Feeds

New Mac fake-defenders similar to Windows scareware

Added feature: Porn, drug sites opened at random

Next gen security for virtualised datacentres

Researchers at Microsoft have discovered striking similarities between the recently emerged wave of scareware packages targeting Mac fans and the longer established rogue anti-virus applications for Windows.

MacDefender falsely warns that Mac OS X machines are infected with malware in a bid to trick prospective marks into buying a supposed security package that actually does more harm than good. Like its Windows cousin, the scam starts after users are tricked – via search engine manipulation and other ruses – into visiting an imitation scanner interface.

But the similarities between MacDefender (dubbed FakeMacdef) and Winwebsec, a strain of scareware for Windows machines, go far deeper than that.

For one thing, the URL format that FakeMacdef calls home is almost identical to that which we see in Winwebsec. In additional, the purchase pages use the same payment gateway. Finally, as a blog post by Microsoft illustrates, the interfaces on both products are almost the same.

The one main difference between MacDefender and its Windows-targeting siblings is that the Mac-targeting malware is more aggressive. MacDefender frightens users further by loading adult-oriented or pharmaceutical websites at random intervals. These sites themselves aren't infected by malware, but are loaded in order to trick Mac users into thinking they really are infected – and that MacDefender offers the best way out of the supposed mess, Microsoft said.

FakeMacdef loads most of its resources from a directory named "ru.lproj", suggesting the developer may be a Russian language speaker.

At least three Mac-targeting scareware packages have been doing the rounds this month: Mac Defender, Mac Protector and Mac Security. All three are bogus but don't expect Apple to tell you that, much less talk customers through the process of getting rid of the nuisance.

Standing orders, leaked this week, mean that Apple consumer rights people are told to neither confirm nor deny Mac infections.

The internal document, entitled About 'Mac Defender' Malware, further instructs Apple support personnel "not [to] provide support for removal of the malware". ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.