Feeds

Apple strikes back with update blocking new scareware

'The cat and mouse game has begun'

5 things you didn’t know about cloud backup

Apple has updated Mac OS X to detect a piece of scareware that managed to bypass its malware-blocking measures.

As previously reported, a variant of a rogue antivirus package known as MacDefender was introduced on Tuesday that evaded the malware protection feature built into the latest version of the Mac operating system. In a series of events that closely mimics those in the Windows world, the variant was introduced just hours after Apple had added a malware signature designed to stop downloads of the malicious program.

"The cat and mouse game has begun," Mac antivirus provider Intego wrote in a blog post published on Thursday. "We will be following this closely, and testing all new variants as they appear. The people behind this malware have shown that they can react very quickly, and Apple has reacted rapidly as well."

Mac OS X Security preferences pane

Mac OS X System Preferences > Security > General: better safe than sorry

The latest update is specifically designed to detect a file called mdInstall.pkg, which installs MacDefender.C. Like similarly named programs such as MacGuard, the programs get installed after Mac users are tricked into believing their machines are riddled with infections. The ruse works by presenting people surfing Google Images, Facebook, and other sites with images depicting an antivirus scan on a Mac hard drive. Inevitably, the scan falsely claims that the users' machines are compromised and urges the rogue antivirus package be installed immediately.

Apple added the MacDefender definitions on Tuesday, following widely scattered evidence that the social engineering attacks were achieving their intended result.

The update protecting against the latest variant will automatically be installed on Macs running the latest version of Mac OS X that are configured to do so. To turn on automatic updating, go to System Preferences > Security, and select the General tab. Then make sure there is a check mark next to "Automatically update safe downloads list." ®

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.