ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Apple adds malware blocker in Snow Leopard

By | August 25, 2009, 11:51am PDT

Summary: Apple has quietly added a new Snow Leopard feature to scan software downloads for malware, a no-brainer move that coincides with a noticeable spike in malicious files embedded in pirated copies of Mac-specific software.

Apple’s commercials may give the impression that Macs are virus-free (.mov) but the company isn’t taking any chances with the newest Mac OS X refresh.

Apple has quietly added a new Snow Leopard feature to scan software downloads for malware, a no-brainer move that coincides with a noticeable spike in malicious files embedded in pirated copies of Mac-specific software.

[SEE: iBotnet: Researchers find signs of zombie Macs ]

The malware blocker, first spotted by the folks at Intego, appears to be scanning installation packages for signs of known Mac malware.

In the screenshot below, the anti-virus flagged a malicious filed called “OSX.RSPlug.A,” which is a DNS changer Trojan horse that runs on Mac OS X and changes the DNS settings on the compromised computer.

[ SEE: Mac OS X Malware found in pirated Apple iWork 09 ]

It is not yet clear how Apple is handling the package scans for signs of malicious software.

I have confirmed that Apple is not using the open-source ClamAV engine to handle these scans so it’s likely the company has entered into an agreement with a commercial anti-virus company.

This isn’t the first official acknowledgment from Apple that the Mac operating system may be susceptible to malware.  This Web page on Mac OS X security actually recommends the use of third-party anti-virus software to get “additional protection.”

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Apple Macintosh, Malware, Apple Inc., Spyware, Adware & Malware, Cyberthreats, Apple Mac OS X, Apple Mac OS, Desktops, Viruses And Worms, Security, Operating Systems, Software, Hardware, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

135
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Apple adds malware blocker in Snow Leopard
birumut Updated - 29th Apr 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat
View in thread
0 Votes
+ -
Why is Apple such an M$ $hill?
NonZealot 25th Aug 2009
Doesn't Apple know that there is 0, zero, nada, zilch malware targeting OS X?
0 Votes
+ -
No malware targeting OS X...really?
ths40 25th Aug 2009
http://blogs.zdnet.com/security/?p=3575

http://www.macforensicslab.com/Malware_on_Mac_OS_X.pdf

http://christodonte.com/2008/11/new-malware-targeting-mac-os-x/

http://www.theregister.co.uk/2008/01/25/mac_malware_menace/

http://blog.trendmicro.com/mac-os-x-dns-changing-trojan-in-the-wild/


And on, and on, and on.

So just keep on keeping your heads in the sand Apple fanboys/girls. Nothing at all to worry about.
0 Votes
+ -
First NonZ really roped you in...:P
James Quinn 25th Aug 2009
Very funny indeed. Second you named what 5? I can't see where they do
much in terms of real damage. Still 6 WOW time to panic! Or is it?

Wake me when some real damage in the real world occurs to a given Mac
system or systems and then I'll be interested.

I do think its a good idea for Apple to do this however butter safe than
sorry I always say.

Pagan jim
0 Votes
+ -
Margarine safe than happy, I always say...
mgp3 25th Aug 2009
butter safe than sorry I always say.

devil
0 Votes
+ -
Did you read?
martin23 25th Aug 2009
You seem to have missed the drift of nonzealot who is notorious on the site as a MS rather than Apple fan.

The updated MS-DOS fans of 20 years ago are no different today always needing to criticise other peoples choices.

20 years ago that was because most people DOS was a dog of an OS but it did marketing well and now has 90% of the PC market. Strange they still attract the same sort of supporters.

0 Votes
+ -
hmm...
Badgered 25th Aug 2009
You seem to have missed the drift of nonzealot who is notorious on the site as a MS rather than Apple fan.

I think you're mistaken... I hear he owns a MacBook.
0 Votes
+ -
Pot calling the kettle...
bmonsterman 25th Aug 2009
You said:

"The updated MS-DOS fans of 20 years ago are no
different today always needing to criticise
other peoples choices."

Then you went on to criticize other peoples
choices:

"20 years ago that was because most people DOS
was a dog of an OS but it did marketing well
and now has 90% of the PC market. Strange they
still attract the same sort of supporters."

