Apple to support reps: 'Don't confirm Mac infections'

http://www.theregister.co.uk/2011/05/20/apple_malware_attacks/

by foob • 15 years ago

135 121 15 years ago

theregister.co.uk

Garbage• 15 years ago

Original post - http://news.ycombinator.com/item?id=2564429

bonch• 15 years ago

It says right in the article that AppleCare doesn't cover what users do to their machines. Microsoft doesn't remove malware that Windows users install either.

This thing is coming from Ed Bott's Microsoft column on ZDNet, where he's been hitting this hard for the second day in a row based on an "investigation" that involved him scouring the Apple discussion forums for a couple of hours. Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?

illumin8• 15 years ago

The Mac Defender malware is pretty harmless. It downloads as a zip file, and users must manually click through the entire installer just to get it installed. How many Windows viruses are delivered as a setup.exe where you have to click next about 3 times and enter your admin password just to install it?

As usual anti-mac trolls love to jump on the bandwagon and bash the platform with one of the best security track records running.

lotusleaf19872• 15 years ago

"[Bott] cited an internal document titled "About 'Mac Defender' Malware," which was last updated on May 16 and says that the trojan, which surfaced earlier this month and masquerades as legitimate security software for the OS X platform"

I find it ironic that Bott's fear mongering is leading the naive to download shady anti-virus software that is actually adware. These articles are really just contributing to the problem by misinforming people. Ed Bott is the equivalent of Glen Beck.

Niten7• 15 years ago

Most Windows viruses these days have the exact same attack vector, simply tricking the user into installing them. All we're seeing here is that: (1) Despite the marketing, the Mac is not magically immune to these things any more than Windows is, and (2) now that OS X has obtained a reasonable market share it's finally become worth attacking.

Neither of these things should be surprising to anyone, and hopefully the antimalware situation on OS X will improve before progressively more insidious Mac viruses are released.

sliverstorm2• 15 years ago

... the platform with one of the best security track records running.

Have you forgotten that Darwin is by and large derived from BSD? Apple is standing on the shoulders of giants with this one.

Niten7• 15 years ago

> Microsoft doesn't remove malware that Windows users install either.

Yes they do:

http://support.microsoft.com/kb/129972/en-us

"Call 1-866-PCSAFETY or call 1-866-727-2338 to contact security support."

> Two hundred clueless posts on a web forum out of a userbase of millions doesn't mean there's a "malware explosion," as he described it. Why are people falling for this flamebait?

If Apple is issuing special instructions to its support staff about this malware, then clearly this is a pronounced problem.

kenjackson4• 15 years ago

Not only that but Microsoft has an anti-virus anti-malware application. AND as part of Windows Update they regularly run the malicious program removal tool.

And I suspect MS would ship antivirus built into Windows if they could. Unfortunately, antitrust makes packaging things that make sense a non-starter if other companies sell it.

foob• 15 years ago

I think that it's reasonable if Apple doesn't want to provide support for fixing malware problems on systems that they've sold regardless of how any other company chooses to handle such issues. Also, this issue is obviously independent of OS as the exploited security hole is the users' lack of understanding. That said, the reason that I thought this article was hackernews worthy is because Apple is encouraging employees to knowingly withhold information about malicious software running on users' computers. I personally find that to be an inappropriate approach in almost any situation. What are your thoughts on this aspect of the article?

demallien• 15 years ago

Not to mention that Apple is the only company to have started building a defence to the 'clueless user' problem,with the Mac App Store. It's going to become increasingly more difficult for trojan horse authors to convince users to install their non-App Store application, the more that people become accustomed to that being the way to install software on a Mac.

lotusleaf19872• 15 years ago

Woof: http://daringfireball.net/2011/05/wolf

"According to a third article penned by Bott, AppleCare reps are seeing a four- to five-fold increase in the number of calls requesting support for rogue antivirus scams targeting the Mac"

So now a handful of incidents is cause for uproar?

"Porn sites just started popping up on my MacBook Pro," one user wrote. "Is this a virus? I have never had a virus on a Mac before and I have been using Macs for years. Please help!"

So it's just adware then? Oh no!

progolferyo• 15 years ago

As a PC turned Mac user for the last 3 years, this is truly the best thing about working on the Mac platform. My girlfriend is still on her shitty HP laptop and it is so incredibly painful to watch her worry about viruses and malware on a daily basis.

I hope Apple's policy around this is not going to be sweep it under the rug because it could get out of control as Apple market share grows and more effort is dedicated towards hacking the Mac.

