before progressively more insidious Mac viruses are released.
    - jonhohle 15y ago
      > and hopefully the antimalware situation on OS X will improve before progressively I don't think antimalware is anything I'd ever want to run on a computer I control. Unfortunately, I think we're being pushed into a world where all applications are vetted and purchased through a trusted marketplace, eliminating this vector.
      - Niten 15y ago
        > I don't think antimalware is anything I'd ever want to run on a computer I control. Why not? I mean this as an honest question. EDIT: If you're concerned about performance or system resources, try a PC with MSE sometime, I think you'll be pleasantly surprised at how unobtrusive good antimalware can be.
        danssig 15y ago
        Have you ever ran a windows machine without all this stupid virus/malware software running? It's dramatically faster. Anti-malware/virus software was a stupid road to go down, the proper solution is to have better security on the machine.
        JonoW 15y ago
        I run MSE, I barely notice it speed wise, and haven't had any malware or viruses. On your comment: > the proper solution is to have better security on the machine. Strongly disagree; if you look at this MacDefender issue, there is no flaw in OSX that is causing infection, users are installing it on their own accord. But what anti-malware/virus software can do here is warn or prevent the user from installing this in the first place, as it should detect the virus/malware signature. This is why you need it even if the underlying OS is secure, to try protect users from themselves.
  - sliverstorm 15y ago
    ... the platform with one of the best security track records running. Have you forgotten that Darwin is by and large derived from BSD? Apple is standing on the shoulders of giants with this one.
- Niten 15y ago
  > Microsoft doesn't remove malware that Windows users install either. Yes they do: http://support.microsoft.com/kb/129972/en-us http://support.microsoft.com/kb/129972/en-us "Call 1-866-PCSAFETY or call 1-866-727-2338 to contact security support." > Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait? If Apple is issuing special instructions to its support staff about this malware, then clearly this is a pronounced problem.
  - kenjackson 15y ago
    Not only that but Microsoft has an anti-virus anti-malware application. AND as part of Windows Update they regularly run the malicious program removal tool. And I suspect MS would ship antivirus built into Windows if they could. Unfortunately, antitrust makes packaging things that make sense a non-starter if other companies sell it.
    - Niten 15y ago
      Oh they absolutely would. Heck, Windows Defender is the same engine as MSE, they just had to limit its functionality to keep from getting sued. They were even threatened by the third-party antivirus companies when they promoted a link to MSE in Microsoft Update. But hopefully they can take a more proactive course now that the DoJ's oversight is ending: http://arstechnica.com/microsoft/news/2011/04/department-of-justices-long-oversight-of-microsoft-to-end.ars http://arstechnica.com/microsoft/news/2011/04/department-of-...
      - yuhong 15y ago
        Huh? Windows Defender existed before MSE.
    - deleted 15y ago
      [deleted]
    - vacri 15y ago
      Not only that, but Microsoft isn't a direct retailer, they're a wholesaler. If you have a problem with your machine, it's the responsibility of the person who sold it to you to ensure it is fit for purpose, not the upstream provider. Apple is a direct retailer.
- foob 15y ago
  I think that it's reasonable if Apple doesn't want to provide support for fixing malware problems on systems that they've sold regardless of how any other company chooses to handle such issues. Also, this issue is obviously independent of OS as the exploited security hole is the users' lack of understanding. That said, the reason that I thought this article was hackernews worthy is because Apple is encouraging employees to knowingly withhold information about malicious software running on users' computers. I personally find that to be an inappropriate approach in almost any situation. What are your thoughts on this aspect of the article?
- demallien 15y ago
  Not to mention that Apple is the only company to have started building a defence to the 'clueless user' problem,with the Mac App Store. It's going to become increasingly more difficult for trojan horse authors to convince users to install their non-App Store application, the more that people become accustomed to that being the way to install software on a Mac.
lotusleaf1987 15y ago
Woof: http://daringfireball.net/2011/05/wolf http://daringfireball.net/2011/05/wolf "According to a third article penned by Bott, AppleCare reps are seeing a four- to five-fold increase in the number of calls requesting support for rogue antivirus scams targeting the Mac" So now a handful of incidents is cause for uproar? "Porn sites just started popping up on my MacBook Pro," one user wrote. "Is this a virus? I have never had a virus on a Mac before and I have been using Macs for years. Please help!" So it's just adware then? Oh no!
progolferyo 15y ago
As a PC turned Mac user for the last 3 years, this is truly the best thing about working on the Mac platform. My girlfriend is still on her shitty HP laptop and it is so incredibly painful to watch her worry about viruses and malware on a daily basis. I hope Apple's policy around this is not going to be sweep it under the rug because it could get out of control as Apple market share grows and more effort is dedicated towards hacking the Mac. As stupid as this story is, it is still something that Apple is gonna have to probably start paying more and more attention to, given the trajectory of Apple market share in the future and the increased effort will be taken towards the Mac platform. I think
- bandushrew 15y ago