Hypocritical?
0 Votes
+ -
hook, line and sinker..... (nt)
Badgered 25th Aug 2009
.
0 Votes
+ -
Well there shouldn't be...
storm14k 25th Aug 2009
...based on their marketshare right?
0 Votes
+ -
Malware?
Eleutherios 25th Aug 2009
You and Mr. Naraine can say whatever you want but I've used Macs for 8
years both as a user (all 8 years) and developer (last four years), and I've
never, ever had a virus, trojan, whatever you want to call it, on my
computer.
0 Votes
+ -
Virus and Usage
Zem Black 26th Aug 2009
I've used both Mac (off and on for 6 years) and PC (over 10 years), and I've never had a virus on either. Part of it is dumb luck but most is simply taking some care in not hitting the wrong sites and opening suspicious email.
Still, there _are_ more viruses for PCs, that's fact. Another fact, there are viruses/worms for Macs, but there isn't the market share to make them widespread, yet.
0 Votes
+ -
marketshare myth
shanee25 27th Aug 2009
This is a common myth, but a myth it is.
Pre OS X Mac had loads of malware and even less marketshare. LINUX has
people creating malware to work on LINUX machines and their market
share is far smaller than the mac community. When it gets down to it, its
the robustness of the OS that keeps the number of malware down. There
are mac viruses out there, but the numbers are far lower than those for
XP and Vista.
Additionally, these malware require social engineering to work duping
users into downloading the viruses and giving consent to their
installation.
0 Votes
+ -
How do you know you are safe?
joblak@... 3rd Sep 2009
How do you know that you haven't had a virus on either platform unless you have anti-malware software running? A virus is not designed to flash a huge sign in front of you that says "I'm here, stealing all your private data".

You've not experienced dumb luck. You've just experienced dumb and blind. happy

Check out the Apple Security Guides for 10.4 and 10.5 and see how even Apple recommends anti-virus software.
http://www.apple.com/support/security/guides/
0 Votes
+ -
RE: Apple adds malware blocker in Snow Leopard
DannyO_0x98 25th Aug 2009
Why is "Open" a choice?

The problem I have with scanners is they require signature
updates and there will always be a window of vulnerability
between identification and signature download.

Leads me to wonder what the signature update mechanism is?
A daily phone home? Some sort of push mechanism? I hope to
high heaven an update notice is not a modal box popping up.

But, Mr. Naraine, earlier changes, such as confirmation on first
run and Administrator permissions for install into system areas,
were earlier indications from Apple that malware could be
downloaded and installed onto a Mac.
0 Votes
+ -
There are always a few False Positives
brendan@... 25th Aug 2009
That's why there's the Open choice, just like most windows anti-malware programs offer an option to ignore the advice just in case.

Still, however flawed the signature detection model might be, it's still a necessary part of any security setup. Just not the only part because as You've said, there's a window of opportunity.
0 Votes
+ -
Scanners
Jkirk3279 25th Aug 2009
I had a theory recently that Apple could change the paradigm for
fighting malware.


Suppose Apple created a database for spam, for example.

Mac Users who get a spam email, mark it as spam. The report gets
emailed to Apple.

The database is updated every day, and the spam definitions are
pushed out to Macs everywhere.

Thus the next time a Mac user starts to download an email that's been
tagged as spam, it either auto deletes or drops in to the Junk folder
automatically.

It's a small change, but it could be revolutionary. If all email
providers adopted this approach, spam blasters would find their
revenue stream drying up.

They'd have to alter the wording, bit count, create date, and keywords
of their spam continually.

And that would really put a crimp in the spam firehose we're all
dealing with.



0 Votes
+ -
Alot of companys
jdbukis@... 25th Aug 2009
already do this sort of thing and there are already blacklist servers for spam.
Even email clients have in built spam filters and settings to mitigate rigged emails.
0 Votes
+ -
Yeah, but are any of those companies named Apple?
NonZealot 26th Aug 2009
If not then you have to admit that when Apple comes out with its own clone that Apple will have invented this product and Apple, how did the OP phrase it... could change the paradigm for fighting malware.

LOL!
0 Votes
+ -
There is NO Malware...
arminw 26th Aug 2009
For the iPhone, because Apple has to approve each application, which
then gets a signature that allows it to to be executed. Apple could
extend their existing apps store to the Mac and thereby ensure that if
their customers only got their applications through iTunes, there would
be no possible way to ever get malware on the Mac, no matter how
popular it got.
0 Votes
+ -
FAIL - here's the first:
de-void-21165590650301806002836337787023 26th Aug 2009
http://www.internetnews.com/security/article.php/3721016

First of many, no doubt.

