Mac App Store App 'Adware Doctor' Discovered Stealing User Browsing History [Update: Removed]

[DeepIn2U]

A month is super fast? For a security breach like this?

* clicks "ignore" button*

Sorry I was looking at the article date/time and the update therein.

Seems that it's been more, much more than a month since this app has been in the App Store.

 

[netdudeuk]

I'm not exactly sure that taking a month to act is "SUPER FAST".

I thought that it was a joke.

 

[capandjudy]

I don't suppose that buyers get a refund? BTW-Malwarebytes quarantined it last week I believe so props to them. I frankly don't remember why I got it. My bad!

 

[doctor-don]

Surprise! Surprise!

 

[bluecoast]

For me, this is part of the fog that comprises the App Store.

Beyond all the user friendly marketng - and measures that have admittedly helped millions of users - the App Store has still allowed millions of people to get their data harvested. Path was not an anomaly.

 

[MrJeffreyGee]

Off with their heads!

 

[VictorTango777]

The vast majority of those require the device to be jailbroken. The remainder use enterprise provisioning. There's no anti-malware available for iOS, so carriers can't be shipping it with new devices. Stop conflating Android and iOS. Besides, this was a macOS app, not an iOS app.

Malware is not virus. Just keep you Mac updated and don't install crap.

No.

Don’t jailbreak your phone. Anti malware apps on iOS are scams.

Is there an objective standard to determine whether a Mac was compromised due to a real technical vulnerability or if it was user negligence? Does the same standard also apply to operating systems other than Apple? For example, if a Mac user installed "crap" and the Mac became compromised, most people in this forum would blame that user. But if a Windows user installed "crap" and the PC became compromised, do we blame the user or Microsoft?

 

[iamtheonlyone4ever]

is not the developer's fault, people got it all wrong, the app is not to clean your drive from spyware, the app is to install the spyware

😀

now seriously, shouldn't apple test the apps before allowing the developers to post their apps
the same thing happens a few days ago with a facebook app

what is the point to allow the app to be published to then find out that is has done something illegal
then apple removes the apps after the damage has been done

it isn't better to do it backwards
first test the app then let the developer upload the app

but it seems to me that apple is trusting the developers a bit too much and they are simply taking their word for it
is ok if they don't play by the rules we simply remove the app
yes but the problem is that many data and personal info has been compromised
because Mac users are trusting you apple, not the developers so much

so to close this up
how it is that apples find out about this
because if they don't test the app before being publish in the app store
my only guess is that apple only finds out after many users complaint about the problem

we are already living in the internet espionage era
soon people will have to forget about connecting to the internet because is not fun anymore
forget about protecting from viruses or hackers, now you have to protect from apps developers and from companies like microsucks with their w10 spyware
also the so called free services like FB and instagram

I try to use apple integrated apps as much as possible and I am very selective when is time to install something on my system because we need 3rd party apps

the way things are going lately, I think we need to skip downloading and installing apps from the App Store as much as possible

Tim stop making money and give us security and protection
[doublepost=1536372650][/doublepost]

You clearly have no idea of how businesses work nor how the Mac App Store works. The $1.50 that Apple receives is not pure profit, there are card processing fees, hosting and other expenses to be taken out of Apple's cut. Their profit is less than you might think.

agreed but still even after all that they still make money
I think that is why they allow the most useless apps on the App Store
anything that can sell is good because then they make money
even if they make 50 cents out the dollar 50 still profit
multiply that by 2 millions users and they just made a million dollars

I think apple is focusing on the dollar sign first instead of worry a bit about their own loyal costumers
Tim has to go and fast

 

[borgranta]

"Adware Doctor is also currently the number five top paid app on the entire store in the U.S."

Why would they kill the golden goose? They get paid $1.50 every time someone downloads it, which is pure profit.

It is less than $1.50 after various fees and expenses. They would stand to lose more than they would gain.
[doublepost=1536373400][/doublepost]

So he told Apple about it for a month and nothing happened until he post this article?

LOL. So much for Apple screening process. Apple doesn't really care, as long as they get their 30%.

If that were true than they would have left it there.