  There isn't much apple can do in a practical sense. People clueless enough to run an Installer based on an web ad popup are unlikely to be reading Apple's PR posts. Aside from OS specific code that refuses to install anything called Mac Defender, Apple has no power over this problem.
  - darren_ 15y ago
    You've basically described 10.6's anti-malware 'solution', although obviously its little plist file hasn't been updated to include Mac Defender yet.
    - bandushrew 15y ago
      LOL ...and to me, that sounded kind of silly...
- darren_ 15y ago
  A positive step for Lion is that they've started actively engaging members of the exploit research community, although details are scarce on what that means or how seriously they'll take their advice. Proper ASLR and sandboxing Safari by default would help a lot, I think.
  - 15y ago
sliverstorm 15y ago
The real news is not that Apple won't remove malware, it's that Apple is apparently actively working to conceal the truth and perpetuate the Mac-selling legend that Macs cannot get viruses.
- mambodog 15y ago
  Apple is doing the most sensible thing for their business. An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past. However, from a marketing point of view it's a lot harder to sell. Compare: You can't get viruses on Mac. with: Using a Mac you are very unlikely to get a virus, and provided you don't download and install anything shady ad/spyware isn't a concern either. The second statement is true of Macs today, and still presents an advantage over Windows, but "No viruses" is a much simpler message, and one it seems they are trying to keep (superficially) intact.
  - Niten 15y ago
    > An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past. Well yes, but lately how are these drive-by installations happening? Mostly through holes in third-party software. My concern, as a Mac user, is that there's no fundamental reason it should be any harder to attack OS X this way; it's just that up until now Windows has been a vastly more profitable target. And that is changing. If you're a careful and conscientious user I'd honestly say you're safer on Windows at this point, because Windows is used to being attacked. It's used to defending itself against this kind of threat. You have this ecosystem of powerful antivirus programs like MSE or AntiVir that update themselves constantly, and innumerable other third-party tools such as Secunia PSI as preventative measures, and these just don't really exist on OS X yet. Windows also yet has some exploit mitigation facilities that OS X lacks, such as ASLR and kernel patch protection. It will be a while before OS X has developed such an ecosystem of its own, and we just have to hope the adjustment period won't be too painful.
innes 15y ago
As the OS gets more popular, Apple will need to add the kind of protective features present in Windows to deal with this sort of problem. Dismissing it isn't gonna work - this kind of malware is the problem these days rather than viruses. As a savvy user, I've never found the need to run antivirus software on Windows, but it would be the height of arrogance for me to scoff at the problems others do have and blame it on their stupidity. As is the way with these things, Apple will stonewall, but I expect eventually handle the issue. In the mean time some of the congregation will snort in derision and deny there's a problem.
- Steko 15y ago
  Apple is not going to solve the problem of gullible people typing their credit card info into a scammer's form, any Mac based solution (of which the obvious will be to lock down installation to the Mac App Store) is just going to push scammers back on the web.
  - innes 15y ago
    No, but they can help solve the problem of gullible people downloading and running installers for known malware. Honestly, listening to some Mac user responses to this problem, it's like entering a timewarp back to when all the measures implemented on Windows/IE to deal with this stuff hadn't even been thought up. Possibly a quick fix, until it's addressed, is for folk on OSX to do their web surfing in a Windows VM, using a security-focussed browser designed for non-technical people, such as IE9. ;-)
    - danssig 15y ago
      >Honestly, listening to some Mac user responses to this problem, it's like entering a timewarp back to when all the measures implemented on Windows/IE to deal with this stuff hadn't even been thought up. That's because many of the measures implemented on windows are fundamentally flawed. Virus/Malware scanners? Really? So we want to turn infecting people's computers into a business? The MS approach has always been to make money on working around defects. I really, really hope Apple doesn't decide to go down this route.
maqr 15y ago
The users who are most likely to be infected by this stuff are the same users that Apple caters to in person in their stores. Many Apple customers (at least the ones that I know) have become used to in-store "geniuses" fixing their difficult computer problems -- setting up their email, installing software, that kind of thing. This is going to be very difficult for Apple stores to handle.
- furyg3 15y ago
  It's not really that hard, Windows support guys have been doing it forever. And, like almost everything else, it's easier on a mac (my mom got this malware... on mother's day) The problem is: naive user + attack vector (bad default Safari options) + malicious attacker (advertising network). The solution is: * Cleanup - Kill process form activity monitor, delete app from Applications, and installers from Downloads folder (kinda shocked that there isn't more to it). * Inform - Teach user about basic practices. * Close vector - Safari's Automatically open safe files after download checkbox. * Block attacker - Install AdBlock for Safari (Bonus points). All of the above, except the 'informing' part, takes all of two minutes to do, so I think the "Geniuses" at the Apple Stores can manage. To those entrepreneurs whose business model is based on ads... sorry, but Adblock is the new Antivirus. I install it alongside any software updates or antivirus software (even on Macs, now).
