ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes
Home / News & Blogs / Hardware 2.0

Apple's 'Mac Defender' update allows users to run known malware

By | May 31, 2011, 3:46pm PDT

Summary: Apple has now released a security update for Mac OS X ‘Snow Leopard’ users to protect them from ‘Mac Defender’ and associated variants. Problem over, right? Wrong!

Apple has now released a security update for Mac OS X ‘Snow Leopard’ users to protect them from ‘Mac Defender’ and associated variants. Problem over, right?

Wrong!

First off, this update only applies to Mac OS X 10.6.7. If you’re running an earlier version of Snow Leopard then you need to make sure you download the updates. However, if you’re running an older version of Mac OS X then you’re outta luck unless you hand over dollars to Apple for an upgrade. This is a pretty big problem as the install base for users not running the latest version of Mac OS X is pretty significant. According to NetMarketShare data for April 2011, while the usage share for Mac OS X 10.6 is 3.65% (the breakdown of this into 10.6.x versions is not given), Mac OS X 10.5 still has a usage share of 1.3%, while Mac OS X 10.4 has a usage share of 0.37%.

Even of the visitors to Hardware 2.0, some 20% of Mac users are running Mac OS X 10.5 or lower.

That sucks.

Secondly, Apple’s update offers mediocre protection at best, and goes as far as allowing users to install known malware onto their systems.

Open???? Seriously? ‘Open’ is an option for a file that ‘will damage your computer.’ Also, ‘Move to Trash’ … again, is this for real? How about a ‘nuke it from orbit’ option instead?

Crazy stuff!

Finally, Mac Defender’s gone viral on Facebook, which is very bad news.

Bottom line, Apple users can’t rely on Apple to protect them. Instead they should download and install a third-party malware scanner.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Hardware 2.0”

Topics

Apple Macintosh, Malware, Apple Inc., Adrian Kingsley-Hughes, Spyware, Adware & Malware, Cyberthreats, Viruses And Worms, Desktops, Security, Hardware

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

25
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Apple's 'Mac Defender' update allows users to run known malware
nix_hed 1st Jun
@Cylon Centurion or just get NoScript for Safari (it's been available since Safari 5 came out) and turn off the "Open safe files after download" option. Both should be part of Safari as a default.
View in thread
0 Votes
+ -
I'm confused
oncall Updated - 31st May
Don't most malware scanners have an option to "run program anyway" you know for the cases when the scanner triggers off of a legitimate piece of software?
0 Votes
+ -
Contributr
RE: Apple's 'Mac Defender' update allows users to run known malware
Adrian Kingsley-Hughes 31st May
@oncall as an option perhaps ... can you point me to a Windows tool that handles known malware that way by default?
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
jeremychappell 31st May
@Adrian Kingsley-Hughes Err, the blue button is the default. Also, I think you'll find that MacDefender is Intel only - and the number of Intel Mac owners running Mac OS X versions lower than 10.6 is vanishingly small. Do you even know if MacDefender even runs on Mac OS X prior to 10.6?!
0 Votes
+ -
I think you mis-stated your argument then
oncall 31st May
@Adrian Kingsley-Hughes

Ahh I see, your issue isn't the "run anyway" option, your issue is having the "run anyway" on the first tier of options? Fair enough but I'm not sure I'd call it "crazy stuff". Personally, I would prefer a "block and don't bother me" option but I have, as of yet, not seen this malware.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
itguy08 Updated - 31st May
@Adrian Kingsley-Hughes

The blue box is the default in OS X. Hit Enter and it will go to the trash. And you can't run stuff from the trash.

I'll stick with the Apple stuff and common sense. It has worked for me since 2002.
0 Votes
+ -
"I'll stick with the Apple stuff and common sense." ...
SonofaSailor 31st May
@itguy08

erm, It was the lack of common sense that brought you to Apple products in the first place.
0 Votes
+ -
Presumably Adrian doesn't like the "Discard Changes" button
Richard Flude 31st May
when you close with unsaved changes.

C'mon the user is warned, if they ignore the warnings and continue (choosing to override the default action) this is in line with the Human Interface Guidelines and the user is responsible.

It's not for Apple to make the user experience as punishing as windows. Get your own nanny if you need one.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
Cylon Centurion Updated - 31st May
Skip the Apple hand-holding. Dump Safari for Firefox and install Adblock and NoScript, and your security woes are all but fixed. NoScript especially will prevent the redirects.

