Apple Investigating 'MACDefender' Malware, Support Staff Barred From Assisting Customers

[Denarius]

You want to sincerely say that Apple takes NO blame in not educating their customers better?

Yes, I could certainly say that Apple take no blame here for exactly the same reason that a car manufacturer isn't responsible if a customer crashes because they don't know how to drive, or a chainsaw manufacturer is responsible if someone chops off one of their own limbs because they haven't sought guidance how to use it safely.

The security weakness here is the user, not the machine.

 

[munkery]

Mac OS X will not have the same malware problems as Windows. The main reason Windows has so many issues is the Windows OS with the greatest market share, XP, does not use discretionary access controls (DAC) in the account type, admin, used by most users. An OS has no user space security mechanisms and many trojans can install without authentication when run without DAC. The primary user space security mechanism in this regard protects security sensitive data from being logged when entered into password prompts and web forms.

Also, even Windows 7 has a higher liability to have more malware issues due to having a greater number of privilege escalation vulnerabilities.
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Mac+OS+X+gain+privileges+2011
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows+7+gain+privileges+2011
Privilege escalation is required to install rootkits that bypass user space security mechanisms in OSs that use DAC unless social engineering ploys trick unknowledgeable users.

Most OSs provide enough security such that malware that relies on social engineering, such as MACDefender, is obvious and easy to avoid with a little bit of user knowledge. Even if the volume of Mac OS X malware increases proportionally in terms of market share, the incidence rate of successful infection per capita will not equal that of Windows, specifically XP, due to using DAC by default and having fewer privilege escalation vulnerabilities.

Other examples show that the more targeted platform is that which is easier to exploit. Microsoft IIS is exploited more than Apache despite Apache having greater market share. Android OS has more malware than iOS despite roughly equal market share. The large volume of Windows malware is due to both being an easier target and greater market share.

 

[ChrisNM]

Be Kind

Let's not forget that the new users who switched to macs have been abused by Microsoft for years - especially with Vista. Vista users were constantly bombarded with pop windows to allow this and to allow that. After a while, this new approach to security that those idiots at Microsoft once touted as innovative actually had the opposite effect. It conditioned Vista users to automatically click "yes" on the pop ups because they were coming up so often.

So if some new mac users clicked "yes" on this malware, instead of snickering and calling them idiots, why not extend your sympathies to them for the years of abuse they received at the hands of Microsoft and welcome them to the mac family and tell them they no longer need to be afraid.

 

[samcraig]

Yes, I could certainly say that Apple take no blame here for exactly the same reason that a car manufacturer isn't responsible if a customer crashes because they don't know how to drive, or a chainsaw manufacturer is responsible if someone chops off one of their own limbs because they haven't sought guidance how to use it safely.

The security weakness here is the user, not the machine.

I believe that both automobiles and power tools have warnings that improper use can lead to injury.

 

[GGJstudios]

I believe that both automobiles and power tools have warnings that improper use can lead to injury.

... which everyone reads, of course!

 

[*LTD*]

So you think that the Apple Rep on record was lying about the increase in call volume? That this is a non-issue? Is that right?

Obvioiusly call volume always increases when something new pops up? These aren't calls about an ocean of new malware, but about one person's call centre experience about the particular malware in question.

Of course call volume increases. It likely increased when there was the iWork trojan, and before that with Leap-A, etc.

Then the malware issues dies down because there ceases to be an issue for another two years.

And remember, we're relying on Ed Bott's *anonymous* source for all this. There is no actual, verified rep on record saying or doing anything.

 

[Les Kern]

Apple has almost 70BN in the bank. Buy Sophos and add it to the OS. Done.
Of course my idea of putting some jobs back in America fell on deaf ears, so I suspect this will as well.

 

[scoobydoo99]

So you think that the Apple Rep on record was lying about the increase in call volume? That this is a non-issue? Is that right?

There was NO Apple rep on record. That's the point, it was attributed to "anonymous." Which in journalism-speak means "made up."

 

[Mal]

This makes me glad I run day-to-day in a non-admin account. It would probably fool my wife.

You do realize that it doesn't make any difference if you're running in a standard or admin account, right? The only thing that changes is whether you have to enter username and password or just your password. Running in an admin account is not dangerous on a Mac. I've done it for years, and so do most other Mac users. There is no additional damage that can be done by this software running in an admin account, nor does it gain access to anything by that fact either. Even if you were running as root, it wouldn't install itself (though I do believe you wouldn't have to enter your password in that case). You'd still have to click through the installer steps to install it yourself.

jW

 

[GGJstudios]

Buy Sophos and add it to the OS. Done.

