Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Updates Malware Definitions to Protect Against Botnet Threat Coordinated Via Reddit
- Thread starter MacRumors
- Start date
- Sort by reaction score
just checking given the topic. looking at the url I can see its from apple now. odd that it hasn't updated automatically , if id not seen this thread id have not even thought to look assuming it auto updated.
Please keep in mind if you think you have this issue, check your /etc/hosts file for something similar to this :
127.0.0.1 swscan.apple.com
127.0.0.1 swquery.apple.com
127.0.0.1 swdownload.apple.com
127.0.0.1 swcdn.apple.com
127.0.0.1 swdist.apple.com
And remove it .
In this way, the malware tries to block access to xprotect updates ( as far as i know )
127.0.0.1 swscan.apple.com
127.0.0.1 swquery.apple.com
127.0.0.1 swdownload.apple.com
127.0.0.1 swcdn.apple.com
127.0.0.1 swdist.apple.com
And remove it .
In this way, the malware tries to block access to xprotect updates ( as far as i know )
You did
Well, you first have to go to a website that distributes pirated software. At that point we could just say that you got what you deserved and not worry any further about it.
But you don't just try to install pirated software. When you install it, MacOS X will tell you that you are installing software by an unknown developer. If that pirated software was _original_ Adobe or Microsoft software, it would just install, you wouldn't get a warning. (Surely Adobe and Microsoft are not "unknown developers" to Apple, right? ) If you proceed at that step, you don't only try to install pirated software which means your are criminal, you are also trying to install software that you should know has been manipulated, making you criminally stupid.
----------
He just did. It's absolutely safe that your computer will be infected
Or did you mean some other kind of safe?----------
Install software from shady websites AND ignore some severe warnings that MacOS X gives you.
The user Parasprite mentioned xprotect would be updated automatically in the background. So I was wondering. Thanks for the information.
Sums up Reddit really... bunch of tools who are all about trending and thinking they are elite $hizzle when they are really a bunch of kids who love putting double spaces at the end of the line AND HAVING ALL SLEDGING IN CAPITALS.
Well, I'm stuck with Gimp because I'm adult and don't support piracy, and Photoshop is just too expensive for amateur photography, unless it's your main and single hobby. It's not my case, since I'm a multi-interest hobbyist. I even use the buggy Audacity for recording stuff I play with my guitar.
However there's a thing that really annoys me when installing software: allowing administrator rights. Ok, let's give administrator rights so the app can copy stuff to some system folders, but since it should not be the standard behavior of any app, why OSX doesn't give a more detailed explanation of what will be done with the root access I'm giving? It could throw that warning popup with a button providing additional details of the operation, don't you agree?
However there's a thing that really annoys me when installing software: allowing administrator rights. Ok, let's give administrator rights so the app can copy stuff to some system folders, but since it should not be the standard behavior of any app, why OSX doesn't give a more detailed explanation of what will be done with the root access I'm giving? It could throw that warning popup with a button providing additional details of the operation, don't you agree?
Actually..
Actually, what it really sums up is the stupidity and/or ignorance of the average computer user.
Actually, what it really sums up is the stupidity and/or ignorance of the average computer user.
You were right to be suspicious. Following a link from a post in an online forum is exactly the kind of risky behavior that this thread addresses. Don't be lulled into a false sense of security just because you "can see its from apple". I doubt you'd click on a link in an email from Nigeria, even if the link has "citibank" in it. Faking URLs is trivial.
Just curious, has a "good botnet" ever existed? IE, one that automatically and without your knowledge adds you to FOLDING@home or some similar organization? How much computing power is out there that could be used for these projects, but isn't either because the owner doesn't know or the owner doesn't care? How much of it could you trick them into contributing through this?
Not saying someone actually should do this, but it's an interesting idea I've had for awhile.
Not saying someone actually should do this, but it's an interesting idea I've had for awhile.
Thats an OTA update of definition. No actual update link or dmg to download. As long the computer has internet it will be updated automatically.
How many mac users could have been compromised trying to get the Fappening over reddit? hehehe
How many mac users could have been compromised trying to get the Fappening over reddit? hehehe
Say again? People going to pirate sites are not exactly the common Apple user.
Reminds me of installing Microsoft Office...
"I know this is gonna **** up my fonts, this is gonna **** up my fonts...*breathes* *looks away and clicks*"
----------
I just imagine someone spreading a virus that silently installs legitimate antivirus software which would then run in the background and automatically update itself without your knowledge.
Thanks a lot for this link. That site (not just the page you linked) is well worth reading for good advice and explanation about OS X, malware and antivirus programs.
http://www.thesafemac.com/mmg/
I don't know how to do with absolute certainty but as was suggested you can check the modification dates on the xprotect plists. in finder do shift+command+G and enter
/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources
this will open this directory in Finder. check the modification dates for XProtect.meta.plist and XProtect.plist
If they are recent (like in the last 24 hours) you should be fine.
BTW, if you want to see the list of all malware XProtector detects you can run this in terminal
cat /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist |grep OSX
To put some perspective on the amount of OS X malware out there, that's 41 items total including variations of the same malware like iWorm.A, iWorm.B and iWorm.C.
Last edited:
So this is a silent "in-the-background" update that Apple pushes to my Internet-connected iMac?