Apple has shown it has no intentions of supporting user's troubles with malware. Why anyone thought this patch would be a cure all is beyond me. They have too much of an ego to do that.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
nix_hed 1st Jun
@Cylon Centurion or just get NoScript for Safari (it's been available since Safari 5 came out) and turn off the "Open safe files after download" option. Both should be part of Safari as a default.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
jetsethi 31st May
This doesn't make much sense. All scanners and security-related software allow you to run programs just in-case.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
Droid101 Updated - 31st May
@jetsethi
Simply not true. In Windows, for instance, the "run anyway" option isn't listed unless you first click the "show other actions" button. The only options it'll show by default are delete or exit. AND, it asks "are you sure you want to run anyway" if you somehow accidentally clicked twice to get that option up in the first place.
0 Votes
+ -
"Simly not true?"
oncall 31st May
@Droid101

First you say it is "simply not true" them go to list that yes they do have a "run anyway" option? So the correct answer is "yes", other malware scanners do have a "run anyway" option. You just disagree with how Apple implemented that choice.
0 Votes
+ -
Contributr
RE: Apple's 'Mac Defender' update allows users to run known malware
Adrian Kingsley-Hughes 31st May
@Droid101 ... and then the on-access scanner usually kicks in and blocks the malware again ... oh, which Mac OS X doesn't have ...
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
CarlitosLx 1st Jun
@Droid101
That's not the anti-malware, that's IE9's default behaviour happy
(read down for AKH's reply)
0 Votes
+ -
Contributr
RE: Apple's 'Mac Defender' update allows users to run known malware
Adrian Kingsley-Hughes 31st May
@jetsethi as an option perhaps ... can you point me to a Windows tool that handles known malware that way by default?
0 Votes
+ -
Message has been deleted.
itguy08 Updated - 1st Jun
  • Flagged
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
Scrabbler 31st May
Don't you ever get false positives from a Windows antivirus?
I would be upset if an antivirus "nuked" some of my valid files without asking me first.
0 Votes
+ -
That would be a valid argument (maybe)...
SonofaSailor 31st May
@Scrabbler

if we were talking about a false positive. But we're not


Nice, though, that you stick to the Apple fanboi playbook, and when someone points out a flaw in Apple or Mac, your response is "b - b- but... what about Windows"
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
Scrabbler 31st May
@SonofaSailor
What's your point? Does your Windows antivirus give you an option to download the file anyway only if it is a false positive?
PS the flaw we are talking about here is really with Google's search engine and the user.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
sxb101029 Updated - 31st May
I have just updated the security update in my Macbook, it was about 2 MB, did not take very long. I almost did get infected by it -- Here is what happened: It came via Google images file. I know some people speak very highly of Firefox, but keep reading what happened to it below:

I had the Firefox opened at the moment, & was able to stop/quit the download when it was trying to download at a very fast speed. Having the download stopped half way on my Mac, it damaged the Firefox, & afterwards the Firefox would not close, it required Force Close.

I have completely un-installed Firefox, those little bits & pieces had to be removed to have fresh clean install (Library, Caches, & Preferences have bits of it). Also, I would suggest to uncheck the check-box in Safari Preferences where it says to open the files automatically after download.

I own 2 Windows (veteran user) & 2 Apples (since 2009), & honestly I would have had to do a lot more than just this if it were Windows getting infected, I have been there, & done that many many times since Win 95.
0 Votes
+ -
What you describe is either a totally separate issue or coincidence
wackoae 31st May
@sxb101029 Downloading something is not enough to do any damage. The "destructive" code has to run.

What you describe has absolutely nothing to do with the issue. It is very likely a bug on the version of FF you have or simply a coincidence. But there is absolutely ZERO way for a simple download to cause any damage.
0 Votes
+ -
RE: Apple's 'Mac Defender' update allows users to run known malware
sxb101029 31st May
@wackoae
Well, I had been reading about this (MacDef) anyway, & the window illustrations/nomenclature got my attention, it was the same.
0 Votes
+ -
Message has been deleted.
the Tea Lady Updated - 1st Jun
0 Votes
+ -
One wonders if the term "false positive" ever occurs to a blogger
ego.sum.stig@... 31st May
That and, what about the poor crackers who might want to test their wares. Does anyone not think of them? :P
0 Votes
+ -
Because...
Just True 31st May
Because Jobs (and Gates) hires staff in HIS image - there is no way that their IT will be smarter than the hacker. So, it's better not do believe in THEIR fairy tales too much... - use your own brains, if it's possible, and you will be safe.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix