The State of Mac Malware
There’s been a lot of buzz recently about the sudden increase in Mac-specific malware cropping up so far this year. First people raved about the fairly tame and unthreatening BlackHole RAT trojan, then Mac users had to watch out for a slightly more crafty but avoidable MACDefender trojan, and now there’s news of a more advanced malware kit (Weyland-Yutani Bot) that has the ability to steal data entered into Firefox (Safari and Chrome currently unaffected, but expected to follow soon). AppleCare has reportedly been receiving a significant number of calls about the MACDefender trojan, and has issued a support document on how to deal with it.
Clearly some change is in the air, but exactly how does it affect normal Mac users? I for one actively look for Mac-based malware (eg. MACDefender), and have never stumbled across it by accident. Maybe I need to surf on the ‘dark side’ of the web more often. I just wanted to give my take on recent events and the state of Mac malware, and why I don’t think there’s any reason to be too worried just yet.
Low Risk MACDefender Trojan is Easily Avoided
There have been widespread reports of people installing a trojan that masquerades as an anti-virus program dubbed MacDefender. When visiting a malicious or compromised website promoted by SEO (search engine) poisoning, some Mac OS X users using Safari are experiencing the automatic download of a disk image which then automatically mounts and launches an installer. Intego’s blog has a detailed report which shows that they’ve discovered instances of scareware, where the websites (ironically displaying a faux-Windows GUI) show a fake virus scan and inform the user that their computer is infected.
Note: The automatic mounting and execution of the installer can easily be prevented by unchecking the “Open ‘safe’ files after downloading” option in the Safari Preferences.
If the user installs it, the MacDefender app look very professionally done and is unlike any other OSX malware to date. It will periodically open porn sites, pop up warnings that the user’s computer is infected, and prompt them to purchase the MacDefender anti-virus software. The software purchase page is just a place to get the user’s credit card number, and no product is delivered.
For the most part this is a very low-risk trojan, and can easily be avoided by disabling the ‘safe files’ option, and not installing software that randomly appears on your computer. No website can arbitrarily scan your computer for malware, and if they tell you that you’re infected, they’re lying. If common sense and good security practice aren’t enough, you can install an anti-virus (eg. VirusBarrier or Sophos) that will pick up this trojan.
If you did accidentally install the trojan, it can be removed with the following steps:
- Open Activity Monitor (in /Applications/Utilities/), and find the MacDefender.app process in the list. If it’s there, select it and click ‘Quit Process’.
- Open System Preferences (in the Apple menu) and click on Accounts. Click on the Login Items tab for your user, and find MacDefender in the list. If it’s there, select it and remove it using the minus [-] button below the list.
- Delete MacDefender from your Applications folder.
Check out my article on Securing Leopard and Top 100 Security and Privacy Tips!
[Update 5/5/11] There are reports of variants of the MACDefender trojan going around under the name “Mac Security” or “Mac Shield”. For the reversers, check out this reverse engineering of the MACDefender binary.
Sophos Offers Free Mac Anti-virus
Sophos have released a free home edition of their anti-virus for Mac OS X users. This brings automatic on-access detection, and disinfection capabilities that cover Windows viruses/worms/trojans, as well as the few pieces of malware that currently exist for Mac OS X. Sophos claim that their antivirus does not use many resources, and thus does not slow the machine down like some A/Vs do.
They make the following statement which describes the current Mac malware situation fairly well:
Although malware is more common on Windows than it is on Macs, there is a growing concern that, as Mac OS X market-share continues to grow, the operating system will become a more attractive target for cybercriminals.
Even though I would rate the current malware threat to Macs as fairly low, we will undoubtedly start seeing more and more of it as Macs gain market share in the home. Attackers know that companies are getting better and better at protecting against malware, however home users are notoriously bad at protecting their systems and keeping them patched. Surely if you’re a regular visitor of Security Generation, you’re not one of those people ;)
I haven’t tested this yet, and Sophos aren’t the first to arrive on the Mac AV scene. ClamXav is a good free open source alternative, however one benefit of Sophos’ solution is the experience of their research team, and vast database of malware (don’t expect this to remain free forever). Although I personally wouldn’t pay for Mac AV just yet, there are also some good solutions from Kaspersky and Intego’s VirusBarrier.
Loading ...