  - beaumartinez 15y ago
    > Cleanup [...] kinda shocked that there isn't more to it. Perhaps not with this "first generation" of OS X malware. On Windows some malware replicate to files and have other self-preservation quirks making anti-malware software necessary. > I think the "Geniuses" at the Apple Stores can manage. Against simple malware, yes. When crackers start investing time and effort into their malware (like on Windows), it'll be a different case altogether.
to 15y ago
go to google, search for "piece sign" on image search. click on the ~20 image, black very slim lines white background next to piece sign with globe in background and alien head like looking piece sign. host is decinet.com or something. (im on my phone right now) watch what happens next... thats the trojan, unzips automatically in safari.
yuhong 15y ago
Personally I feel that top-down control of customer support agents is fundamentally flawed these days, but that is a different matter.
morganpyne 15y ago
To be honest, I'm just curious why we haven't seen much real malware yet. The Mac Defender stuff is a joke, but there's no reason why somebody couldn't be exploiting the recent Skype bug (http://www.purehacking.com/blogs/gordon-maddern/skype-0day-vulnerabilitiy-discovered-by-pure-hacking http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v...), or the Chrome/Flash bug (http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php), the bugs found at pwn2own or the myriad other holes which are closed regularly via updates.
- orijing 15y ago
  The reason is scale and alternative options: If you're a hacker, why focus on the Mac when you can target 10x as many people on Windows?
  - morganpyne 15y ago
    I have often seen this mantra repeated, but I can't believe that this is enough to dissuade every single hacker. With Macs approaching 10% of the market this has got to be worth somebodies time to have a go. And yet, I know a lot of folks with Macs and not a single one has ever had malware issues. Either nobody is getting hit, or they are getting hit with stuff so good and stealthy that they just don't know it :-) I'm certainly not arguing that Macs are invulnerable (far from it), I'm just genuinely curious why somebody somewhere isn't stepping in to fill the malware niche.
    - seabee 15y ago
      Malware might bring money in, but that doesn't make it a business. You can't exactly corner the market or rely on word of mouth; your targets are largely random and diverse. When you have a random choice, the only rational decision is to pick the most likely option: Windows.
    - jasonlotito 15y ago
      > With Macs approaching 10% of the market this has got to be worth somebodies time to have a go. Well, apparently there is an issue. Enough so that Apple has taken notice.
telleman 15y ago
The problem is real this time and Apple needs to get off its ass. I'm the IT guy at a (mostly) Mac startup. In the last week I've had two users come to me about the Mac Defender Malware. One was smart enough to email me when he saw the window, but the other managed to infect his machine. (Older gentleman. We don't pay him for his computer expertise.) I told him to go to the Mac Store and ask them to reinstall his operating system. I would do it myself, but it's a Macbook Air (no CD-drive) and a personal machine. I am pretty upset to read that the Mac store people are not going to be helpful to him (landing the problem back in my lap). We spend a lot of money on Apple products for the slender justification that they'll "just work" -- which is often a joke at the best of times.
nchlswu 15y ago
As far as I'm concerned, when I read this I had no problems with what Apple is doing. They got a memo stating that Apple is looking into it, and don't confirm/deny malware. That's what they're supposed to do, no? This is hardly a cover up. Apple is simply reminding their support staff to not make promises they can't keep. This is a holdover till they have a solution. If their permanent solution is a cover up, that's a whole other story.
- Niten 15y ago
  I agree... although it would be nice if they would step up for their customers in this regard, I just don't see a scandal here. (That's just The Register's style of reporting I guess, not to diss them or anything.) However, the letter itself is interesting in that it confirms Mac malware is becoming a real issue.
- smackfu 15y ago
  I have a real issue with directing people to say "we are not aware of a thing" in a memo that shows they are clearly aware of it.
learc83 15y ago
I worked in Geek Squad for 5 years (finally started making a enough money doing freelance development to quit this past december). I've done malware removal on 5-10 computers a day, 5 days a week for most of that time. So I've seen thousands of malware infections on the average consumer's computer. I've seen more different malware infections than just about anyone outside of an antivirus research lab. When I first started most of malware came from users downloading files from P2P sites. However, for the last 2 years nearly all the malware I found was installed via a drive-by download that happened without user input. You can talk all you like about avoiding porn sites and installing AV software, but it's not that simple. The majority of the computers I worked on had current AV programs--they weren't able to prevent the infections. The situation with malware and windows is absolutely terrible, and it doesn't only happen to idiots who stuff their drives with porn. Macs have security flaws--they aren't perfect, but when compared to the malware ghetto I've dealt with over the years, calling this a mac malware problem an "explosion" is just ridiculous.
- jbri 15y ago
  > and it doesn't only happen to idiots who stuff their drives with porn. Instead, it only happens to people who don't keep their browser up to date so that it's actually vulnerable to drive-by downloads. Right?
  - learc83 15y ago
