Trend Micro tools tossed from Apple's Mac App Store after spewing fans' browser histories
Data caught being siphoned off to outside server
Updated A bunch of Trend Micro anti-malware tools have vanished from Apple's Mac App Store – after they were spotted harvesting and siphoning off users' browser histories.
Dr Cleaner, Dr Antivirus, and App Uninstall – utilities owned by the Japan-headquartered security house and distributed on the Mac App Store – are no longer available for download. It is not entirely clear yet whether Apple took action itself and stripped the info-collecting software from its online macOS application store, or if Trend Micro pulled the apps itself following complaints. Its website today still links to the downloads even though they are no longer available.
While neither Apple nor Trend has responded to a request for comment on the matter, the removals are almost certainly a response to reports in recent days that the products appeared to covertly collect and upload private user data.
Mac security guru Patrick Wardle noted last week that in addition to the advertised functions of removing adware and malware from Macs, the software also collected people's personal data including their browsing history, then transmitted that data as a password-protected archive to a server on the internet.
The activity was also spotted by Privacy First, who documented the activity in the following video:
As Wardle explained, the fact that both applications were signed off by Trend Micro and approved for the App Store by Apple should give users reason to be cautious when looking to get new software from even the Cupertino-sanctioned official portal and trusting Apple's own security protections which were in this case circumvented.
"From a security and privacy point of view, one of the main benefits of installing applications from the official Mac App Store is that such applications are sandboxed," Wardle blogged.
"The other benefit is that Apple supposedly vets all submitted applications - but as we've clearly shown here, they (sometimes?) do a miserable job.)"
Fortunately, the newest version of Apple's OS appears to have addressed the first part of that. Wardle noted that those running preview versions of Mojave would have had the product running within new sandbox protections that would have blocked access to private data such as browsing history.
The takedown comes just days after Privacy First and Wardle found that another App Store security product, AdWare Doctor, was pulled for exhibiting nearly the exact same malicious activity. In fact, the Dr Cleaner and Dr Antivirus products were named alongside AdWare Doctor as bad actors in the initial PrivacyFirst report on the matter. ®
Updated to add
Trend Micro has confirmed Wardle and Privacy First's fears are true, and that browser histories were collected as part of the code's installation. In a statement today, the biz said:
Dr Cleaner, Dr Cleaner Pro, Dr Antivirus, Dr Unarchiver, Dr Battery, and Duplicate Finder collected and uploaded a small snapshot of the browser history on a one-time basis, covering the 24 hours prior to installation. This was a one-time data collection, done for security purposes (to analyze whether a user had recently encountered adware or other threats, and thus to improve the product & service). The data collected was explicitly identified to the customer in the data collection policy and is highlighted to the user during the install. The browser history data was uploaded to a US-based server hosted by AWS and managed/controlled by Trend Micro.
Trend is removing this, er, feature from its software, though.