Sophos can actually increase your Mac's vulnerability. Don't use it.

 

[Dr McKay]

Mac OS X will not have the same malware problems as Windows. The main reason Windows has so many issues is the Windows OS with the greatest market share, XP, does not use discretionary access controls (DAC) in the account type, admin, used by most users. An OS has no user space security mechanisms and many trojans can install without authentication when run without DAC. The primary user space security mechanism in this regard protects security sensitive data from being logged when entered into password prompts and web forms.

Also, even Windows 7 has a higher liability to have more malware issues due to having a greater number of privilege escalation vulnerabilities.
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Mac+OS+X+gain+privileges+2011
http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows+7+gain+privileges+2011
Privilege escalation is required to install rootkits that bypass user space security mechanisms in OSs that use DAC unless social engineering ploys trick unknowledgeable users.

Most OSs provide enough security such that malware that relies on social engineering, such as MACDefender, is obvious and easy to avoid with a little bit of user knowledge. Even if the volume of Mac OS X malware increases proportionally in terms of market share, the incidence rate of successful infection per capita will not equal that of Windows, specifically XP, due to using DAC by default and having fewer privilege escalation vulnerabilities.

Other examples show that the more targeted platform is that which is easier to exploit. Microsoft IIS is exploited more than Apache despite Apache having greater market share. Android OS has more malware than iOS despite roughly equal market share. The large volume of Windows malware is due to both being an easier target and greater market share.

Windows 7 does pretty well at security nowadays, most Malware on it requires direct user intervention to install, not like the fly-by installs of Windows XP.

Infection rates for Windows 7 is 2.5 computers infected out of every 1,000.

 

[*LTD*]

This is a crazy thread.

I've only just moved from windows and you get this all the time.

Its scary that people out there click to install this stuff. People will now start to pick holes in apple when they haven't done anything wrong.

Seriously people stop downloading random stuff!!

It's crazy because we have to read through this garbage every couple of years. This is almost a carbon copy of threads in 2009 when we had the iWork trojan, and in 2006 when we had Leap-A.

Suddenly there's an ocean of malware and viruses that are just around the corner. They've been "just around the corner" for at least 7-8 years now.

You might think that this news story signals a major change in the situation. It doesn't. It's a repeat of what we've seen before.

But THIS time we're doomed. Honest! (which is what we're told each time)

 

[scoobydoo99]

Sophos can actually increase your Mac's vulnerability. Don't use it.

+1

Antivirus software in general IS malware.

Why would anyone intentionally infect a mac with ANY anti-virus software?

 

[*LTD*]

+1

Antivirus software in general IS malware.

Why would anyone intentionally infect a mac with ANY anti-virus software?

Macs don't need antivirus. There's not enough out there in enough quantities to justify it.

A new trojan every 2-3 years does not call for antivirus. It DOES, however, call for sensationalist headlines and predictions of doom each time it happens. Over a ten-year period. LOL

 

[ryanwarsaw]

it's unfortunate that this is happening to us, finally, but it's NOT like it can't be avoided. Just don't install anything you didn't specifically request, as has already been suggested. Is that a difficult thing to comprehend?



Cheers,
Cameron

It isn't difficult to understand. That being said Apple goes out of it's way to advertise that you don't have to worry about these kind of issues. Many people switch based upon these claims and don't read forums all day long.

I downloaded something called mackeeper or something similar. I knew it was a scam but just wanted to see what it would do. Haven't had any problems but I noticed when I went to delete it that many parts of it are locked and won't move to trash.

Again I did this knowing it could be dangerous but I did it knowingly. Normally things like this are just minor nuisances but this seems to be a bit more problematic.

I know how to get rid of these things but some people may not be able to and are sold macs being told they don't have to worry about such issues.

 

[munkery]

Windows 7 does pretty well at security nowadays, most Malware on it requires direct user intervention to install, not like the fly-by installs of Windows XP.

Infection rates for Windows 7 is 2.5 computers infected out of every 1,000.

There are still malware in the wild that uses privilege escalation to bypass UAC and infect Windows 7 without user intervention. Stuxnet is a good example.

This is a list of Windows 7 vulnerabilities related to the Stuxnet exploit.

Here is a guide to turn those vulnerabilities into exploits.

