Apple strikes back with update blocking new scareware Apple has updated Mac OS X to detect a piece of scareware that managed to bypass its malware-blocking measures. As previously reported, a variant of a rogue antivirus package known as MacDefender was introduced on Tuesday that evaded the malware protection feature built into the latest version of the Mac operating system. In a …
Also, "Safe downloads list"? Should surely be called "Unsafe downloads list", shouldn't it? Don't suppose it's really a white-list....
And therein lies the problem. How long will it be before someone starts appending random garbage to the ends of the installer files so that every single download has a different signature?
Apparently Facebook has already managed to block the attacks:
http://www.f-secure.com/weblog/archives/00002173.html
F-Secure also has some interesting discussion about what will happen when Google Images finally successfully blocks the malware links showing up there, effectively bursting this bubble.
http://www.f-secure.com/weblog/archives/00002175.html
Finally Sophos adds:
"It also appears that this malware is using the tried-and-true affiliate distribution method. The writers recruit other people to perform black-hat SEO, infect web pages and post blog spam and assign each one a unique affiliate ID to use in the URL for their traffic.
This allows the criminals to track which affiliate referred the victim and pay them a commission upon purchase of the fake software, enabling the criminals to cast a much wider net by sharing a portion of the profits with their "affiliates.""
http://nakedsecurity.sophos.com/2011/06/02/apple-to-malware-authors-tag-youre-it/
Affiliate malware, who would have thought...
But surely if the affiliate ID parameter in URLs has been identified, Google can use it to block the links, both in Images and via their Safe Browsing service that is used by Chrome, Safari and Firefox.
http://googleonlinesecurity.blogspot.com/2011/04/protecting-users-from-malicious.html
Demographic differences are the most relevant thing I think - amongst the Mac demographic is a significant group of people with no technical grounding. A desktop Linux user is unlikely to believe that there's some magical piece of antivirus software installed that they didn't know about, and weirdly never saw before becoming 'infected', or alternatively that you can virus scan from within a browser, and is very unlikely to act without secondary confirmation (by manual inspection of the filing, possibly) and without first checking the web for suitable open source tools.
You might want to take a good, hard, look at Android. Which is built on Linux (albeit an increasingly divergent fork of it).
Also, I seem to recall a bunch of netbooks originally appearing with various flavours of Linux on board. Are you seriously claiming every single one of them has only been sold to knowledgeable IT people? I'd love to see your evidence if so.
Every human being on Earth suffers from some degree of ignorance. It's not limited to platform, career, or intelligence: it's just not possible to know everything about everything today.
"...amongst the Mac demographic is a significant group of people with no technical grounding."
Like every pee-cee user has a degree in anything vaguely techy. Anyway, research has shown that Mac users are better-looking, smarter, richer and more fun to sleep with. Or was I only dreaming that last part?
begin when an obfuscated malware will find its way through the AppStore.
In the meanwhile, the folks can just recompile with another compiler or change really small pieces of code to get a different signature that Apple will have to add to its detection tool.
They'll always be one step ahead.
And heuristic is no help as the trojan (for what i have read) perform zero suspiscious actions...
... it's enabled by default. Also, no user has root-level privileges, everything runs in userspace.
Even when installing apps, you do so as 'admin', which is not the same as 'root'. It's a lot harder to fully compromise a Mac since, unlike Windows, no user has root level privileges unless they are explicitly (and difficultly) granted.
That's not to say you couldn't have serious security problems while running in userspace, but it's not nearly has bad as every user having full control over the machine's core...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