As stupid as this story is, it is still something that Apple is gonna have to probably start paying more and more attention to, given the trajectory of Apple market share in the future and the increased effort will be taken towards the Mac platform.

I think

bandushrew3• 15 years ago

There isn't much apple can do in a practical sense.

People clueless enough to run an Installer based on an web ad popup are unlikely to be reading Apple's PR posts.

Aside from OS specific code that refuses to install anything called Mac Defender, Apple has no power over this problem.

darren_2• 15 years ago

You've basically described 10.6's anti-malware 'solution', although obviously its little plist file hasn't been updated to include Mac Defender yet.

darren_2• 15 years ago

A positive step for Lion is that they've started actively engaging members of the exploit research community, although details are scarce on what that means or how seriously they'll take their advice.

Proper ASLR and sandboxing Safari by default would help a lot, I think.

jonhohle2• 15 years ago

This isn't about an exploitable, remote attack vector. This is about giving someone instructions on installing software to hijack their computer and them willingly complying.

kenjackson4• 15 years ago

My girlfriend is still on her shitty HP laptop and it is so incredibly painful to watch her worry about viruses and malware on a daily basis.

WTF is your gf doing on a daily basis? Does she do reviews of shady porn sites? Install MSE (it's free) on your gf's computer and tell her not to install programs sent in email from people. Then tell her to stop worrying.

And if she does do reviews of shady porn sites, tell her to use a VM.

cosgroveb• 15 years ago

This blame the user bullshit has to end. My own girlfriend got a virus (it was hostage-ware to be precise) last year and doesn't visit porn sites, runs up-to-date anti-virus, and keeps Windows up-to-date and patched. She knows better to run random shit sent to her via email. She's very defensive and doesn't even open an email that looks shady. It was probably a drive-by-download, Flash, PDF, or Java, I don't know. Running combofix, anti-spyware scanners, and everything I could find on forums didn't help. She wasn't happy that I had to wipe her HDD.

It is painful to watch her worry about viruses.

Caballera2• 15 years ago

The real 'shitty' thing about HP, and many other Windows laptops isn't even the malware, it's the @#$@# that the manufactures pre-install on these laptops and desktops that they sell. Three years ago my gf and I ordered HP laptops and had to use a program called Crap Remover to get rid of all the Nortan Antivirus junk, the HP software bundled junk and all the preinstalled crapware junk they put on it. After that it ran fine (as fine as Vista got that is) with MSE.

sliverstorm2• 15 years ago

The real news is not that Apple won't remove malware, it's that Apple is apparently actively working to conceal the truth and perpetuate the Mac-selling legend that Macs cannot get viruses.

mambodog• 15 years ago

Apple is doing the most sensible thing for their business. An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past.

However, from a marketing point of view it's a lot harder to sell. Compare:

You can't get viruses on Mac.

with:

Using a Mac you are very unlikely to get a virus, and provided you don't download and install anything shady ad/spyware isn't a concern either.

The second statement is true of Macs today, and still presents an advantage over Windows, but "No viruses" is a much simpler message, and one it seems they are trying to keep (superficially) intact.

Niten7• 15 years ago

> An uptick in users installing adware on their computers (yes, you have to manually install it) is a far cry from having a platform blighted by drive-by infections and autonomously spreading worms as Windows was in years past.

Well yes, but lately how are these drive-by installations happening? Mostly through holes in third-party software. My concern, as a Mac user, is that there's no fundamental reason it should be any harder to attack OS X this way; it's just that up until now Windows has been a vastly more profitable target. And that is changing.

If you're a careful and conscientious user I'd honestly say you're safer on Windows at this point, because Windows is used to being attacked. It's used to defending itself against this kind of threat. You have this ecosystem of powerful antivirus programs like MSE or AntiVir that update themselves constantly, and innumerable other third-party tools such as Secunia PSI as preventative measures, and these just don't really exist on OS X yet. Windows also yet has some exploit mitigation facilities that OS X lacks, such as ASLR and kernel patch protection.

It will be a while before OS X has developed such an ecosystem of its own, and we just have to hope the adjustment period won't be too painful.

wisty• 15 years ago

It's not a virus. It's malware. Users install it, and it sends them to porn sites.

If you run "sudo rm -rld /*" on a Mac, it may not run so well either.

Of course, it may be a sign that more sophisticated malware (i.e. real viruses, and other stuff that actually exploits the Mac's vulnerabilities) will be on the way.

daeken• 15 years ago

> Of course, it may be a sign that more sophisticated malware (i.e. real viruses, and other stuff that actually exploits the Mac's vulnerabilities) will be on the way.

Once an OS has the attention of malware writers (even user-installed malware like this), real malware won't be far behind. Especially when you consider how much easier exploitation is on OS X than, say, Windows or Linux. It's 2011, but OS X still doesn't have useful ASLR -- supposed to be coming in 10.7, but it was also supposed to come in 10.6, so we'll see how that goes.

rmc• 15 years ago

It's not a virus. It's malware. Users install it, and it sends them to porn sites.

To you and to fellow readers of this site.

However to the average Joe, there is no difference between the terms "virus", "malware" and "my computer is now doing things that I don't like that I didn't want it to do and it's interfering with me using my computer and I can't stop it"

beedogs• 15 years ago

Apple lies about the capability, strengths, and shortcomings of their products all the time, and have done so for as long as I can remember. It just seems to be their standard practice.

ericd3• 15 years ago

No, they just don't bog their messages down with caveats, which just serve to confuse people. Effective communication sometimes sacrifices some small measure of accuracy. You see this in conversation all the time.

lloeki2• 15 years ago

Apple sells anti-malware right in Apple Stores. How's that for truth-concealing?

innes4• 15 years ago

As the OS gets more popular, Apple will need to add the kind of protective features present in Windows to deal with this sort of problem. Dismissing it isn't gonna work - this kind of malware is the problem these days rather than viruses. As a savvy user, I've never found the need to run antivirus software on Windows, but it would be the height of arrogance for me to scoff at the problems others do have and blame it on their stupidity.

As is the way with these things, Apple will stonewall, but I expect eventually handle the issue. In the mean time some of the congregation will snort in derision and deny there's a problem.

Steko• 15 years ago

Apple is not going to solve the problem of gullible people typing their credit card info into a scammer's form, any Mac based solution (of which the obvious will be to lock down installation to the Mac App Store) is just going to push scammers back on the web.

innes4• 15 years ago

No, but they can help solve the problem of gullible people downloading and running installers for known malware.

Honestly, listening to some Mac user responses to this problem, it's like entering a timewarp back to when all the measures implemented on Windows/IE to deal with this stuff hadn't even been thought up.

Possibly a quick fix, until it's addressed, is for folk on OSX to do their web surfing in a Windows VM, using a security-focussed browser designed for non-technical people, such as IE9. ;-)

maqr• 15 years ago

The users who are most likely to be infected by this stuff are the same users that Apple caters to in person in their stores. Many Apple customers (at least the ones that I know) have become used to in-store "geniuses" fixing their difficult computer problems -- setting up their email, installing software, that kind of thing. This is going to be very difficult for Apple stores to handle.

furyg3• 15 years ago

It's not really that hard, Windows support guys have been doing it forever. And, like almost everything else, it's easier on a mac (my mom got this malware... on mother's day)

The problem is: naive user + attack vector (bad default Safari options) + malicious attacker (advertising network).

The solution is:

* Cleanup - Kill process form activity monitor, delete app from Applications, and installers from Downloads folder (kinda shocked that there isn't more to it).

* Inform - Teach user about basic practices.

* Close vector - Safari's Automatically open safe files after download checkbox.

* Block attacker - Install AdBlock for Safari (Bonus points).

All of the above, except the 'informing' part, takes all of two minutes to do, so I think the "Geniuses" at the Apple Stores can manage.

To those entrepreneurs whose business model is based on ads... sorry, but Adblock is the new Antivirus. I install it alongside any software updates or antivirus software (even on Macs, now).

beaumartinez• 15 years ago

> Cleanup [...] kinda shocked that there isn't more to it.

Perhaps not with this "first generation" of OS X malware.

On Windows some malware replicate to files and have other self-preservation quirks making anti-malware software necessary.

> I think the "Geniuses" at the Apple Stores can manage.

Against simple malware, yes. When crackers start investing time and effort into their malware (like on Windows), it'll be a different case altogether.

to• 15 years ago

go to google, search for "piece sign" on image search. click on the ~20 image, black very slim lines white background next to piece sign with globe in background and alien head like looking piece sign. host is decinet.com or something. (im on my phone right now)

watch what happens next... thats the trojan, unzips automatically in safari.

yuhong2• 15 years ago

Personally I feel that top-down control of customer support agents is fundamentally flawed these days, but that is a different matter.

morganpyne2• 15 years ago

To be honest, I'm just curious why we haven't seen much real malware yet. The Mac Defender stuff is a joke, but there's no reason why somebody couldn't be exploiting the recent Skype bug (http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v...), or the Chrome/Flash bug (http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php), the bugs found at pwn2own or the myriad other holes which are closed regularly via updates.