Stuxnet is a popular example of this technique being used in the wild and more malware developers will use this method as Windows 7 takes more XP market share.

 

[2IS]

It's somewhat ironic, in a way, that the only Mac "virus" (trojan, not virus) will only get people who manually install it because they think they need an antivirus on a Mac.

Expect waves of people proclaiming that Macs have viruses too, etc etc, when this is actually just crapware that the user has to install.

You know what I find ironic? When Mac users take the stance that if a PC gets infected, it's an issue with the OS and if a Mac gets infected it's an issue with the user.

You can try and split hairs between a virus vs trojan all you want, both are unwanted and it isn't like a trojan is the lesser of two evils anyway.

 

[*LTD*]

It isn't difficult to understand. That being said Apple goes out of it's way to advertise that you don't have to worry about these kind of issues. Many people switch based upon these claims and don't read forums all day long.

I downloaded something called mackeeper or something similar. I knew it was a scam but just wanted to see what it would do. Haven't had any problems but I noticed when I went to delete it that many parts of it are locked and won't move to trash.

Again I did this knowing it could be dangerous but I did it knowingly. Normally things like this are just minor nuisances but this seems to be a bit more problematic.

I know how to get rid of these things but some people may not be able to and are sold macs being told they don't have to worry about such issues.

They don't. 99% of malware out there is for Windows and will only run on Windows. Users have no more reason to worry than they did back in 2006 when Leap-A happened.

 

[samcraig]

Wirelessly posted (Mozilla/5.0 (iPad; U; CPU OS 4_2 like Mac OS X; en) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C134b Safari/6533.18.5)

A new trojan every 2-3 years does not call for antivirus. It DOES, however, call for sensationalist headlines and predictions of doom each time it happens. Over a ten-year period. LOL

Actually - what it CALLS for, LTD - is better education amongst Mac Users (and I mean the general Mac User) about protecting themselves from harmful software and situations where the OS and/or their system can be compromised.

So If it's one incident every 3 years or one ever three days doesn't matter. The education needs to be there. That's not hype. That's not sensationalism. That's not headlines. That's reality.

 

[*LTD*]

You know what I find ironic? When Mac users take the stance that if a PC gets infected, it's an issue with the OS and if a Mac gets infected it's an issue with the user.

You can try and split hairs between a virus vs trojan all you want, both are unwanted and it isn't like a trojan is the lesser of two evils anyway.

A virus is different from a trojan.

"Virus" is not, and shouldn't be, a catch-all term.

 

[samcraig]

A virus is different from a trojan.

"Virus" is not, and shouldn't be, a catch-all term.

You missed his point ENTIRELY. Congratulations.

 

[GGJstudios]

You know what I find ironic? When Mac users take the stance that if a PC gets infected, it's an issue with the OS and if a Mac gets infected it's an issue with the user.

A Windows PC can be infected without the user's knowledge or permission. The only way current Macs can be infected is if the user actively installs something.

You can try and split hairs between a virus vs trojan all you want, both are unwanted and it isn't like a trojan is the lesser of two evils anyway.

Actually, a trojan IS the lesser of the two evils, since a trojan can be blocked by a reasonably aware user. A virus can't. It helps if you understand the differences. Read the Mac Virus/Malware Info.

 

[samcraig]

A Windows PC can be infected without the user's knowledge or permission. The only way current Macs can be infected is if the user actively installs something.

Actually, a trojan IS the lesser of the two evils, since a trojan can be blocked by a reasonably aware user. A virus can't. It helps if you understand the differences. Read the Mac Virus/Malware link in post #113.

You keep pointing out that link... which is good. One of the "problems" is that Apple's marketing is constantly telling its customers that it can't get viruses. And I would gather that most average users won't/don't split hairs - or a better phrase is - cannot differentiate between the various types of attacks they can have on their systems. And since Apple has no desire (and understandably) to admit that their systems CAN be compromised - no matter how it's done - then the average user is more susceptible to feeling "invincible"

 

[Trashmikes]

Did you read the article? They address this. Maybe you skimmed?

Where?

 

[*LTD*]

Every 2-3 years, that ONE piece of malware that pops up for OS X gets weeks of attention. If we spent as much time covering all the Windows malware out there (and viruses), we'd be old and gray before we've fully covered so much as a single percent of it.

Some people have lost all sense of perspective. But no matter. We'll be seeing you all again in, say, 2014 or so when the next "explosion" hits. LOL

I had this same conversation in 2009 and before that in 2006 on a different tech site.