    I've seen plenty of the same fake AV malware that installs itself via drive-by downloads on computers with up to date firefox installs. Security patches aren't instant. Updating your browser helps sure, but it's not a real solution. There is a tendency for people like us to assume every time we see someone with a malware infection that it must be because the user is a moron who: still uses Kazaa, doesn't know about the good porn sites, is browsing on IE6 and installs anything that a popup asks him too. That just isn't true. It's not just idiots, the average non-moron windows user is massively vulnerable to malware. In my experience (I'll limit it to friends and family b/c of the obvious selection bias of including Geek Squad customers), nearly every (non developer) windows user I know has had at least one malware infection over the last few years that required either my help, or a system restore.
augustl 15y ago
I hope Apple solve this by creating a consumer version or mode of OS X with a sandbox similar to iOS. I'd love if my mom had no way of installing software that could break the computer, without doing scary sounding stuff like "jailbreaking" or "enable developer mode".
- fuzionmonkey 15y ago
  Chrome OS is the epitome of this. The whole operating system is just a browser. Nothing to configure, install or break.
- wesley 15y ago
  Isn't that what an account with parental controls are for? http://gigapple.files.wordpress.com/2008/12/system-pc.png?w=604 http://gigapple.files.wordpress.com/2008/12/system-pc.png?w=...
wesley 15y ago
OSX Lion better have an outgoing firewall.. Anyone know?
- ericd 15y ago
  Little Snitch can do this currently, if you're looking. Outbound firewalls are somewhat annoying, though, as you have to authorize every single program at least once, which makes me think that Apple is unlikely to add one that runs by default.
  - wesley 15y ago
    Just wondering, could a trojan somehow control safari (or other approved apps) via a script, and then upload files to the hacker's server, circumventing little snitch and other outgoing firewalls?
    - podperson 15y ago
      A trojan can do anything a user can do, so yes. The one thing Lion has going for it here is that apps can declare their intention to do certain things and then be prohibited from doing anything else. So, for example, a non networked app can tell the OS it has no interest in using network APIs and will then be sandboxed from them (so if its code is violated it won't be able to suddenly start phoning home). But, of course, this requires effort on developers' parts to support the feature. The key thing is that Apple's own apps are likely to use this feature. But if you download some random piece of software and then run it and the OS says "are you sure?" and you answer yes then you're boned. And again, if you already said "yeah" to "run this bizarro app from disreputable source", are you going to say "omfg no" when asked if it can use the network?
- lloeki 15y ago
  So what? A user who has been tricked into installing Mac Defender will be just as easily tricked into authorizing Mac Defender to get out.
Groxx 15y ago
More abuse of the term "infection": >The con artists behind Mac Defender hook their victims by presenting Mac-using web surfers with images that depict an antivirus scan taking place on their machines. The images falsely claim users are infected with serious malware and urge them to download and install the antivirus package. Those who fall for the ruse are then infected. Yes. It's malware. It has infected the computer. Because they downloaded and installed it willingly. But "infection" implies "virus" to most people, and this is nothing of the sort.
burn-a-mac 15y ago
Hopefully this will make people think twice before buying crap produced by Apple.
primeMover2010 15y ago
awesome. even malware has higher usability on mac, than it has on other platforms. and if you pay for the snake oil.. errrr... remedy, the virus is gone. the virus writers are pretty awesome social engineers.
illumen 15y ago
Yesterday I saw some mac osx malware being served up from a website listed in google image search results. The search was Flamenco or something like that. My girlfriend pulled me over to show me that this website was saying it was from apple security and that I needed to download a tool to remove the Trojan. Having just come back from a visit to Turkey, we found the Trojan reference funny. I think if she was surfing with safari the .zip file would have extracted automatically, which I think would have caused many people to run whatever evil was stored inside.
- tjogin 15y ago
  That definitely is a stupid default setting.
patrickk 15y ago
Here's an article comparing some decent Mac antivirus applications for those who are concerned: http://lifehacker.com/5800267/the-non+alarmists-guide-to-mac-malware-protection http://lifehacker.com/5800267/the-non+alarmists-guide-to-mac...
Caballera 15y ago
Mac Protector (another name for Mac Defender) tried to install on my wive's new MacBook Pro the other day when she went to live.com to get the last of her contacts and some emails. She knew not to provide it with permission to install and panic and disaster was adverted. Mac Defender does look pretty real though and I could see how the uninformed or people that easily panic would give it permission to install. As one second your on the web then a 'window' pops up saying your infected with Virus and to get the latest downloads ect., and it all looks convincingly real. I don't regret switching to Mac myself as my Mac runs so much smoother then any Windows PC, plus installation of software is a breeze, my MacBook Pro starts up in 15 seconds and it just works right out the box. There was no crapware pre-installed like my old HP laptop. Additionally, when I researched looking into purchasing my MacBook Pro I saw that Apple does recommend using Anti-virus software and I do have it installed, with no issues and it doesn't slow my MacBook Pro down a bit.