orijing2• 15 years ago

The reason is scale and alternative options: If you're a hacker, why focus on the Mac when you can target 10x as many people on Windows?

morganpyne2• 15 years ago

I have often seen this mantra repeated, but I can't believe that this is enough to dissuade every single hacker. With Macs approaching 10% of the market this has got to be worth somebodies time to have a go. And yet, I know a lot of folks with Macs and not a single one has ever had malware issues. Either nobody is getting hit, or they are getting hit with stuff so good and stealthy that they just don't know it :-) I'm certainly not arguing that Macs are invulnerable (far from it), I'm just genuinely curious why somebody somewhere isn't stepping in to fill the malware niche.

aerique• 15 years ago

Because the users are more naive about malware and 10x as many might actually install it?

nchlswu• 15 years ago

As far as I'm concerned, when I read this I had no problems with what Apple is doing. They got a memo stating that Apple is looking into it, and don't confirm/deny malware.

That's what they're supposed to do, no? This is hardly a cover up. Apple is simply reminding their support staff to not make promises they can't keep. This is a holdover till they have a solution. If their permanent solution is a cover up, that's a whole other story.

Niten7• 15 years ago

I agree... although it would be nice if they would step up for their customers in this regard, I just don't see a scandal here. (That's just The Register's style of reporting I guess, not to diss them or anything.)

However, the letter itself is interesting in that it confirms Mac malware is becoming a real issue.

smackfu2• 15 years ago

I have a real issue with directing people to say "we are not aware of a thing" in a memo that shows they are clearly aware of it.

learc835• 15 years ago

I worked in Geek Squad for 5 years (finally started making a enough money doing freelance development to quit this past december).

I've done malware removal on 5-10 computers a day, 5 days a week for most of that time. So I've seen thousands of malware infections on the average consumer's computer. I've seen more different malware infections than just about anyone outside of an antivirus research lab.

When I first started most of malware came from users downloading files from P2P sites. However, for the last 2 years nearly all the malware I found was installed via a drive-by download that happened without user input.

You can talk all you like about avoiding porn sites and installing AV software, but it's not that simple. The majority of the computers I worked on had current AV programs--they weren't able to prevent the infections. The situation with malware and windows is absolutely terrible, and it doesn't only happen to idiots who stuff their drives with porn.

Macs have security flaws--they aren't perfect, but when compared to the malware ghetto I've dealt with over the years, calling this a mac malware problem an "explosion" is just ridiculous.

jbri• 15 years ago

> and it doesn't only happen to idiots who stuff their drives with porn.

Instead, it only happens to people who don't keep their browser up to date so that it's actually vulnerable to drive-by downloads.

Right?

learc835• 15 years ago

I've seen plenty of the same fake AV malware that installs itself via drive-by downloads on computers with up to date firefox installs.

Security patches aren't instant. Updating your browser helps sure, but it's not a real solution.

There is a tendency for people like us to assume every time we see someone with a malware infection that it must be because the user is a moron who: still uses Kazaa, doesn't know about the good porn sites, is browsing on IE6 and installs anything that a popup asks him too. That just isn't true.

It's not just idiots, the average non-moron windows user is massively vulnerable to malware.

In my experience (I'll limit it to friends and family b/c of the obvious selection bias of including Geek Squad customers), nearly every (non developer) windows user I know has had at least one malware infection over the last few years that required either my help, or a system restore.

yardie• 15 years ago

Why is it the browsers job to secure your system? It doesn't matter if it's IE 1 or Chrome 12 if any application tries to install itself without user intervention the system should stop it by default.

ZoFreX2• 15 years ago

> and it doesn't only happen to idiots who stuff their drives with porn

What is this based on? What the customer tells you? To quote House: Everybody lies!

I am being partially serious, I don't have AV installed, I run Windows, and I haven't had a virus in... a long time. I think the last one was Sasser!

learc835• 15 years ago

Based on the general state of the computer, and many times customers asked me to try to identify the source of the infection.

To do this I checked the history for recently visited sites. Before most browsers had private browse modes, and the ability to only delete recently browsed data, a non empty history with no obvious porn listings could usually be taken at face value.

josephcooney• 15 years ago

Selection bias? Your conclusion that windows is a malware ghetto based on your experience at the geek squad is like a Doctor saying 'everyone is sick, because all I see everyday are sick people'.

powrtoch• 15 years ago

I think the meaning was that Windows is a malware ghetto compared to Mac. More akin to a Doctor noticing that 95% of his patients are blondes and declaring that blondes tend to get sick more.

The significance of this is offset by the base rate though: unlike Windows PCs, blondes don't constitute 90% of the sample group.

learc835• 15 years ago

Definitely a selection bias--I mentioned that previously in a post down below.

I'm not saying everyone is sick though. I'm saying I've seen thousands of windows machines with malware and a lot of the time it wasn't just an uneducated user problem.

My first store was also about an hour away from the nearest mac store so I also saw a pretty fair amount of macs while working there. They came in all the time for hardware issues so obviously they aren't perfect--But I never once saw one with malware--not in 5 years.

I don't think that they are magically immune to malware and some of it can be explained by smaller market share, but whatever the reason from my experience dealing with thousands of windows pcs and hundreds of macs--malware on macs is so insignificant that it doesn't exist.

5 years ago people were saying that malware for macs was coming (In fact Best Buy was pushing AV installs for macs when we first started carrying them), but it didn't materialize.

For the average user--if you buy a windows machine you will probably have to deal with malware, but if you go with a mac the chance is so low that is virutally nonexistent.

augustl• 15 years ago

I hope Apple solve this by creating a consumer version or mode of OS X with a sandbox similar to iOS. I'd love if my mom had no way of installing software that could break the computer, without doing scary sounding stuff like "jailbreaking" or "enable developer mode".

fuzionmonkey• 15 years ago

Chrome OS is the epitome of this. The whole operating system is just a browser. Nothing to configure, install or break.

wesley3• 15 years ago

Isn't that what an account with parental controls are for?

http://gigapple.files.wordpress.com/2008/12/system-pc.png?w=...

wesley3• 15 years ago

OSX Lion better have an outgoing firewall.. Anyone know?

ericd3• 15 years ago

Little Snitch can do this currently, if you're looking. Outbound firewalls are somewhat annoying, though, as you have to authorize every single program at least once, which makes me think that Apple is unlikely to add one that runs by default.

wesley3• 15 years ago

Just wondering, could a trojan somehow control safari (or other approved apps) via a script, and then upload files to the hacker's server, circumventing little snitch and other outgoing firewalls?

lloeki2• 15 years ago

So what? A user who has been tricked into installing Mac Defender will be just as easily tricked into authorizing Mac Defender to get out.

Groxx3• 15 years ago

More abuse of the term "infection":

>The con artists behind Mac Defender hook their victims by presenting Mac-using web surfers with images that depict an antivirus scan taking place on their machines. The images falsely claim users are infected with serious malware and urge them to download and install the antivirus package. Those who fall for the ruse are then infected.

Yes. It's malware. It has infected the computer. Because they downloaded and installed it willingly. But "infection" implies "virus" to most people, and this is nothing of the sort.

burn-a-mac• 15 years ago

Hopefully this will make people think twice before buying crap produced by Apple.

primeMover2010• 15 years ago

awesome. even malware has higher usability on mac, than it has on other platforms. and if you pay for the snake oil.. errrr... remedy, the virus is gone. the virus writers are pretty awesome social engineers.

illumen• 15 years ago

Yesterday I saw some mac osx malware being served up from a website listed in google image search results.

The search was Flamenco or something like that. My girlfriend pulled me over to show me that this website was saying it was from apple security and that I needed to download a tool to remove the Trojan.

Having just come back from a visit to Turkey, we found the Trojan reference funny.

I think if she was surfing with safari the .zip file would have extracted automatically, which I think would have caused many people to run whatever evil was stored inside.

tjogin2• 15 years ago

That definitely is a stupid default setting.

patrickk• 15 years ago

Here's an article comparing some decent Mac antivirus applications for those who are concerned:

http://lifehacker.com/5800267/the-non+alarmists-guide-to-mac...

Caballera2• 15 years ago

Mac Protector (another name for Mac Defender) tried to install on my wive's new MacBook Pro the other day when she went to live.com to get the last of her contacts and some emails. She knew not to provide it with permission to install and panic and disaster was adverted.

Mac Defender does look pretty real though and I could see how the uninformed or people that easily panic would give it permission to install. As one second your on the web then a 'window' pops up saying your infected with Virus and to get the latest downloads ect., and it all looks convincingly real.

I don't regret switching to Mac myself as my Mac runs so much smoother then any Windows PC, plus installation of software is a breeze, my MacBook Pro starts up in 15 seconds and it just works right out the box. There was no crapware pre-installed like my old HP laptop.

Additionally, when I researched looking into purchasing my MacBook Pro I saw that Apple does recommend using Anti-virus software and I do have it installed, with no issues and it doesn't slow my MacBook Pro down a bit.

Apple to support reps: 'Don't confirm Mac infections'

Related Stories