Hardware 2.0

Adrian Kingsley-Hughes

Mac Defender malware now spreading virally via Facebook

By Adrian Kingsley-Hughes | May 31, 2011, 12:34pm PDT

Summary: Mac malware has made the leap to Facebook and is now spreading virally, claiming to be a video of IMF boss Dominique Strauss-Kahn.

[UPDATE: Apple issues security update to detect and remove Mac Defender and variants, but still allows users to open known infected files!]

Mac malware has made the leap to Facebook and is now spreading virally, claiming to be a video of IMF boss Dominique Strauss-Kahn.

Security firm Sophos has the details:

The fake anti-virus attack first appears in your timeline as a message apparently posted by one of your friends.

In case you’ve been out of the loop, the text used refers to the news story of IMF chief Dominique Strauss-Kahn who is facing charges in New York over charges that he allegedly tried to rape a hotel maid.

People who know what they’re doing will recognize this for what it is - a sick fakey headline and the promise of a video is used to entice people to click on the link which goes to a site pushing malware - in this case Mac Defender. For good measure clicking on the link also posts the same message onto the Facebook wall of the person clicking on the link - this helps find the next sucker victim.

Sophos senior technology consultant Graham Cluley calls it a ‘a genius piece of social engineering.’

Needless to say, if you see this on Facebook, don’t click on the link!

Apple has promised a patch for Mac Defender and its variants, but so far this hasn’t materialized. [UPDATE: The Apple security update has just materialized.]

Windows users shouldn’t get too cocky though, given that the same viral ‘video’ is being used to spread the Zeus botnet malware to the Microsoft crowd. Linux users don’t get to play.

Additional coverage:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Hardware 2.0”

Can Linux on the desktop and DRM ever coexist?

Apple releases 'Mac Defender' security update

Topics

Facebook, Apple Macintosh, Sophos Plc., Malware, Spyware, Adware & Malware, Cyberthreats, Social Media, Viruses And Worms, Security, Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

RE: Mac Defender malware now spreading virally via Facebook

blind obedience 2nd Jun

Who says I am the one flagging you. I could care less and in fact I want people to see what you type it just further proves what an idiot you are. Don't you find it funny how your posts keep getting deleted and mine do not. I am not sure what your obsession is with me but you should seek professional help.

What are you? 10 years old? Nah nah na-nah nah Nah nah na-nah nah

sheesh...

View in thread

Please Select
Please Select

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Cylon Centurion 31st May

... The flood gates just opened up.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Test Subject 31st May

@Cylon Centurion

Don't say that too loud. The Apple police will be knocking on your door.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

tonymcs@... 31st May

@Cylon Centurion

And there's a lesson here for Linux users too. There is no magic. If Linux grew to near 9%, gained a development environment that didn't suck too much, was used by people who had money or believed in paying for software, then they could play too.

The same applies to a clay tablet and stick, which has about the same global share wink

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

ScorpioBlue 1st Jun

And there's a lesson here for Linux users too. There is no magic. If Linux grew to near 9%, gained a development environment that didn't suck too much, was used by people who had money or believed in paying for software, then they could play too.

Garbage. Unlike Apple, Linux gets it's software through it's distro supported Package Repository. By default, the executable bit is turned off and you can't just click on wizards in the wild and download things like you do with Windows. If you've ever used it (and I suspect you haven't), you would know this.

I wouldn't be surprised if Apple extends it's App Store the same way a Package Repository does, only unlike Linux, you'll have to pay for many of the apps that are in there.

0 Votes

+ -

Message has been deleted.

bobiroc Updated - 1st Jun

Reply
Flagged

0 Votes

+ -

People have to be really clueless to be harmed from this

DeRSSS Updated - 31st May

@bobiroc

First of all, people should all of sudden believe that there is "virus" on Macintosh, even though in whole twenty seven year long history of these computers there was no even single epidemic of a virus (if thogh laboratory, "proof of concept" examples did exist).

Second, user has to believe that non-existing, never previously known program "Mac Defender" would all of sudden heal the computer of "virus".

Third, after agreeing with this trick and **voluntary installing** it and seeing that, despite the promise, the computer is not healed, user has to believe to this program for **second time** that it will actually heal the computer in the end of the day if user will pay for "full" version of this program.

All in all, user has to be at least *thrice* clueless to actually get harmed. No comparison to PCs, which really have history of virus epidemics, what makes the social engineering actually working big scale in reality, not only in the media as with this MacDefender thing.

Reply
Flag

0 Votes

+ -

Let's count the number of things wrong with the sentence

facebook@... 31st May

@denisrs

If you want to go back in history to begin counting -- which you obviously do because there aren't any really relevant modern viruses affecting Windows 7 any more -- the *First* PC virus ever written -- Elk Cloner -- was for the Apple.

But, to be fair, Mac OS X is a fairly immature operating system that only goes as far back as Leopard -- Tiger being on a completely different platform. Even still, Leap-A and a number of other viruses existed on both Leopard and Tiger.

Given the fact that these computers are sold on the FUD that they are somehow more secure than a modern Windows 7 Operating system and that the Mac OS goes out of its way to manage the user experience, Mac users tende to be naive there is no comparison.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

ItsTheBottomLine 31st May

@denisrs your denial is entertaining to say the least.

0 Votes

+ -

RE: People have to be really clueless...

bobiroc 31st May

@denisrs

Oh I am not denying that but if 25 years working with computers and in IT has taught me anything there are many clueless computer users out there no matter what platform or software or technology they choose to use.

No one isn't saying that this scam like all the other similar onese are not obvious (especially to those that are computer literate) but it does not change the fact that they are effective. This scam is virtually no different than all the Scareware that gets on Windows computers and yet millions have fallen for those scams too. They all have one goal and that is to trick the user into thinking their computer is compromised and to get them to enter a credit card thinking the fake software will fix it.

Also as it has been said many times viruses (and I mean actual viruses) and worms are not very effective in modern Windows or fully patched Windows systems either unless for some reason you are using Windows XP Pre SP2 or earlier versions of Windows without a firewall or something insanely stupid. Of course stuff like that happens too as most of the machines I see with an infection are not properly patched. Either that or they were doing something "clueless" to let the infection in. You can bring up the history of Windows viruses all you want but it doesn't change the fact that it is irrelevant today.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

comp_indiana 1st Jun

@Bobiroc

Let's keep in mind that XP is still the most popular version of Windows, since Vista sucked so badly. Ummmkay?

One problem doesn't mean that 'security though obscurity' BS is proven. It's not, and this is still a socially engineered exploit, not the common, garden variety Windows exploit that requires NOTHING of the user whatsoever.

Windows 7 doesn't change things much, the Windows(?) reputation is still suffering from XP's near total lack of security, just like Mac users are still suffering from bogus FUD, etc.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Lester Young 1st Jun

@comp_indiana

You are full of it.

This idea that XP is the truly representative version of Windows is nonsense. XP is about half of worldwide Windows usage, and only because of all the pirate copies throughout the developing world. It is a distinct minority of Windows in the developed world. Win7 is the fastest selling version of Windows ever and its share is edging ahead of XP in Europe and North America. So which version of Windows is "popular?" I know you love your straw man, but it's time to give it up.

Your reference to a "common, garden variety Windows exploit" requiring no interaction from the user is completely false in today's environment. Most Windows exploits are socially engineered, just like the Mac exploit.

If there ever was a system that had its reputation damaged by FUD it was Vista, not OS X. Acknowledging that OS X is as vulnerable to malware as modern versions of Windows is not FUD.

0 Votes

+ -

Perspective: Mac v PC viruses

HollywoodDog 31st May

I once worked for a major antivirus company testing scan products, and we had a secure lab and in it a CD full of every known virus for PC at the time (11 years ago). If memory serves, the expected count for each daily build of the scanner when scanning the disk was about 100,000. There have, of course, been many viruses since.

This Mac Defender thing is one piece of malware (which a user has to run and provide a password to install).

We've seen three dozen stories about it on ZDNet. So
Mac: 1 malware = 36 stories
PC: x00,000 malware = 4 or 5 stories

There isn't an epidemic of Mac malware. There's an epidemic of Mac malware scare stories.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Droid101 31st May

@HollywoodDog
Do the checks you get from Steve Jobs make you sleep better at night?

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

ItsTheBottomLine 31st May

@Droid101 LOL - very good.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Jesster 2nd Jun

It's Direct Deposit into my account, and wrong Steve. Balmer instigated because Macs and viri don't get enough newstime and he wants to balance the coverage in order to make MightySoft look better. Face it he has to do something other than lose revenue and market share.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

bobiroc 31st May

@HollywoodDog

Ok... Once again you are living in the past as viruses and worms are not really a big issue anymore as if they do end up on a computer it is usually because a piece of malware like this has opened the door for them.

Second of all this is the first piece of Malware for MacOS that anyone has ever seen grow and be spread like this so it comes to a shock to many people. This is the way computers and people are being exploited today.

Thirdly it is no different than the very many articles and blogs written about conficker a few years ago when that was made out to be the threat that took down Windows for good and ended up only really affecting about .07% of all the Windows computers in the world. I am sure there were 36 or more stories about Conficker then too and it is still brought up as an example of a major Windows exploit today even though there was a patch for Windows months before it even hit and it only really affected unpatched systems.

I have had my hands on one Mac with this Malware and have received several emails and messages from teachers I work with and family and friends that use Macs that have had this installed. Thankfully this one is relatively easy to uninstall and remove and as long as they did not cough up any credit card or personal information they should be OK.

Reply
Flag

0 Votes

+ -

Untrue - not living in past

HollywoodDog 31st May

@bobiroc ... and I'm certainly not of the opinion that malware doesn't matter. I worked in A/V company for heaven's sake.

You said: "this is the first piece of Malware for MacOS that anyone has ever seen grow and be spread like this so it comes to a shock to many people"

Exactly. PC gets malware, it's dog-bites-man. Mac gets malware it's man-bites-dog.

It's no surprise that the PC centric industry media is going to go on about this. I'm just saying the hype is overblown.

Don't install software off the internet unless you're totally positive what it is, and if you're not convinced you can avoid this temptation, go get A/V software for the Mac.

I am running my Macs without it.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

bobiroc 31st May

@HollywoodDog

"You said: "this is the first piece of Malware for MacOS that anyone has ever seen grow and be spread like this so it comes to a shock to many people"

Exactly. PC gets malware, it's dog-bites-man. Mac gets malware it's man-bites-dog."

I think you severly overestimate the MacOS user community. They are people just like Windows users and they will remain their own worst enemies when it comes to stuff like this. This malware is biting and for most it becomes an annoyance but for some it is very effective.

"Don't install software off the internet unless you're totally positive what it is, and if you're not convinced you can avoid this temptation, go get A/V software for the Mac."

That is great advice. Now see if people will actually follow it. Current events and recent and distant history has shown that is the one factor that will not change. The operators of the computer will be it's downfall no matter how secure you make an OS or piece of software. Malware writers know this and that is why they choose to use this method and other methods the prey on the unsuspecting user like phishing.

0 Votes

+ -

Message has been deleted.

ScorpioBlue Updated - 1st Jun

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Aerowind 31st May

@HollywoodDog Did you miss the memo? You don't even need to put in the password anymore.

Reply
Flag

0 Votes

+ -

I didn't see that

HollywoodDog 31st May

@Aerowind ... and I don't know how any software can get installed on OSX without you providing your admin password.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

iPwn Updated - 31st May

@HollywoodDog
you obviously dont read enough of the articles do you...

http://www.zdnet.com/blog/bott/mac-malware-authors-release-a-new-more-dangerous-version/3385?tag=mantle_skin;content

PS, the reason why this is so overblown, is that Mac's are sold on the basis that you have a more secure system. I'm not going to get into the arguement, since its been argued many times already...

0 Votes

+ -

Message has been deleted.

itguy08 Updated - 1st Jun

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

iPwn Updated - 31st May

@itguy08

If you actually read the article in the link i provided, it actually states this;
"In this new variation, no password is required as long as youre logged in using an administrator account. That might lull a potential victim into thinking theyre safe."

this is because when you are running under the ADMIN account, (which is the default account if no-others are created)...if you're using any account apart from the admin's then yes, you will need to obviously punch in the credentials...

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

ItsTheBottomLine 31st May

@Aerowind Yes he did - fantasy land - look at the name of all places - not based in reality "Hollywood" Sheesh.

0 Votes

+ -

That's right...you don't know.

ye 31st May

@HollywoodDog: I don't know how any software can get installed on OSX without you providing your admin password.

Like many Mac fanboys who discuss security issues you have no idea what you're talking about. But that hasn't stopped you.

0 Votes

+ -

Message has been deleted.

itguy08 Updated - 1st Jun

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

ItsTheBottomLine 31st May

@HollywoodDog You know by your reactions and @denisrs above, this looks like it stings... A LOT. Very entertaining...thank you.

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Tommy S. 1st Jun

@HollywoodDog (which a user has to run and provide a password to install).

Not anymore...

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Droid101 31st May

Don't listen to the article, sheeple. Click the link! The more people infected, the faster Apple Engineers will make a "magical" and "revolutionary" malware scanner.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

doh123 31st May

@Droid101
since you don't know.. there is already an anti-malware blocker/cleaner built into Mac OS X and totally hidden so users don't have to worry about it, this isn't new

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Cylon Centurion 31st May

@doh123

Kinda useless when the thing isn't updated.

