Macs Join the Rogue Program Club

Great place to wake things up. Ran across this on my list of headlines:

Quote:

---

Source: Security Ticker

F-Secure has reported about the first known rogue antispyware program for MacIntosh computers. Macsweeper is what it goes by. With the growing number of reported fake codec zlob trojans made for Macs, this doesn't surprise me. The first known Mac fake codec was reported just last November. Since then, there has been a steady release of Mac fake codecs to go along with the Windows versions. The last one discovered was on January 11th. If you go through Sunbelt's blog, you'll find many more.

For now, I'm not sure how you remove it, but it appears to be mainly a nuisance. More updates on this later.

---

MacSweeper did respond as noted here by F-Secure. I think this is just showing that regardless of platform you can face issues and get caught with your proverbial pants down. ;) :D

I didn't think there was anyone out there writing malware for other platforms, like Mac and Linux. Naive of me, eh?

I was just a matter of time. Now what are those MAC commercials gonna say?

Mac and PC join forces to right all computer wrongs. Problem is PC keeps having to reboot and start over and MAC is so small that it can't effectively fight on it's own. I see a comic book in there somewhere... stay tuned. LOL

Quote:

---

Originally Posted by KorpDeath

I was just a matter of time. Now what are those MAC commercials gonna say?

Mac and PC join forces to right all computer wrongs. Problem is PC keeps having to reboot and start over and MAC is so small that it can't effectively fight on it's own. I see a comic book in there somewhere... stay tuned. LOL

---

Mac is the hippy of OSs, if it's doing anything, it's tokin' with malware as we speak tyring to solve everyone's problems and getting resource munchies.

The stoned virus comes to mind as a Mac friendly one. "You're computer is stoned"... And so were most of the people who designed them, built them and wrote OSs for them.

Berkeley is only knowing for two things, BSD and LSD, go figure.

I can personally confirm that some Mac users are Scotch drinkers.

It's about damn time! Time that general user security issues hit mac users and that mabye I'll have a reason to even look at a mac. I wouldn't ever touch a mac because of both the price and I'm not doing any multimedia projects which requires the mac's only talent.

You know, the more I think about this the more I'm convinced that stuff like this has little to do with the OS and so much to do with guillability (sp?). The manufacturers of Macsweeper accepted third-party sponsors and don't seem to have regard for what they do. Based on their response, it leads me to believe that they don't care about their users. The users, in turn, have developed a "we'll-never-get-attacked" attitude and let anything in without checking (how many times have you read an EULA of a program? that is where stuff like this is put in for legal reasons).

whats an EULA? :)

Quote:

---

Originally Posted by MsMittens

You know, the more I think about this the more I'm convinced that stuff like this has little to do with the OS and so much to do with guillability (sp?).

---

Very true indeed. As a matter of fact there's nothing in OS-X, Linux, *BSD or Windows that will prevent a user from starting a malicious program and get infected. Think about.. A program can do everything the user can do that starts it. This includes emailing, doing web queries, connect to servers, login IRC etc.. A malicious program started by a user could abuse those possibilities.. Also note that worms like MyDoom and Netsky DO NOT abuse any bugs in the system or really need administrative privileges to be effective (only their bad programming is why they need admin privs). Which means OS-X, linux and bsd users have the same risk to get infected by similar worms as Windows users. Unfortunately some of those users think they're invulnerable.

Quote:

---

Originally Posted by MURACU

whats an EULA?

---

End User License Agreement ;)

I think Muracu was being rhetorical and sarcastic. ;)

In regards to users then, the question is: how do we get them to pay attention to what they are doing? Granted, these are home boxes but I'm seeing more and more companies offer choices for laptops (at VMware we now have options between different manufacturers including Apple for employee laptops). Granted, I can use something like Fusion and create a sandbox effect for my "non-work" stuff that I might use my laptop for (e.g., when on the road -- which I've done a lot of lately -- checking email, etc.).

I have been pondering that security seems to be a plateau of late and it makes me think that people are starting to dull to the FUDing of things like "security alert orange" (which I hear at the airport non-stop). If this is a user issue, how do we get them to pay attention again without resorting to severe FUDing?

I believe the whole problem stems from the security model used by all major OS's today. They all use IBAC (Identity Based Access Control) and this model has a few drawbacks, one being that a program started by a user has the same access permissions as that user. Not really sure what the solution would be, replacing the security model probably isn't a viable option as that will undoubtedly break all the existing software we use today.

I agree with SirDice that the security model is somewhat lacking once a user has decided to run something.
For instance if you happen to be logged into OS X as the admin (dont do it, you DO NOT need to be an admin all the time. If you need admin rights the OS will prompt you for creds) then yes anything dodgy that you run, so socially engineered malware for instance, will run with the users rights, ie admin rights.

I work for a Computer Security company that produces software for OS X and the biggest issue for normal users are the attachments that they get in emails and stupid bits of software that they have downloaded from a website, or torrented/P2P for.
Users are far to trusting. Wow, naked images of Brittany Spears, wkd. Right double click on that, oh needs admin rights, right enter my username and password.oooooo no pictures, hmmmm, thats odd.
Its a lame example (although you would be surprised how many people *still* fall for it. But things like cracked codecs, or free software that will fix all your mac woes.

So i guess what im trying to say is that the security model could be improved immeasurably, but the first hurdle that needs to be addressed is the thing between the keyboard and the chair. Decent security education is essential, but its something that just isnt looked at well enough these days.

Hmm :)

Maybe I should try a MAC ...

From what I can see, this product is certainly rogue, in that it attempts to trick people into purchasing a copy by reporting things that are actually a normal part of the Mac OS's functionality. Things like caches, last used and so on............ just the same sort of stuff as you get in Windows.

I have not seen anything that suggests it contains actual malware, but I wouldn't expect that of "scareware"

From what I can see, it is just a $40 copy of the free CCleaner you can get for Windows, and I am not sure it is as good.

I came across this which might amuse?

Quote:

---

Today I spoke with a journalist about MacSweeper and he said something that stuck in my mind.

"I visited the macsweeper.com website. I know I probably shouldn't have - but I used a Windows PC so I knew I wouldn't get infected."

Now that's something you don't hear everyday!

---

:D

Its not malware, but it is a bit dodge.

Sophos has a nice way of looking at this, a Potentially Unwanted Application, so you might want it, but probably you dont.

http://www.sophos.com/security/analy...acsweeper.html

Although annoyingly they dont have automatic removal for it yet :(

You know, the more I think about this the more I'm convinced that stuff like this has little to do with the OS and so much to do with guillability (sp?). The manufacturers of Macsweeper accepted third-party sponsors and don't seem to have regard for what they do. Based on their response, it leads me to believe that they don't care about their users. The users, in turn, have developed a "we'll-never-get-attacked" attitude and let anything in without checking (how many times have you read an EULA of a program? that is where stuff like this is put in for legal reasons).