Mac Defender

Mac Defender (also known as Mac Protector, Mac Security,^[1]Mac Guard,^[2] and Mac Shield)^[3] is an internet rogue security program that can be installed by unwitting users of computers running the Mac OS X operating system. The Mac security firm Intego discovered the fake antivirus software on May 2, 2011, with a patch not being provided by Apple until May 31.^[4] The software has been described as the first major malware threat to the Macintosh platform (although it does not attach to or damage any part of OS X).^{[5][6][7][8][9][10]} However, it is not the first Mac-specific Trojan, and is not self-propagating.

Users typically encounter the program when opening an image found on a search engine. It appears as a pop-up indicating that viruses have been detected on the users' computer and suggests they download a program which, if installed, provides the users' personal information to unauthorized third parties.

The software has been traced through German websites, which have been closed down, to the Russian online payment ChronoPay. AppleCare employees were told not to assist callers in removing the software, but Apple later promised a software patch.^[11] The Mac OS X security update 2011-003 was released on May 31, 2011, and includes not only an automatic removal of the trojan, and other security updates, but a new feature that automatically updates malware definitions from Apple.^[1]

Symptoms

-memo-new-mac-defender-variant-macguard-doesnt-require-password-for-installation/ |publisher=The Mac Security Blog » INTEGO SECURITY MEMO |title= New Mac Defender Variant, MacGuard, Doesn’t Require Password for Installation }}</ref> All variants require the user to actively click through an installer to complete installation even if a password is not required.

Origin

Mac Defender was traced to ChronoPay by the email address of ChronoPay financial controller Alexandra Volkova.^[12] The email address appeared in domain registration for mac-defence.com and macbookprotection.com, two web sites Mac users are directed to in order to purchase the security software. ChronoPay is Russia's largest online payment processor. The web sites were hosted in Germany and were suspended by Czech registrar Webpoint.name. ChronoPay had earlier been linked to another scam in which users involved in file sharing were asked to pay a fine.^[13][14]

Apple response

According to Sophos, by May 24, there had been sixty thousand calls to AppleCare technical support about Mac Defender-related issues,^[15] and Ed Bott of ZDNet reports that the number of calls to AppleCare increased in volume due to Mac Defender, and that a majority of the calls now pertain to Mac Defender.^[16] AppleCare employees have been told not to assist callers in removing the software.^[17] Specifically, support employees have been told not to instruct callers on how to use Force Quit and Activity Monitor to stop Mac Defender, as well as not to direct callers to any discussions pertaining to the problems caused by Mac Defender.^[15] An anonymous AppleCare support employee said that Apple instituted the policy in order to prevent users from relying on technical support instead of anti-virus programs.^[17]

On May 24, 2011 Apple issued instructions on the prevention and removal of the malware.^[18]

On May 31, 2011 Apple released security update 2011-003 which addressed the threat and removed the trojan from any affected Mac computers, and added a feature that automatically updates malware definitions from Apple.^[1]

Mac Guard variant

A new variant of the program, Mac Guard, has been reported which does not require the user to enter a password to install the program,^[19] although one still does have to run the installer.^[20]

See also

• Leap (computer worm)
• Trojan BackDoor.Flashback

References