135 points by foob 15y ago

Original post - http://news.ycombinator.com/item?id=2564429 http://news.ycombinator.com/item?id=2564429

bonch 15y ago

It says right in the article that AppleCare doesn't cover what users do to their machines. Microsoft doesn't remove malware that Windows users install either. This thing is coming from Ed Bott's Microsoft column on ZDNet, where he's been hitting this hard for the second day in a row based on an "investigation" that involved him scouring the Apple discussion forums for a couple of hours. Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?

illumin8 15y ago
The Mac Defender malware is pretty harmless. It downloads as a zip file, and users must manually click through the entire installer just to get it installed. How many Windows viruses are delivered as a setup.exe where you have to click next about 3 times and enter your admin password just to install it? As usual anti-mac trolls love to jump on the bandwagon and bash the platform with one of the best security track records running.
- lotusleaf1987 15y ago
  "[Bott] cited an internal document titled "About 'Mac Defender' Malware," which was last updated on May 16 and says that the trojan, which surfaced earlier this month and masquerades as legitimate security software for the OS X platform" I find it ironic that Bott's fear mongering is leading the naive to download shady anti-virus software that is actually adware. These articles are really just contributing to the problem by misinforming people. Ed Bott is the equivalent of Glen Beck.
  - innes 15y ago
    Ed 'Glen Beck' Bott is apparently more influential amongst non-technical Mac users than anyone might have expected!
- deleted 15y ago
  [deleted]
- Niten 15y ago
  Most Windows viruses these days have the exact same attack vector, simply tricking the user into installing them. All we're seeing here is that: (1) Despite the marketing, the Mac is not magically immune to these things any more than Windows is, and (2) now that OS X has obtained a reasonable market share it's finally become worth attacking. Neither of these things should be surprising to anyone, and hopefully the antimalware situation on OS X will improve before progressively more insidious Mac viruses are released.
  - jonhohle 15y ago
    > and hopefully the antimalware situation on OS X will improve before progressively I don't think antimalware is anything I'd ever want to run on a computer I control. Unfortunately, I think we're being pushed into a world where all applications are vetted and purchased through a trusted marketplace, eliminating this vector.
    - Niten 15y ago
      > I don't think antimalware is anything I'd ever want to run on a computer I control. Why not? I mean this as an honest question. EDIT: If you're concerned about performance or system resources, try a PC with MSE sometime, I think you'll be pleasantly surprised at how unobtrusive good antimalware can be.
      - danssig 15y ago
        Have you ever ran a windows machine without all this stupid virus/malware software running? It's dramatically faster. Anti-malware/virus software was a stupid road to go down, the proper solution is to have better security on the machine.
        JonoW 15y ago
        I run MSE, I barely notice it speed wise, and haven't had any malware or viruses. On your comment: > the proper solution is to have better security on the machine. Strongly disagree; if you look at this MacDefender issue, there is no flaw in OSX that is causing infection, users are installing it on their own accord. But what anti-malware/virus software can do here is warn or prevent the user from installing this in the first place, as it should detect the virus/malware signature. This is why you need it even if the underlying OS is secure, to try protect users from themselves.
- sliverstorm 15y ago
  ... the platform with one of the best security track records running. Have you forgotten that Darwin is by and large derived from BSD? Apple is standing on the shoulders of giants with this one.
Niten 15y ago
> Microsoft doesn't remove malware that Windows users install either. Yes they do: http://support.microsoft.com/kb/129972/en-us http://support.microsoft.com/kb/129972/en-us "Call 1-866-PCSAFETY or call 1-866-727-2338 to contact security support." > Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait? If Apple is issuing special instructions to its support staff about this malware, then clearly this is a pronounced problem.
- kenjackson 15y ago
  Not only that but Microsoft has an anti-virus anti-malware application. AND as part of Windows Update they regularly run the malicious program removal tool. And I suspect MS would ship antivirus built into Windows if they could. Unfortunately, antitrust makes packaging things that make sense a non-starter if other companies sell it.
  - Niten 15y ago
    Oh they absolutely would. Heck, Windows Defender is the same engine as MSE, they just had to limit its functionality to keep from getting sued. They were even threatened by the third-party antivirus companies when they promoted a link to MSE in Microsoft Update. But hopefully they can take a more proactive course now that the DoJ's oversight is ending: http://arstechnica.com/microsoft/news/2011/04/department-of-justices-long-oversight-of-microsoft-to-end.ars http://arstechnica.com/microsoft/news/2011/04/department-of-...
    - yuhong 15y ago
      Huh? Windows Defender existed before MSE.
  - deleted 15y ago
    [deleted]
  - vacri 15y ago
    Not only that, but Microsoft isn't a direct retailer, they're a wholesaler. If you have a problem with your machine, it's the responsibility of the person who sold it to you to ensure it is fit for purpose, not the upstream provider. Apple is a direct retailer.
foob 15y ago
I think that it's reasonable if Apple doesn't want to provide support for fixing malware problems on systems that they've sold regardless of how any other company chooses to handle such issues. Also, this issue is obviously independent of OS as the exploited security hole is the users' lack of understanding. That said, the reason that I thought this article was hackernews worthy is because Apple is encouraging employees to knowingly withhold information about malicious software running on users' computers. I personally find that to be an inappropriate approach in almost any situation. What are your thoughts on this aspect of the article?
demallien 15y ago
Not to mention that Apple is the only company to have started building a defence to the 'clueless user' problem,with the Mac App Store. It's going to become increasingly more difficult for trojan horse authors to convince users to install their non-App Store application, the more that people become accustomed to that being the way to install software on a Mac.

lotusleaf1987 15y ago

Woof: http://daringfireball.net/2011/05/wolf http://daringfireball.net/2011/05/wolf "According to a third article penned by Bott, AppleCare reps are seeing a four- to five-fold increase in the number of calls requesting support for rogue antivirus scams targeting the Mac" So now a handful of incidents is cause for uproar? "Porn sites just started popping up on my MacBook Pro," one user wrote. "Is this a virus? I have never had a virus on a Mac before and I have been using Macs for years. Please help!" So it's just adware then? Oh no!