LOTS of people try to jailbreak their phones too and end up getting infected.
0 Votes
+ -
Really?
Jkirk3279 28th Aug 2009
So let me get this straight.

There's already a system where users mark emails as spam, the report
gets sent to HQ, the results are compiled, and the blacklist is pushed back
to the users?

Who is doing it?

I have a copy of SpamSieve, but it doesn't work that way. You train it by
marking emails as SPAM or GOOD, and it keeps a list of the keywords
culled from those examples.

But it doesn't phone home.

So far I haven't seen any service that does.
0 Votes
+ -
correction
shanee25 27th Aug 2009
Just wish to make a small but significant correction.
Administrator permissions have ALWAYS been needed to install into
system areas. This goes beyond mac and back to UNIX. Where this was
overlooked was in the case where users would be using their
administration account as their default. It may also be that this was an
option that was by default switched off, but it has always been available.
I have had is switched on for my machines since Panther.
0 Votes
+ -
RE: Apple adds malware blocker in Snow Leopard
Loverock Davidson 25th Aug 2009
Why would Apple need to have this software? I've read repeatedly in the talkbacks that there are no known exploits for it and that there is no need for this type of software.
0 Votes
+ -
There was a time this was true....
James Quinn 25th Aug 2009
Still times change and as Apple's market share increases it is likely to get
more attention. So once again Apple proves to be ahead of the curve.
Remember how many Windows systems had to go down in flames before
MS paid any attention and they even admitted to being soft on the issue
but said no more? I remember and I applaud Apple from learning from
MS example. I also applaud MS for finally taking the needed action if a
tad bit late.... still late is better than never.

Pagan jim
0 Votes
+ -
I'm confused...
Badgered Updated - 25th Aug 2009
There was a time this was true....

Even Apple's most recent commercials say Macs don't have to deal with all the malware and viruses Windows does. Yet they add malware scanners... Why?

Still times change and as Apple's market share increases it is likely to get more attention.

Where were you when I read time after time from Mac users that Market Share had NOTHING to do with it?
0 Votes
+ -
Simple....
James Quinn 25th Aug 2009
Windows has known several 10's of thousands of malware out there
including viri, addware, trojans etc.

As the poster above pointed out something like 5 for OSX of which I can't
recall a single article where a Macintosh has been damaged not a single
one. On the Windows side I can point to many an article over the years
and a recent one of late.

Pagan jim
0 Votes
+ -
Silly Jim... When will you learn..?
Wolfie2K3 25th Aug 2009
The point of modern malware is NOT to wipe your hard drive or otherwise damage your files or your computer.

The primary thrust of malware today is "PWNAGE". That is, being able to have your computer do work for the author(s) of the malware - be it sending out a boatload of spam, or launching a DDOS attack on some website.

The problem is, they aren't very well constructed and generally crash and cause more problems.
0 Votes
+ -
True its the current trend but trends tend to change.
James Quinn 25th Aug 2009
Pagan jim
0 Votes
+ -
jim....
Badgered 25th Aug 2009
I can't recall a single article where a Macintosh has been damaged not a single
one.

So I ask again... if there is no danger of being infected, why would Apple install a malware scanner?
0 Votes
+ -
That's not what he said...
Metronome49 26th Aug 2009
He didn't say there was no danger, and neither did Apple. He said that nothing has actually ever happened. Apple said that you don't have to worry about it.

Apple is being preemptive, which is a lot better than waiting around for when the market share grows and it becomes a problem and hurts their brand.
0 Votes
+ -
re: not what he said
Badgered 26th Aug 2009
He didn't say there was no danger, and neither did Apple. He said that nothing has actually ever happened. Apple said that you don't have to worry about it.

Actually, I agree with you. The problem is the way it's delivered... it gives the impression that you don't need it. In both Jim's comments, and the commercials. You, I, Jim, and Apple know that isn't true... but it's the impression they are giving. On Jim's part, I assume it's not intentional. On Apple's part... my feeling is that it is.
0 Votes
+ -
@badgered
Metronome49 26th Aug 2009
"Need" is a little too strong of a word here.