 

[cmaier]

Is there an objective standard to determine whether a Mac was compromised due to a real technical vulnerability or if it was user negligence? Does the same standard also apply to operating systems other than Apple? For example, if a Mac user installed "crap" and the Mac became compromised, most people in this forum would blame that user. But if a Windows user installed "crap" and the PC became compromised, do we blame the user or Microsoft?

Whatever the standard is, jailbreaking is clearly in the “user fault” category.

 

[BuddyTronic]

The server is physically located in China. There's your proof. Keep up the denial though.

No denial here - I have no idea and don't even care to much in this instance. I say what I say about IP redirection and tunnelling and so forth because the world is too eager to rubber-stamp a lot of BS theories without asking the right questions in SOME of the cases of malicious computer activities.

Also - there is nothing much that would prevent any person from setting up a few computers in Shenzhen - I have been there a dozen times myself for business. Some guys a person could hire there could set up a company. Any person can set up a computer there - voila - server in China. The Russians could do that too, and so can any person from California. In fact wouldn't it be smarter for the Russians to set up in various countries around the world? Or how about someone in California just does it but makes it look like Russians trying to hide in China. Use Russian language versions of Linux etc etc, hire Russian hackers to do the work. Make it "look" like Russians did it. Then the Mark Zuckerberg real evil guys can get the data they want. Nobody seems to care about real proof - "They server is physically in China" seems to answer all your questions and even accuse me of some kind of "denial".


In Summary - The example I care more about is the "Russia hacking the US elections" bull-dada. Snowden and Wikileaks are better sources for that stuff than the US Coast guard and the other 16 "intelligence" agencies. You know what I mean?

 

[cmaier]

No denial here - I have no idea and don't even care to much in this instance. I say what I say about IP redirection and tunnelling and so forth because the world is too eager to rubber-stamp a lot of BS theories without asking the right questions in SOME of the cases of malicious computer activities.

Also - there is nothing much that would prevent any person from setting up a few computers in Shenzhen - I have been there a dozen times myself for business. Some guys a person could hire there could set up a company. Any person can set up a computer there - voila - server in China. The Russians could do that too, and so can any person from California. In fact wouldn't it be smarter for the Russians to set up in various countries around the world? Or how about someone in California just does it but makes it look like Russians trying to hide in China. Use Russian language versions of Linux etc etc, hire Russian hackers to do the work. Make it "look" like Russians did it. Then the Mark Zuckerberg real evil guys can get the data they want. Nobody seems to care about real proof - "They server is physically in China" seems to answer all your questions and even accuse me of some kind of "denial".


In Summary - The example I care more about is the "Russia hacking the US elections" bull-dada. Snowden and Wikileaks are better sources for that stuff than the US Coast guard and the other 16 "intelligence" agencies. You know what I mean?

Oh lord, more nonsense. Either nobody knows about Occam’s razor or Russians are extra trolly tonight.

 

[justperry]

The states are much better when it comes to privacy. First of all there's no great firewall, so in the states you can use privacy conscious services (like DuckDuckGo and StartPage) that would be banned in China. Second of all the police state in China in general is much more extreme than anything that has ever been done in America. The authorities in Beijing literally have 100% of the city under 24/7 surveillance, and give all citizens a "social score".

What I meant and maybe you and others didn't understand is that you for instance have the NSA amongst other Data collection agencies, they know everything from all it's citizens so there's your privacy, what the States does not do is going after each and everyone if they even make a small mistake, like commenting on political issues, the ones they don't like.
So yes, the States is better but that does not mean they don't collect data.

 

[haruhiko]

Mac App Store is a wasteland and misleading new users.

 

[baryon]

This is why the idealized vision of the "walled garden" App Store is a bit silly. Malware does get in, and blindly trusting anything bought from the App Store is just as stupid as blindly downloading anything from outside the App Store. But simply making it difficult to install apps from outside the App Store is like pretending that the outside world is full of malware and the inside world is a safe haven. It's not the case. Apple, stop forcing people to use your money making service. Let us decide.

 

[fairuz]

You clearly have no idea of how businesses work nor how the Mac App Store works. The $1.50 that Apple receives is not pure profit, there are card processing fees, hosting and other expenses to be taken out of Apple's cut. Their profit is less than you might think.

The costs incurred to host the MAS in general are huge, but the per-download costs are tiny. Out of the $1.50 (minus credit card fees) they get for each download, it must cost them less than a cent. In other words, if there are fewer downloads on the MAS in total, the total cost of the MAS is still almost the same.
[doublepost=1536398741][/doublepost]

This is why the idealized vision of the "walled garden" App Store is a bit silly. Malware does get in, and blindly trusting anything bought from the App Store is just as stupid as blindly downloading anything from outside the App Store. But simply making it difficult to install apps from outside the App Store is like pretending that the outside world is full of malware and the inside world is a safe haven. It's not the case. Apple, stop forcing people to use your money making service. Let us decide.

You can freely install things outside the MAS and the iOS App Store, only it's more difficult on iOS. And the review process is obviously not perfect, but it's better than wild west, and at least they can remove things. Say there's no Mac App Store, and this story about Adware Doctor is released... Most people wouldn't even see this and would keep downloading it!
[doublepost=1536399139][/doublepost]

Mac App Store is a wasteland and misleading new users.

It's also still glitchy af. I don't know how they've gone so wrong with it.

 

[M.PaulCezanne]

All hardware is made in China. Is it unreasonable to believe our computers or routers might have embedded code capable of redirecting traffic to some creep in China?

VPN’s promise they keep no logs. Are we just going to take their word for it?

DNS leaks, http, Google, Equifax, iCloud, British Airways...

I try to take all reasonable precautions as a far more knowledge than average (non-pro) tech user, but as time goes by it feels more and more futile. The vast majority of average users don’t stand a chance.

Privacy and anonymity seem like myths these days. At this point, I don’t think it’s too cynical to conclude this is how big tech wants it.

 

[MacBH928]

so much of the "safe garden"...

Its no use to ban the app, legal action must be taken. Invading people's privacy can destroy people's lives depending on what and where the information is shared. Just imagine if a car manufacturer engineer leaked info... future plans of car model and specs will be public and it will affect the brand and the stock if it is going to affect profitability.

 

[BuddyTronic]

Oh lord, more nonsense. Either nobody knows about Occam’s razor or Russians are extra trolly tonight.

Well, at least everyone can agree that this spyware is a bad thing.

It most likely is China related - as you say Occam's razor. But if smart guys were doing it wouldn't they consider pinning it on someone else and tunnel the data where they want it anyways?

Someone wants the data - are we really sure who in this case? How can we be really sure who is responsible?

 

[GGJstudios]

i just read about a Mac virus this week

There has never been a virus in the wild that can infect macOS. There are trojans, but they can all be avoided by users practicing safe computing, such as not installing pirated software.

Has anyone use "Antivirus - ZAP"? Since this story, I'm now worried of having this app and have used it a few times to remove Adwawre and Malware... I wonder if this is a "bad" app https://antiviruszap.com

You don't need any antivirus app to keep macOS malware free.

There is sense in having an antivirus software on the Mac. There can be viruses in emails and attachments that won't be a nuisance to your Mac but if passed on to others with Windows, will be. An antivirus will stop that from happening.

First, there is no antivirus app that is 100% effective. Also, Windows viruses can't infect macOS, and it's not a Mac user's responsibility to keep every other computer malware free. It's the responsibility of each user to protect their own computer.

And that is what happens when you install a security software in a system that doesn't really need one.

This statement is misleading and dangerous.

No it isn't. You don't need software to keep a macOS malware-free. Some common sense and practicing safe computing are all that's required.

Is there an objective standard to determine whether a Mac was compromised due to a real technical vulnerability or if it was user negligence? Does the same standard also apply to operating systems other than Apple? For example, if a Mac user installed "crap" and the Mac became compromised, most people in this forum would blame that user. But if a Windows user installed "crap" and the PC became compromised, do we blame the user or Microsoft?

We can try to blame others, but ultimately, it's each user's responsibility to protect their own devices. That means if you're running Windows, you should install reputable and vetted anti-malware software, since there are viruses in the wild that can infect Windows. There are none in the wild that can infect macOS, so anti-malware software isn't a requirement. For both Windows and macOS trojans, it's up to the user to be careful about what they install.