progolferyo 15y ago

As a PC turned Mac user for the last 3 years, this is truly the best thing about working on the Mac platform. My girlfriend is still on her shitty HP laptop and it is so incredibly painful to watch her worry about viruses and malware on a daily basis. I hope Apple's policy around this is not going to be sweep it under the rug because it could get out of control as Apple market share grows and more effort is dedicated towards hacking the Mac. As stupid as this story is, it is still something that Apple is gonna have to probably start paying more and more attention to, given the trajectory of Apple market share in the future and the increased effort will be taken towards the Mac platform. I think

bandushrew 15y ago
There isn't much apple can do in a practical sense. People clueless enough to run an Installer based on an web ad popup are unlikely to be reading Apple's PR posts. Aside from OS specific code that refuses to install anything called Mac Defender, Apple has no power over this problem.
- darren_ 15y ago
  You've basically described 10.6's anti-malware 'solution', although obviously its little plist file hasn't been updated to include Mac Defender yet.
  - bandushrew 15y ago
    LOL ...and to me, that sounded kind of silly...
darren_ 15y ago
A positive step for Lion is that they've started actively engaging members of the exploit research community, although details are scarce on what that means or how seriously they'll take their advice. Proper ASLR and sandboxing Safari by default would help a lot, I think.
- 15y ago

sliverstorm 15y ago

The real news is not that Apple won't remove malware, it's that Apple is apparently actively working to conceal the truth and perpetuate the Mac-selling legend that Macs cannot get viruses.

mambodog 15y ago
Apple is doing the most sensible thing for their business. An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past. However, from a marketing point of view it's a lot harder to sell. Compare: You can't get viruses on Mac. with: Using a Mac you are very unlikely to get a virus, and provided you don't download and install anything shady ad/spyware isn't a concern either. The second statement is true of Macs today, and still presents an advantage over Windows, but "No viruses" is a much simpler message, and one it seems they are trying to keep (superficially) intact.
- Niten 15y ago
  > An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past. Well yes, but lately how are these drive-by installations happening? Mostly through holes in third-party software. My concern, as a Mac user, is that there's no fundamental reason it should be any harder to attack OS X this way; it's just that up until now Windows has been a vastly more profitable target. And that is changing. If you're a careful and conscientious user I'd honestly say you're safer on Windows at this point, because Windows is used to being attacked. It's used to defending itself against this kind of threat. You have this ecosystem of powerful antivirus programs like MSE or AntiVir that update themselves constantly, and innumerable other third-party tools such as Secunia PSI as preventative measures, and these just don't really exist on OS X yet. Windows also yet has some exploit mitigation facilities that OS X lacks, such as ASLR and kernel patch protection. It will be a while before OS X has developed such an ecosystem of its own, and we just have to hope the adjustment period won't be too painful.

innes 15y ago

As the OS gets more popular, Apple will need to add the kind of protective features present in Windows to deal with this sort of problem. Dismissing it isn't gonna work - this kind of malware is the problem these days rather than viruses. As a savvy user, I've never found the need to run antivirus software on Windows, but it would be the height of arrogance for me to scoff at the problems others do have and blame it on their stupidity. As is the way with these things, Apple will stonewall, but I expect eventually handle the issue. In the mean time some of the congregation will snort in derision and deny there's a problem.

Steko 15y ago
Apple is not going to solve the problem of gullible people typing their credit card info into a scammer's form, any Mac based solution (of which the obvious will be to lock down installation to the Mac App Store) is just going to push scammers back on the web.
- innes 15y ago
  No, but they can help solve the problem of gullible people downloading and running installers for known malware. Honestly, listening to some Mac user responses to this problem, it's like entering a timewarp back to when all the measures implemented on Windows/IE to deal with this stuff hadn't even been thought up. Possibly a quick fix, until it's addressed, is for folk on OSX to do their web surfing in a Windows VM, using a security-focussed browser designed for non-technical people, such as IE9. ;-)
  - danssig 15y ago
    >Honestly, listening to some Mac user responses to this problem, it's like entering a timewarp back to when all the measures implemented on Windows/IE to deal with this stuff hadn't even been thought up. That's because many of the measures implemented on windows are fundamentally flawed. Virus/Malware scanners? Really? So we want to turn infecting people's computers into a business? The MS approach has always been to make money on working around defects. I really, really hope Apple doesn't decide to go down this route.

maqr 15y ago

The users who are most likely to be infected by this stuff are the same users that Apple caters to in person in their stores. Many Apple customers (at least the ones that I know) have become used to in-store "geniuses" fixing their difficult computer problems -- setting up their email, installing software, that kind of thing. This is going to be very difficult for Apple stores to handle.

furyg3 15y ago
It's not really that hard, Windows support guys have been doing it forever. And, like almost everything else, it's easier on a mac (my mom got this malware... on mother's day) The problem is: naive user + attack vector (bad default Safari options) + malicious attacker (advertising network). The solution is: * Cleanup - Kill process form activity monitor, delete app from Applications, and installers from Downloads folder (kinda shocked that there isn't more to it). * Inform - Teach user about basic practices. * Close vector - Safari's Automatically open safe files after download checkbox. * Block attacker - Install AdBlock for Safari (Bonus points). All of the above, except the 'informing' part, takes all of two minutes to do, so I think the "Geniuses" at the Apple Stores can manage. To those entrepreneurs whose business model is based on ads... sorry, but Adblock is the new Antivirus. I install it alongside any software updates or antivirus software (even on Macs, now).
- beaumartinez 15y ago
  > Cleanup [...] kinda shocked that there isn't more to it. Perhaps not with this "first generation" of OS X malware. On Windows some malware replicate to files and have other self-preservation quirks making anti-malware software necessary. > I think the "Geniuses" at the Apple Stores can manage. Against simple malware, yes. When crackers start investing time and effort into their malware (like on Windows), it'll be a different case altogether.

to 15y ago

go to google, search for "piece sign" on image search. click on the ~20 image, black very slim lines white background next to piece sign with globe in background and alien head like looking piece sign. host is decinet.com or something. (im on my phone right now) watch what happens next... thats the trojan, unzips automatically in safari.

yuhong 15y ago

Personally I feel that top-down control of customer support agents is fundamentally flawed these days, but that is a different matter.

morganpyne 15y ago

To be honest, I'm just curious why we haven't seen much real malware yet. The Mac Defender stuff is a joke, but there's no reason why somebody couldn't be exploiting the recent Skype bug (http://www.purehacking.com/blogs/gordon-maddern/skype-0day-vulnerabilitiy-discovered-by-pure-hacking http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v...), or the Chrome/Flash bug (http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php), the bugs found at pwn2own or the myriad other holes which are closed regularly via updates.

orijing 15y ago
The reason is scale and alternative options: If you're a hacker, why focus on the Mac when you can target 10x as many people on Windows?
- morganpyne 15y ago
  I have often seen this mantra repeated, but I can't believe that this is enough to dissuade every single hacker. With Macs approaching 10% of the market this has got to be worth somebodies time to have a go. And yet, I know a lot of folks with Macs and not a single one has ever had malware issues. Either nobody is getting hit, or they are getting hit with stuff so good and stealthy that they just don't know it :-) I'm certainly not arguing that Macs are invulnerable (far from it), I'm just genuinely curious why somebody somewhere isn't stepping in to fill the malware niche.
  - seabee 15y ago
    Malware might bring money in, but that doesn't make it a business. You can't exactly corner the market or rely on word of mouth; your targets are largely random and diverse. When you have a random choice, the only rational decision is to pick the most likely option: Windows.
  - jasonlotito 15y ago
    > With Macs approaching 10% of the market this has got to be worth somebodies time to have a go. Well, apparently there is an issue. Enough so that Apple has taken notice.

telleman 15y ago

The problem is real this time and Apple needs to get off its ass. I'm the IT guy at a (mostly) Mac startup. In the last week I've had two users come to me about the Mac Defender Malware. One was smart enough to email me when he saw the window, but the other managed to infect his machine. (Older gentleman. We don't pay him for his computer expertise.) I told him to go to the Mac Store and ask them to reinstall his operating system. I would do it myself, but it's a Macbook Air (no CD-drive) and a personal machine. I am pretty upset to read that the Mac store people are not going to be helpful to him (landing the problem back in my lap). We spend a lot of money on Apple products for the slender justification that they'll "just work" -- which is often a joke at the best of times.

nchlswu 15y ago

As far as I'm concerned, when I read this I had no problems with what Apple is doing. They got a memo stating that Apple is looking into it, and don't confirm/deny malware. That's what they're supposed to do, no? This is hardly a cover up. Apple is simply reminding their support staff to not make promises they can't keep. This is a holdover till they have a solution. If their permanent solution is a cover up, that's a whole other story.

Niten 15y ago
I agree... although it would be nice if they would step up for their customers in this regard, I just don't see a scandal here. (That's just The Register's style of reporting I guess, not to diss them or anything.) However, the letter itself is interesting in that it confirms Mac malware is becoming a real issue.
smackfu 15y ago
I have a real issue with directing people to say "we are not aware of a thing" in a memo that shows they are clearly aware of it.

learc83 15y ago

I worked in Geek Squad for 5 years (finally started making a enough money doing freelance development to quit this past december). I've done malware removal on 5-10 computers a day, 5 days a week for most of that time. So I've seen thousands of malware infections on the average consumer's computer. I've seen more different malware infections than just about anyone outside of an antivirus research lab. When I first started most of malware came from users downloading files from P2P sites. However, for the last 2 years nearly all the malware I found was installed via a drive-by download that happened without user input. You can talk all you like about avoiding porn sites and installing AV software, but it's not that simple. The majority of the computers I worked on had current AV programs--they weren't able to prevent the infections. The situation with malware and windows is absolutely terrible, and it doesn't only happen to idiots who stuff their drives with porn. Macs have security flaws--they aren't perfect, but when compared to the malware ghetto I've dealt with over the years, calling this a mac malware problem an "explosion" is just ridiculous.

jbri 15y ago
> and it doesn't only happen to idiots who stuff their drives with porn. Instead, it only happens to people who don't keep their browser up to date so that it's actually vulnerable to drive-by downloads. Right?
- learc83 15y ago
  I've seen plenty of the same fake AV malware that installs itself via drive-by downloads on computers with up to date firefox installs. Security patches aren't instant. Updating your browser helps sure, but it's not a real solution. There is a tendency for people like us to assume every time we see someone with a malware infection that it must be because the user is a moron who: still uses Kazaa, doesn't know about the good porn sites, is browsing on IE6 and installs anything that a popup asks him too. That just isn't true. It's not just idiots, the average non-moron windows user is massively vulnerable to malware. In my experience (I'll limit it to friends and family b/c of the obvious selection bias of including Geek Squad customers), nearly every (non developer) windows user I know has had at least one malware infection over the last few years that required either my help, or a system restore.

augustl 15y ago

I hope Apple solve this by creating a consumer version or mode of OS X with a sandbox similar to iOS. I'd love if my mom had no way of installing software that could break the computer, without doing scary sounding stuff like "jailbreaking" or "enable developer mode".

fuzionmonkey 15y ago
Chrome OS is the epitome of this. The whole operating system is just a browser. Nothing to configure, install or break.
wesley 15y ago
Isn't that what an account with parental controls are for? http://gigapple.files.wordpress.com/2008/12/system-pc.png?w=604 http://gigapple.files.wordpress.com/2008/12/system-pc.png?w=...

wesley 15y ago

OSX Lion better have an outgoing firewall.. Anyone know?

ericd 15y ago
Little Snitch can do this currently, if you're looking. Outbound firewalls are somewhat annoying, though, as you have to authorize every single program at least once, which makes me think that Apple is unlikely to add one that runs by default.
- wesley 15y ago
  Just wondering, could a trojan somehow control safari (or other approved apps) via a script, and then upload files to the hacker's server, circumventing little snitch and other outgoing firewalls?
  - podperson 15y ago
    A trojan can do anything a user can do, so yes. The one thing Lion has going for it here is that apps can declare their intention to do certain things and then be prohibited from doing anything else. So, for example, a non networked app can tell the OS it has no interest in using network APIs and will then be sandboxed from them (so if its code is violated it won't be able to suddenly start phoning home). But, of course, this requires effort on developers' parts to support the feature. The key thing is that Apple's own apps are likely to use this feature. But if you download some random piece of software and then run it and the OS says "are you sure?" and you answer yes then you're boned. And again, if you already said "yeah" to "run this bizarro app from disreputable source", are you going to say "omfg no" when asked if it can use the network?
lloeki 15y ago
So what? A user who has been tricked into installing Mac Defender will be just as easily tricked into authorizing Mac Defender to get out.

Groxx 15y ago

More abuse of the term "infection": >The con artists behind Mac Defender hook their victims by presenting Mac-using web surfers with images that depict an antivirus scan taking place on their machines. The images falsely claim users are infected with serious malware and urge them to download and install the antivirus package. Those who fall for the ruse are then infected. Yes. It's malware. It has infected the computer. Because they downloaded and installed it willingly. But "infection" implies "virus" to most people, and this is nothing of the sort.

burn-a-mac 15y ago

Hopefully this will make people think twice before buying crap produced by Apple.

primeMover2010 15y ago

awesome. even malware has higher usability on mac, than it has on other platforms. and if you pay for the snake oil.. errrr... remedy, the virus is gone. the virus writers are pretty awesome social engineers.

illumen 15y ago

Yesterday I saw some mac osx malware being served up from a website listed in google image search results. The search was Flamenco or something like that. My girlfriend pulled me over to show me that this website was saying it was from apple security and that I needed to download a tool to remove the Trojan. Having just come back from a visit to Turkey, we found the Trojan reference funny. I think if she was surfing with safari the .zip file would have extracted automatically, which I think would have caused many people to run whatever evil was stored inside.

tjogin 15y ago
That definitely is a stupid default setting.

patrickk 15y ago

Here's an article comparing some decent Mac antivirus applications for those who are concerned: http://lifehacker.com/5800267/the-non+alarmists-guide-to-mac-malware-protection http://lifehacker.com/5800267/the-non+alarmists-guide-to-mac...

Caballera 15y ago

Mac Protector (another name for Mac Defender) tried to install on my wive's new MacBook Pro the other day when she went to live.com to get the last of her contacts and some emails. She knew not to provide it with permission to install and panic and disaster was adverted. Mac Defender does look pretty real though and I could see how the uninformed or people that easily panic would give it permission to install. As one second your on the web then a 'window' pops up saying your infected with Virus and to get the latest downloads ect., and it all looks convincingly real. I don't regret switching to Mac myself as my Mac runs so much smoother then any Windows PC, plus installation of software is a breeze, my MacBook Pro starts up in 15 seconds and it just works right out the box. There was no crapware pre-installed like my old HP laptop. Additionally, when I researched looking into purchasing my MacBook Pro I saw that Apple does recommend using Anti-virus software and I do have it installed, with no issues and it doesn't slow my MacBook Pro down a bit.