I don't think it's "needed" now. It's helpful as preemptive measure for if/when actual threats become prevalent. It may be needed later. Noone "needs" it though.
0 Votes
+ -
@Metronome49
Badgered 26th Aug 2009
"Need" is a little too strong of a word here.

I don't think it's "needed" now.

I think considering the actual exploits for OS X being found... that it is. We'll have to agree to disagree on that one.
0 Votes
+ -
And those would be?
DeusExMachina 26th Aug 2009
"I think considering the actual exploits for OS X being found... that it is.
We'll have to agree to disagree on that one."

What exploits (plural) would those be?
0 Votes
+ -
re: And those would be?
rtk Updated - 26th Aug 2009
What exploits (plural) would those be?

I would guess the exploits this scanner/blocker is programmed to find. Or is it your claim that this dialog is only designed to point out OSX.RSPlug.A?
0 Votes
+ -
Princess Leia
DeusExMachina 28th Aug 2009
"I would guess the exploits this scanner/blocker is programmed to find.
Or is it your claim that this dialog is only designed to point out
OSX.RSPlug.A?"

First, there is a big difference between an exploit and a vulnerability.
Second, no it is designed to point out two pieces of malware,
OSX.RSPlug.A and OSX.Trojan.iServices.A/B. That's pretty much it, as of
now.
0 Votes
+ -
DeusExMachina Updated - 28th Aug 2009
0 Votes
+ -
Good, we're making progress
rtk 28th Aug 2009
you and Apple have both admitted there's at least two.

Good job, gold star.
0 Votes
+ -
Helen of Troy
DeusExMachina 28th Aug 2009
I never said there was no malware. Please feel free to search the entire
width and breadth of the internet to find a single instance where I did. In
fact, I have said the contrary on may occasions. What I said was there
were no viruses. And there aren't any. Considering what trojans are, all
OSes have them, and there is nothing to prevent them from being written
in principle, just mitigations that either recognize them and prevent a
user from "accepting the gift" or address what ever vector the program
uses to do accomplish its task.

So what?
0 Votes
+ -
Not a single Mac damaged???
derekgore Updated - 26th Aug 2009
Would you consider having to reinstall the OS damaged? You can't "recall an article" I would imagine is correct. For years Macs were off limits because of uninformed and biased backlash from the faithful.

So rather than rehash all the common gobbledygook usually touted here by fanbois of three persuasions, let's go back to just one compromised Mac way back in 2005. There are many more since:
http://forums.macosxhints.com/archive/index.php/t-34803.html

Not to mention the pirated ilife downloads that compromised "less than a thousand computers" Mac only botnet. Very recent.

Now take the math to a reality level. what fraction of percent is 1000 computers to the total of Macs with OSX out there. And then applying that percentage to the number of Windows machines out there what would be the same percentage? Quite an impressive figure, no? But the same percentage, just dealing with millions instead of a few hundred thousands, I don't know, you Mac folks can tell me the figures.

Would you like more links from 2000 till now on Mac Attacks as I track them weekly? The Mac techs, the real ones not the wannabes here, have been very quietly dealing with infections as script kiddies, and now more sophisticated Mac attacks based on the same newbie or delusional users who are infected the same way in all OS' today. By not doing their security patches for both the OS' and applications, then, thinking they can get something for nothing download codecs for porn sites, try to get pirated music/software/movies from file sharing sites, and open any attachment that comes in their inbox, especially when the title includes "Pass this along to everybody on your list!"

The short version. My estimate is that 99.9% of infections on all platforms are user invited. Probably 100% of the remainder are due to the user not doing the patches/updates when released and then being vulnerable to a known hole. Linux fanbois? What about this month's bind vulnerability that affected all platforms, or the Mozilla security breach of user personal data?

Personally I am tired of seeing the fanbois of all three make the statement for every infection or data breach as being the fault of "stupid users." I love that statement for its circuitous logic. You see, if any OS were inherently secure, especially ones that claim to "just work" as the refuge for supposedly "stupid users," who were supposedly "stupid users" on their last/current OS/platform, then there could be no stupid users. And by default there could be no supposed talkback "contributors," "experts" who know precious little more than the folks they fool into thinking they have skills to talk.

It is the old saw about when someone trips on a crack in the sidewalk they are a clutz, but when I trip on a crack in the sidewalk it is a safety hazard! :P

I applaud Apple for seeing the writing on the wall. And lest I be considered a Windows user who is making an attack against an imaginary invulnerable program, let me point you to a link from Apple's own website, which I advise all my friends who use Macs to peruse and use. It is a 250 page or so PDF file on how to harden your Mac OSX Machine. I'd note pages 222-223 on adding A/V, as well as the checklist to make sure your Mac is hardened on page 231.

This is the voice of your vendor, or prophet, whichever term floats yer boat, not my voice. You can choose to read and heed or not. Here's the Apple.com link:
http://images.apple.com/support/security/guides/docs/Leopard_Security_Config_2nd_Ed.pdf

And Pagan Jim, I have not seen a single article where a Windows PC has been damaged either as infections rarely damage the machine, just the software, wink
0 Votes
+ -
Good post derekgore!..(nt)
JCitizen 27th Aug 2009
.
0 Votes
+ -
Market Share
kc117mx 25th Aug 2009
I don't know if you can consider it a market share issue. And I know that this horse has been beat to death. However, malware developers are targeting individual systems. At this point in time with MS getting on the anti-malware bandwagon, I think that the malware developers are willing to try anything in order to stay alive. If that means changing their focus to Macintosh then I think that's what they'll do. The platform with the largest market share will definitely have more systems in which to target. I think that Windows will be a prime candidate for their (malware) focus as long as Windows XP is still around. So if market share equals a large number of users then yes, market share will make a difference. But you still need a perfect storm for infection, and Windows provides that. But still, Don't count out Mac. Just when you let your defenses down is when you'll get hit.
0 Votes
+ -
MS isn't just getting on the anti-malware bandwagon...
PollyProteus 25th Aug 2009
--> "At this point in time with MS getting on the anti-malware bandwagon..."

MS has had a downloadable package available for five years now, Windows Defender (http://en.wikipedia.org/wiki/Windows_Defender#History), which is free and fairly reliable and is still available for download and install with periodic signature updates via Windows Update.

Your viewpoint is probably based upon the fact that it's not mandatory, but that doesn't mean Micrsofot is "getting on the bandwagon".

And before you go off half cocked, I'm not shilling for MS, I'm simply point out the facts.
0 Votes
+ -
Nope, you're making leaps of logic off of a cliff
Metronome49 26th Aug 2009
"Even Apple's most recent commercials say Macs don't have to deal with all the malware and viruses Windows does. Yet they add malware scanners... Why?"

I don't have to "deal" with malware, or worry about it whatsoever, and with this move, it will put Macs even further away from needing to deal with it.

Saying you don't have to deal with something, or saying you don't have to worry about it, isn't saying that it doesn't exist.

Now stop trolling.
0 Votes
+ -
re: Leaps of logic
Badgered Updated - 26th Aug 2009
Now stop trolling.

ROFL.

Saying you don't have to deal with something, or saying you don't have to worry about it, isn't saying that it doesn't exist.

Specifically, no.. it's not saying it. It's implying it. You may not think so, but I've talked to Mac owners that believe it.
0 Votes
+ -
If I remember right
Loverock Davidson 25th Aug 2009
It was the antivirus companies that didn't want Microsoft to take any action so they can make more money from their products.
0 Votes
+ -
Yeah and MS the 800 lb gorilla if there has every been
James Quinn 25th Aug 2009
one cared what Norton's wanted why? I know that claim has been out
there but I for one find it hard to believe.

Pagan jim
0 Votes
+ -
You DO know that MS has been repeatedly lambasted for ...
de-void-21165590650301806002836337787023 25th Aug 2009
... including more and more features within the OS, right?

And has been heavily fined for doing so?

What do you think would be the outcome if MS was to incorporate their own AV package in every copy of Windows?

Apart from the EU fining MS for many, many $$$$$ ... sorry ... I mean ?????.
0 Votes
+ -
I'm thinking a fair lawyer could have easily gotten MS
James Quinn 25th Aug 2009
the ability to do this and in the time line I am talking about there was no
IE issue with MS in fact there has been little problems for MS with the EU
at that particular time. THis goes back a bit.

Pagan jim
0 Votes
+ -
Talk to Penfield Jackson
rtk 26th Aug 2009
No "fair" lawyer can counter a judge with horrendous bias.
0 Votes
+ -
RE: Apple adds malware blocker in Snow Leopard
birumut Updated - 29th Apr 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix