Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/25/2011
02:07 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Apple Promises MacDefender Fix

The impact of rogue security software attacks like MacDefender has prompted Apple to issue advice about the malware and to commit to issuing a software fix.

Building The Mac Office
(click image for larger view)
Slideshow: Building The Mac Office
After years of insisting that Mac OS X is more secure than Windows, Apple on Tuesday acknowledged that its systems may be affected by security issues too.

The company posted a support article on its website offering advice about how to avoid or remove MacDefender, fake security software that attempts to convince users to pay as much as $80 to remove malware that isn't actually present on users' machines.

Apple also said it plans to issue a software update shortly that will automatically find and remove non-infectious software components that MacDefender and its variants actually do deposit on affected Macs, such as aliases in the Login Items folder.

In so doing, Apple appears to have abandoned its previous practice of downplaying security issues, a tendency exemplified by the company's decision to remove a support webpage advocating the use of antivirus software in late 2008. The Web page was only up for about two weeks when Apple removed it.

Security software companies, which had been predicting more Mac malware for several years without much to show for it, saw Apple's recognition of the need for antivirus software, however brief, as vindication of their claims.

Apple meanwhile, in an uncharacteristic response to a question about security, insisted the whole incident was merely house cleaning. "We have removed the KnowledgeBase article because it was old and inaccurate," an Apple spokesperson said in an emailed statement in 2008. "The Mac is designed with built-in technologies that provide protection against malicious software and security threats right out of the box. However, since no system can be 100% immune from every threat, running antivirus software may offer additional protection."

In addition to downplaying security risks, Apple has been telling its support personnel to avoid advising customers about how to resolve security problems. The company's Apple Care representatives were told, "Explain that Apple does not make recommendations for specific software to assist in removing malware," according to internal documents obtained by ZDNet.

With Apple's recognition of the threat posed by MacDefender, security companies appear to be delighted. Chester Wisniewski, a security researcher at Sophos, a U.K.-based security vendor that makes Mac OS X security software, published a blog post welcoming Apple to the security community and tweaking the company for referring to MacDefender as a phishing scam, where blame belongs with gullible users rather than vulnerable software.

"We have observed that most users are being infected through malicious Web pages that are turning up in Google Image searches," wrote Wisniewski. "The malicious Web pages display a fake security scanner convincing the victim to load a program that is in fact malware."

MacDefender, which also appears under the names MacProtector and MacSecurity, utilizes JavaScript to present simulated Mac OS X dialog windows, through which it attempts to convince users that a computer infection exists.

Security concerns give many companies pause as they consider migrating portions of their IT operations to cloud-based services. But you can stay safe in the cloud, as this Tech Center report explains. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21392
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
CVE-2021-21393
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-29429
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.