 

[macintoshmac]

First, there is no antivirus app that is 100% effective. Also, Windows viruses can't infect macOS, and it's not a Mac user's responsibility to keep every other computer malware free. It's the responsibility of each user to protect their own computer.

I know this. Yet, I want to make sure to a reasonable degree that nothing I send to my clients causes them an issue. I am willing to spend USD10 a year for this convenience. I don't think my clients will accept any responsibility on themselves if something from my side were to infect their systems.

Also, I'd not like it if I receive malware from my clients, even if it is everyone's own responsibility like you say.

 

[john123]

There has never been a virus in the wild that can infect macOS. There are trojans, but they can all be avoided by users practicing safe computing, such as not installing pirated software.

You don't need any antivirus app to keep macOS malware free.

First, there is no antivirus app that is 100% effective. Also, Windows viruses can't infect macOS, and it's not a Mac user's responsibility to keep every other computer malware free. It's the responsibility of each user to protect their own computer.

No it isn't. You don't need software to keep a macOS malware-free. Some common sense and practicing safe computing are all that's required.

We can try to blame others, but ultimately, it's each user's responsibility to protect their own devices. That means if you're running Windows, you should install reputable and vetted anti-malware software, since there are viruses in the wild that can infect Windows. There are none in the wild that can infect macOS, so anti-malware software isn't a requirement. For both Windows and macOS trojans, it's up to the user to be careful about what they install.

Ugh. How can you not see your circular logic? Let me spell it out for you.

You talk about "common sense and practicing safe computing." For people who aren't expert users, what seems like "common sense" to you is not common sense to them. It's easy for them to get tricked by, for example, phony Adobe Flash updaters via popups. It happens all the time.

Expert users are on the opposite end of the spectrum. They often install lots of different types of software and, despite reasonable due diligence, do make mistakes. I do IT for a living—quite well, might I add—and have gotten bit once or twice. And it isn't from pirated software. (Sidenote: that whole "pirated software has viruses" thing for Macs is mostly a myth. Most Mac software torrents are actually just fine in that respect, although legality and morality are quite a different matter.)

On top of all that, many users such as couples share their computer with someone else. So you can be as diligent as you want. Doesn't mean that your partner didn't make a mistake.

The very fact that some software sat on the Apple store for as long as it did doing the very thing it was purported to stop proves beyond a doubt that it's not so simple as you'd like to make it to be.

The great thing is that both user groups are served well by some simple solutions. Malwarebytes is great and very low-resource. Little Snitch is in a very different class but is (for me) an essential tool in the battle for control of my data and what interaction my computer has with the outside world.

Antivirus is a different story. The best products there (like Bitdefender and Intego) aren't free. Most of the free options are aggressive resource hogs. You say, "it's not a Mac user's responsibility to keep every other computer malware free" but that's a pretty self centered point of view. If you forward or retransmit infected content to a Windows colleague and try a line like that, I'd watch out for a left hook. You'd deserve it.

Which brings me back to my point. Acting like Macs are "fine" and "no one needs" third party solutions is wrong and irresponsible. I don't even know why you people say stuff like that. It's totally disconnected from the real world.

 

[GGJstudios]

You talk about "common sense and practicing safe computing." For people who aren't expert users, what seems like "common sense" to you is not common sense to them.

It's a pretty simple thing to remember to not install apps unless you know what they are, and only get them from reputable sources.

It's easy for them to get tricked by, for example, phony Adobe Flash updaters via popups. It happens all the time.

If someone isn't familiar with fake updaters, phishing attacks and similar threats, they should learn about them if they want to protect their systems from malware. No anti-malware app will protect a user from their own foolish choices. People should learn how to maintain and operate a motor vehicle responsibly. The same principle applies to using a computer on the internet.

(Sidenote: that whole "pirated software has viruses" thing for Macs is mostly a myth. Most Mac software torrents are actually just fine in that respect, although legality and morality are quite a different matter.)

No, it's not a myth, since macOS malware has been distributed through pirated apps in the past.

On top of all that, many users such as couples share their computer with someone else. So you can be as diligent as you want. Doesn't mean that your partner didn't make a mistake.

See above. The same goes for all users of a computer. It's really not that tough. Don't install anything unless you know what you're doing. Ask for help.

Malwarebytes is great and very low-resource. Little Snitch is in a very different class but is (for me) an essential tool in the battle for control of my data and what interaction my computer has with the outside world.

Antivirus is a different story. The best products there (like Bitdefender and Intego) aren't free.

None of those apps will protect a computer from a user who doesn't practice safe computing. They won't prevent installations from shady sources, or prevent users for falling for phishing scams, or many other threats. None of these apps are even 100% effective in protecting against the things they're designed to defend against.

You say, "it's not a Mac user's responsibility to keep every other computer malware free" but that's a pretty self centered point of view. If you forward or retransmit infected content to a Windows colleague and try a line like that, I'd watch out for a left hook.

It's not self-centered at all. Even if you avoid sending malware to Windows users, that still doesn't protect them from malware from other sources. If you really want to help Windows users, make sure they're running their own anti-malware to protect them from threats from all sources, and not just from you.

Which brings me back to my point. Acting like Macs are "fine" and "no one needs" third party solutions is wrong and irresponsible. I don't even know why you people say stuff like that. It's totally disconnected from the real world.

What's disconnected from the real world is expecting 3rd party software to protect against threats, when the biggest threat is an uninformed or careless user. What's disconnected from the real world is forgetting that macOS malware is so relatively rare that most Mac users will never encounter any, unless they're going out of their way to do foolish things. What's wrong and irresponsible is to mislead Mac users, especially those migrating from Windows, into thinking that they need the same antivirus protection on a Mac that they do on Windows. Educate them about some simple tips on safe computing, rather than throwing an app at them. They'll thank you in the long run.

 

[john123]

It's a pretty simple thing to remember to not install apps unless you know what they are, and only get them from reputable sources.

If someone isn't familiar with fake updaters, phishing attacks and similar threats, they should learn about them if they want to protect their systems from malware. No anti-malware app will protect a user from their own foolish choices. People should learn how to maintain and operate a motor vehicle responsibly. The same principle applies to using a computer on the internet.

No, it's not a myth, since macOS malware has been distributed through pirated apps in the past.

See above. The same goes for all users of a computer. It's really not that tough. Don't install anything unless you know what you're doing. Ask for help.

None of those apps will protect a computer from a user who doesn't practice safe computing. They won't prevent installations from shady sources, or prevent users for falling for phishing scams, or many other threats. None of these apps are even 100% effective in protecting against the things they're designed to defend against.

It's not self-centered at all. Even if you avoid sending malware to Windows users, that still doesn't protect them from malware from other sources. If you really want to help Windows users, make sure they're running their own anti-malware to protect them from threats from all sources, and not just from you.

What's disconnected from the real world is expecting 3rd party software to protect against threats, when the biggest threat is an uninformed or careless user. What's disconnected from the real world is forgetting that macOS malware is so relatively rare that most Mac users will never encounter any, unless they're going out of their way to do foolish things. What's wrong and irresponsible is to mislead Mac users, especially those migrating from Windows, into thinking that they need the same antivirus protection on a Mac that they do on Windows. Educate them about some simple tips on safe computing, rather than throwing an app at them. They'll thank you in the long run.

All your "best practices" platitudes are worthless because you aren't going to make them happen. You can yak yak yak all day about how the world "should" be, but it isn't that way. And because of that, you're wrong. I think you know you're wrong. At least I hope you do. Either way, please stop giving such horribly misguided advice out. The idea that people might read it and follow it is terrifying. Unless you are personally volunteering to go door-to-door to everyone's house to dispense the "education" you speak of, then everything you typed is useless. (And often factually wrong too. Mac malware is quite common.) Just stop.

 

[macintoshmac]

It's a pretty simple thing to remember to not install apps unless you know what they are, and only get them from reputable sources.

Would you consider Transmission BT a known app? Reliable app? Getting that app from its own server would constitute 'reputable source' right?

Now, remember the fiasco, twice at that?

I am sorry if I come across as crass with what I am going to say, but your username says 'studios' implying that you might be a business. I'd have been very concerned if I were a client, and knowing what I do about GGJ Studios, there is no chance I will become a client, or recommend the business to anyone I know.

In today's times, and since a long time, people are expected to secure their computers and it is not going to change.