0 Votes

+ -

What updates does file quarantine need?

HollywoodDog 31st May

@doh123 ... http://www.macworld.com/article/142457/2009/08/snowleopard_malware.html

"In Snow Leopard, Apple has enhanced File Quarantine to also check files against known malware, pulling from a list of malware definitions at System/Library/Core Services/CoreTypes.bundle/Contents/Resources/XProtect.plist. As of this writing, the file contains only two definitions: the OSX.RSPlug.A Trojan Horse, first discovered in 2007, and the OSX.iService malware embedded in the pirated iWork installer mentioned earlier. However, Apple told Macworld that the list of definitions can be updated via Software Update."

Looks like it has those two definitions plus now this new one for Mac Defender. That's three.

Are there more known threats out there that Apple should be defending against but is not?

0 Votes

+ -

Great

Lester Young 1st Jun

@HollywoodDog

This Mac malware scanner is entirely definitions-based, like the Windows malware scanners of 10 years ago. Not much protection when malware rapidly changes form as in Mac Defender to Mac Guard. When will they develop a heuristic scanner?

0 Votes

+ -

Message has been deleted.

X41 Updated - 1st Jun

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

DannyO_0x98 31st May

Oh well. Noted.

By the way. I have detected from my older-skewing real world friends that a bit of the bloom is off of Facebook. It's hard to say how much of this is media coverage of privacy issues and how much is related to the nearly binary nature of friend in the Facebook world, when, in the real world, the word represents a spectrum of relationships.

Add in Facebook = vector for malware and, well, I wonder.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

LoverockDavidson 31st May

Its times like these I'm glad I don't own a Mac.

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

victorpanlilio@... Updated - 31st May

@LoverockDavidson... in the same sense that people would say "I'm glad I know only one language" ?

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

LoverockDavidson 1st Jun

@victorpanlilio@...
Pretty much. I don't travel overseas so not much incentive to learn another language.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

Lester Young 1st Jun

@LoverockDavidson

You don't live in California, do you?

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

StandardPerson 31st May

@LoverockDavidson, I take it your friends send you a lot of rape videos, which you actually watch, eh?

Reply
Flagged

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

bobiroc 1st Jun

@LoverockDavidson

Owning a Mac and using MacOS is fine. Being in denial that this is a problem and could get much worse based on bringing up the history of how MacOS has had only a couple viruses and a small amount of Malware in the past is the problem.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

LoverockDavidson 1st Jun

@bobiroc
You said it, being in denail is much worse. If malware has happened once on MacOS it can happen again.

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

rdw551 31st May

Just another reason not to use Facebook.

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

brichter 1st Jun

This conversation was totally predictable:

Windows fans gloating
Linux fans whining (if they come out of the woodwork at all)
Apple fans trying to trivialize the issue

What's the real moral of this episode? It proves that of the 2 camps (1) OS X is so secure nobody can write malware, 2) Apple doesn't have the market penetration to give any ROI on the invested time), #2 was correct.

Apple issued an update to block the malware and within 24 hours the malware was not only changed to circumvent the fix from Apple, but the black hats even added another feature (password bypass).

Welcome to the Bigs, Apple. It's obvious your existing malware solution isn't worth crap, relying on existing definitions will always leave you playing catch-up. A real solution needs heuristics, so the Apple Dev corps better get on the stick and make something that works.

BTW, I'm on my Apple right now, but I'm OS-agnostic so take your shots, I'm bulletproof. LOL

Reply
Flag

0 Votes

+ -

RE: Mac Defender malware now spreading virally via Facebook

bobiroc 1st Jun

@brichter

You sound much like me. I am not gloating that this has happened but I have always been a realist when it comes personal security. It doesn't matter if it is technology that you are trying to secure or your own personal life, home, car, whatever.

It just is just upsetting to see the Mac Apologists keep repeating the lines that OS X has had no viruses in 11 years and then argue that this is not a virus. That is great because it is Malware very similar to the Malware that plagues Windows and preys upon the operator of the computer.

Apple will do what Microsoft does and release patches when the Malware becomes known to them and like Windows the user will have to make a conscious effort to make sure their computer is updated and secure. How much worse that this will get for Apple no one knows, but seeing how this specific Malware has morphed into different forms and names and the distribution has found many avenues to try and trick the user within only a few weeks it sure looks like this could be a start of more bad things to come.

The real question is will some MacOS users continue to feed the old tired lines about viruses and deny that this is even a concern solely based on the fact it has not happened to them or anyone they know. Will it take for themselves to become a victim to acknowledge it?