Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

First Scareware For the Mac

Posted by kdawson on Tue Jan 15, 2008 06:29 PM
from the rogue-cleaning-tool dept.
Security Businesses Apple
I Don't Believe in Imaginary Property sends us news from F-Secure of what they claim is the first rogue cleaning tool for the Mac. MacSweeper is a Mac version of Cleanator, hosted from a colo somewhere in the Ukraine. The article points out that the company's About page is lifted verbatim from Symantec's site. With the Mac's market share closing in on double digits, perhaps it's not surprising to see the platform targeted with crapware as PCs have been for years. The F-Secure author adds as a footnote that a journalist said to him something you don't hear every day: "I visited the macsweeper.com website. I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected."
+ -
story

Related Stories

Submission: First Rogue Cleaning Tool for the Mac by Anonymous Coward
[+] Hardware: iPhone Trojan Sign of Things to Come? 151 comments
climber writes "Just days after the first scareware for OSX, researchers are pondering the problems of an iPhone exploit that could lead to larger issues. The Trojan pulls legitimate apps off the phone if you try to remove it, but it only infects iPhones that have 'been modified or opened through a security hole in the system.' Though this worm is more of an annoyance than anything else, it could be a proof of concept for a more serious attack. 'The fear is hackers may be experimenting and gathering research that will increase the dangers of a more malicious attack in the near future. It is clear at least one writer -- the author of this piece at Web Worker Daily -- thinks that the iPhone should be left on the dresser in the morning. She offers several reasons that the device isn't a good corporate tool.'"
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

First Scareware For the Mac 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • gamespot gave it 11 out of 10 (Score:5, Funny)

    by User 956 (568564) on Tuesday January 15 2008, @06:34PM (#22059428) Homepage
    With the Mac's market share closing in on double digits, perhaps it's not surprising to see the platform targeted with crapware as PCs have been for years.

    I didn't realize Kane & Lynch had been announced for the Mac platform

  • Not the smartest journo (Score:5, Insightful)

    by MLCT (1148749) on Tuesday January 15 2008, @06:34PM (#22059430)
    The journalist should have visited using a linux livecd. If the site hosts mac malware then it is a pretty good bet they already have established "businesses" in the field of windows malware.

  • Isn't any "cleaning tool" rogue on a mac? (Score:5, Interesting)

    by Anonymous Coward on Tuesday January 15 2008, @06:38PM (#22059482)
    The category of "cleaning tools" was rather dodgy even before the trojaned ones started showing up. The notion that getting infected by god knows what, running a little wizard, and being all ok again is insane. Both the notion that one can reliably detect malware that has already had time to romp with your system and the idea that infection is so routine that there should be tools to be run every few days for it are pretty gross.

    And now we have an example of this fine species showing up on a platform that doesn't really have malware. How could anybody trust a cleaner for a platform that doesn't, as yet, need cleaning?
    • It's been my experience that 90% of the PCs that require cleaning got in that state because the owner's installed something they shouldn't have. In a way, this program is attempting to create an environment where one would be needed.

      • I dunno, I'd say some recent switchers from Windows to Mac ("average" users, not the Slashdot know it all types) might feel a little naked without their antiviruses and all that. It's almost understandable, seeing as they've had years of conditioning that everything they do invites trojans and viruses. Kind of like how a New Yorker who moves to the suburbs is amazed he doesn't have to lock his car doors.

        Which is ironic, because just as you should still lock your car doors in the suburbs, the principle of de

  • fixed that for you (Score:5, Funny)

    by joeyspqr (629639) on Tuesday January 15 2008, @06:45PM (#22059564)
    "I visited the macsweeper.com website. I know I probably shouldn't have but I used a Mac so I knew I wouldn't get infected."

    oh wait ...

  • Yeah and moon is made from.. (Score:5, Insightful)

    by Fri13 (963421) on Tuesday January 15 2008, @06:46PM (#22059590)

    What, you need to download something to your mac and then INSTALL it?

    This kind software has be there long time ago and there is nothing new to see here.
    Market share is still smaller than GNU/Linux and it is not having this kind problems, wait, it has.

    Come back again when F-secure and others have proof for worm or virus what works like windows platform, automatically.
    • It's been my experience that 90% of the hosed computers in this world have had something installed that shouldn't have been. This is just the sort of malware that typically plagues windows computers.

    • Re: (Score:3, Interesting)

      by necro2607 (771790)
      No kidding, I couldn't guess how many times I've written on Slashdot about how people used to upload trojan-horse programs to my server all the time and try to get me to run it. You know, malicious AppleScripts with a different application icon so it looks like something legit like a text doc or whatever. Except these days, Mac OS is designed with way more attention to these kind of possible "hacks", fortunately.

    • Re:Yeah and moon is made from.. (Score:5, Informative)

      by willyhill (965620) <pr8wak.gmail@com> on Tuesday January 15 2008, @07:23PM (#22060050) Homepage Journal
      Come back again when you understand how Windows machines are largely compromised. Crapware vendors don't need to wait for the next IE vulnerability to target people, all they need is social engineering and lack of common sense. The last few major botnet herding attacks have been perpetrated like that. The fastest-spreading worms have been perpetrated like that. Coming a close second is exploiting vulnerabilities that people can't be bothered to patch. Yet all of this has somehow become Microsoft's fault, but in this case I guess it's the user's fault, right?

      Idiocy can and will spread happily across platform boundaries. It really does not matter what OS you are using. And this article proves it. It's just that until now Windows was losing by the weight of sheer numbers. It has more vulnerabilities, sure. But those are irrelevant to the people who make big $$$ compromising machines. They simply don't need them.

      • Re:Yeah and moon is made from.. (Score:5, Insightful)

        by postbigbang (761081) on Tuesday January 15 2008, @08:01PM (#22060416)
        Your comment is somewhat disingenuous. For argument sake you can cite that there are probably an equal number of stupid people buying Macs and PCs, by percentage.

        Now take a look at the architectures. A dozen years of Windows since Win95 has only progressively made Windows more secure, and while better than before, still full of a superfluity of exploits (for differing reasons, again, not counting user "stupidity"). You have to do a lot of work to iteratively get past the gatekeepers in both operating systems; it's not as trivial an exercise as it once was; all the really wide-open machines are 0w3d by someone by now.... as part of a botnet.

        Given a 5-10% of the market for Apple, depending on whom you believe, you're only now seeing a MacOS ruse. Think about that for a moment. Think about both motive and opportunity. Motive we understand. Opportunity hasn't been very strong until now. The weapon? Two decades in to desktop operating systems (three if you count CP/M, UCSD Pascal and so on) we're only now seeing a MacOS exploit. A common denominator among the exploitable: stupidity. Now let's scratch off stupidity and talk about architecture. It's not Microsoft's fault that they used a root-level database (the 'Registry') that could be twigged by any user-mode app in pre-XP SP2? Hmmmm. Or the mindless ways that people found to explode IE? Or the TCP/IP stack? Or how long it took to get a WEP-128 parser and still longer for a WPA parser? Microsoft's sloppy code created an industry, one to fix the code, and another to exploit it. They didn't take security seriously, then paid it only lipservice. They're paying the price in disrespect for not being respectable!

          • Re: (Score:3, Insightful)

            by postbigbang (761081)
            User idiocy aside, the inherent architectural differences, not the sheer number of idiots IMHO, have made Windows a vulnerable target at many levels. In a perfect world, we would train people on using things before we let them loose with them. But we don't.

            For this reason, until four years ago (Windows early XP era), Windows and its myriad faults were untenable. MacOS X, by contrast, at least warned people before they were about to get a knife stuck in their operating system. FireFox, Mozilla before it, S
  • common as Macs continue to grow in popularity. Malicious code tends to gravitate towards the largest user base (more targets), and Apple's market share (or perhaps, more importantly, positive PR) is growing at a decent rate. I'm surprised that it hasn't happened sooner.

    The same could happen to Linux, (Free|Open|Net)BSD, etc. All it takes is an uneducated* user behind the console, and Linux's drive to take on the desktop makes that all the more likely.

    * I mean uneducated in the security sense. You can be highly intelligent, have 3 PhD's, and still not know a thing about what downloads to avoid. We can't know everything about everything, after all.

  • double digits? (Score:5, Funny)

    by BeanThere (28381) on Tuesday January 15 2008, @07:26PM (#22060074)
    There are now 10 or more Mac users?

    • Re:double digits? (Score:4, Funny)

      by mcpkaaos (449561) on Tuesday January 15 2008, @08:24PM (#22060588)
      Practicing your base 2, I see.

      • Re: (Score:3, Insightful)

        by nmb3000 (741169)
        Most companies that can only maintain a small percentage of the market place fold. I suspect that the reason Mac hasn't is due to the exceedingly large size and growth of the consumer PC business.

        If you're making a profit it doesn't matter how many customers you have: you're still in the black. Sure, more customers then means more profit, but usually you hit a wall where you have to cut profits in order to stay competitive. If a company is happy with its single digit market share (what most would call a ni

  • First Scareware? (Score:5, Funny)

    by Macrat (638047) on Tuesday January 15 2008, @07:28PM (#22060102)
    I thought Symantec released the first Scareware for Macs?

  • Contact Us page changed already (Score:5, Informative)

    by caseih (160668) on Tuesday January 15 2008, @07:29PM (#22060108)
    Looks like they read slashdot. Their "Contact Us" page is already edited now to remove the text copied from Symantec. Now the page doesn't say much of anything at all. No phone numbers, no addresses. Just a bare e-mail address. Hard to believe how scam artists can operate out in the open these days.

  • Hi i'm MacSweeper Developer, listen to me (Score:5, Interesting)

    by MacSweeper (1220668) on Tuesday January 15 2008, @09:42PM (#22061472)
    I would like to explain all the situation, about MacSweeper. We are really trying to make a good software, and you wont find any viruses/spyware/trojans/malware in MacSweeper (test it your self, if you don't believe me, you can use any type of firewalls, dissemblers, or other tools) . The problem is that we are using selling partners that forces us to use this marketing type. We would like to leave them, we don't want to completely destroy Good Name of MacSweeper application.
    Personally I adore Mac Platform, and it hearts to here that the program you wrote is said to be some kind of "Rogue application" , i wouldn't like to destroy good manners of software written for it :((
    I would like to say sorry for all inconveniences that we could bring to you, but believe MacSweeper is meant to be a useful application.

    You can ask Questions, and i will try to answer them! Thank You!
    • Dear Sir,
      thank you for make clear mistake. I find myself have found an inheritance of 50 BILLION DOLLARS (AMERICAN). I rely my confidence on your arm in relate your website macsviper.kom be legitimate business as of identity yours will be made clear as mine is, for this I will need your kindest help with transfer five hundred dollars of administration price, for which of as of now I am not in relation available.
      Sincerely yours,
      Ba Ba Baa, Nigeria

    • Re:Hi i'm MacSweeper Developer (Score:5, Informative)

      by ncryptd (1172815) on Wednesday January 16 2008, @12:48AM (#22063058)
      Well... a quick disasm of your binary doesn't show anything blatantly malicious, which is good... but I also don't see anything really useful. Pretty much everything your program does (and much, much more) can be done with OnyX. For free.

      Oh, and you mis-spelled "purchase" in two methods in MacSweeperDaemon. ;-)

      (void) purchaise
      (void) purchaiseThread
      I also noticed you left a somewhat interesting TODO list [pastebin.com] in the app bundle.

      The binaries have references to KIVViSoftware throughout them -- you wouldn't happen to be one and the same with these guys [kivvisoftware.com], would you?

      Disclaimer: I didn't find anything blatantly malicious -- but I only took a quick look. Given the folders that it tinkers around with, any bugs could do some damage to your Mac, so be careful.

          • Re: (Score:3, Insightful)

            by mzs (595629)
            Oh dear LORD if this app will be deleting files in such a manner you will break SO MANY things. Just do the honorable thing, pull it before it does serious damage.

  • infection (Score:3, Insightful)

    by Tom (822) on Wednesday January 16 2008, @02:23AM (#22063574) Homepage Journal

    I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected."
    Right, because a baddie trying to infect your Mac will absolutely not ever get the idea to put some IE exploit on his page as well, just for good measure, you know?

    Stupid, meet journalist, your brother.

    • Re:the shit hits the fan! (Score:5, Informative)

      by necro2607 (771790) on Tuesday January 15 2008, @06:46PM (#22059600)
      Yeah the difference is, you can't get spyware installed on a Mac by clicking a banner ad in a browser. The software doesn't even have permission to do software installation, so it would be asking for a password (unless some unknown vulnerability is exploited). Frankly if you're entering your password for your computer when some arbitrary website asks for it, you've already got have way worse problems than spyware on your Mac.

      • Re:the shit hits the fan! (Score:5, Informative)

        by sqlrob (173498) on Tuesday January 15 2008, @06:57PM (#22059746)
        It doesn't take special permissions to put stuff in ~/Applications. It's not done by default, but some users do do it, and Finder supports it.

        Or heck, just put it on the desktop where the user can click it. No special permissions needed. Most .Apps don't need an installer, nor need to be in /Applications.

        • Re:the shit hits the fan! (Score:5, Insightful)

          by jmauro (32523) on Tuesday January 15 2008, @07:12PM (#22059918) Homepage
          But the Applications folder does not run as root, but as the regular user. The malware can only screw up the current users session, it cannot access or modify anything that needs root permissions without asking for the root password. Without root, malware is annoying, but not difficult to get rid of.

          • Re:the shit hits the fan! (Score:5, Insightful)

            by GaryPatterson (852699) on Tuesday January 15 2008, @07:18PM (#22060000)
            Yes, but if you ask a user what they care more about - the OS or their data - you'll find few who care that they'll have to reinstall the OS. It's an irritant, but easily replaced from the source media.

            Our data is far more critical, making the ~/Applications folder (or the ~/Desktop folder) a dangerous place for executables.

            Of course, in these enlightened days we all have regular backups now or Time-Machine-enabled external drives. Hmm...

            • Re: (Score:3, Insightful)

              by Taevin (850923) *
              I keep seeing people posting this concept... I have a hard time understanding it to be honest. Let's take a (very simplistic) look at Windows vs. OS X (and yes, I am aware you can make Windows nearly as secure as other operating systems, but I'm looking at base install here): Windows:
              • User Data: not protected
              • System Data: not protected

              OS X:

              • User Data: not protected
              • System Data: protected

              Ok, sure, OS X is not perfectly safe. Clearly it is the better choice though in terms of protecting system data.

              • Re: (Score:3, Informative)

                by sqlrob (173498)
                Depends on what version of OS X you're talking about. Drop something in ~/Library/Input Managers in Tiger and below, and every cocoa app is infected when you run it. Or put something in ~/Library/LaunchAgents and watch for Safari and inject code (non-root for PPC only,special group or root for Intel). Or rewrite plugins residing in ~/Library/Internet Plugins...

                With some more thought I can probably come up with a pile more.

        • Re: (Score:3, Interesting)

          by Mordaximus (566304)
          Exactly! There are too many Mac users all smug with the notion that their OS is super secure. Which is true, the system is secure - but the user is not. The first time they ignorantly run a malicious app that clean out the contents of their home they'll likely learn the distinction though.

          Personally I've never fretted over having to reinstall an OS. I typically clean install with every major release. What I dread is losing my data.

    • Re:Wait, why would you even use this? (Score:5, Insightful)

      by NewbieProgrammerMan (558327) on Tuesday January 15 2008, @07:01PM (#22059800) Homepage
      Well, assuming Apple's market share is increasing (which I don't know for sure, just taking it as a given for making my point), some significant fraction of those new Mac owners are former PC owners. Many of these people will assume that all the crapware they "needed" for their Windows machine is just part of owning a computer. It's not that there's a problem with a Mac, it's that a lot of people just don't know any better.

        • Re:Oh no! (Score:5, Insightful)

          by Tsiangkun (746511) on Tuesday January 15 2008, @07:48PM (#22060282) Homepage
          I'd prefer to focus on the ZERO self propagating pieces of malware in the wild.

          • Re:Oh no! (Score:5, Insightful)

            by bigstrat2003 (1058574) on Tuesday January 15 2008, @08:40PM (#22060786)
            Doesn't matter. Stupid users trump all possible security measures (except locking them out of the system for their own good, which isn't really feasible), and there's no shortage of them. Until the programmers can prevent stupid users from infecting their systems, it doesn't matter how damn many malware samples there are in the wild, and you have no right to be smug about the security of your OS.

            • Re:Oh no! (Score:5, Funny)

              by novakyu (636495) <novakyu@member.fsf.org> on Wednesday January 16 2008, @02:50AM (#22063734) Homepage

              Stupid users trump all possible security measures (except locking them out of the system for their own good, which isn't really feasible), and there's no shortage of them.
              It sounds like we need a friendly user helper agent that will remind users that what they are about to do could be dangerous for their data and prevent them from performing such actions. I am thinking that this agent should be enabled by default, cannot be deactivated except by calling customer support to get the deactivation key, and to inspire user confidence, it should look like something that they see everyday. Like a paper clip.
        • While I haven't seen a Mac user claim that Macs can't be infected by viruses, I see morons complaining about supposed Mac snobs in each damn article about Mac security.

          I'm not sure who's the snob here, Artie MacStrawman or you, who seems to think Mac users are dumb, deluded snobs.

        • Re:Oh no! (Score:5, Interesting)

          by webmaster404 (1148909) on Tuesday January 15 2008, @08:46PM (#22060866)
          No, it has a couple of advantages.

          1. Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system.

          2. Most software is installed through a repository. Now, I realize that Mac does not by default (although there are projects to port apt-get and the like to it) but most distros of Linux have a way of installing via the repository.

          3. Most first-party OS-X software is at least partly open-source including the key components of the OS such as the Kernel, Browser rendering engine, and some of the other utilities. This adds a layer of protection to prevent programming errors from not being noticed as anyone can look at the code and submit fixes to it. In addition, this adds security by having parts of Safari being looked at to prevent such flaws as drive-by-downloads which were a major problem of IE and a reason many Windows users got infected by malware.

          While it is true that if someone really wanted to mess up OS-X or were just plain stupid they could. However, the chances of Unix breaking from normal usage are far far smaller then those of Windows.

          • Re:Oh no! (Score:4, Interesting)

            by Architect_sasyr (938685) on Tuesday January 15 2008, @09:03PM (#22061068)

            While it is true that if someone really wanted to mess up OS-X or were just plain stupid they could. However, the chances of Unix breaking from normal usage are far far smaller then those of Windows.
            You need to meet some of my designers. I spend more time rebuilding OS X machines and correcting privileges than I do with the windows users... incidentally this never happened on the OS 9 installs, so the additional power that having a Unix system around can give is actually what is causing me and my users the most grief here.

            Your comments on OS code, whilst quite valid, are actually rather incorrect. Something that a lot of people seem to fail to remember with open source code is that the code IS available IF you wish to look at it. Personally I've never gone near the Kernel code, so I wouldn't have a clue if it is secure or not (perfect example of this: Firefox).

            My $0.02 AU, Ignore at will.
            • As an administrator of 100-odd macs myself, used in advertising design and textile design, let me give you a foolproof recipe to making your life 95% easier:

              1 Mac OS X Server, configured with all users in Open Directory, and policy to lock out users from system preference panes they have no business being in

              1 FileWave server for application deployment and file integrity checking, obtainable from www.filewave.com (note, this will cost money, but will pay for itself the first time you don't have to reinstall

          • Re:Oh no! (Score:5, Insightful)

            by Garridan (597129) on Tuesday January 15 2008, @09:57PM (#22061622)
            As a linux user, I am under no delusion that my system is "more secure" than a windows box or a mac.

            For me, the worst thing that can possibly happen, is somebody destroys my home directory. Ok, that's easy, if a virus is logged in as me. If they hose my system, so what? I can always re-install linux, that isn't a problem. There aren't any other users. I allow myself access to the internet and to email, so if a virus starts spamming the world, well, that isn't stopped by security policy either.

            What you're talking about is a linux server. There, it's hard to root the machine and cross-infect, sure. But what spreads viruses the most these days is users downloading shit in email and not knowing that their browser just executed something. Linux is *not* more secure. *I* am a user am less prone to viruses because I maintain a strict policy of which sites I use each browser for, where I take cookies from, and I browse sketchy shit only inside vmware and restore from a clean image frequently. But I'm still vulnerable to all sorts of attacks -- if google pushes an ad with linux-targeted malware, for example.

            If you think linux is somehow inherently virus-proof, you're deluding yourself. Using linux on the desktop is the same as using any other desktop system -- if somebody else knows how to make an executable for your system, it's probably vulnerable.

            • I maintain a strict policy of which sites I use each browser for, where I take cookies from, and I browse sketchy shit only inside vmware and restore from a clean image frequently. But I'm still vulnerable to all sorts of attacks

              I understand that meth addiction is difficult to kick, but I urge you to please consider it for your health, both physical, and - particularly - mental. With time the paranoia will subside and you will be able to return to rational, productive behavior. Remember, we're here for you.

            • ...here [openbsd.org] is why:

              • strlcpy() and strlcat()
              • Memory protection purify
                • W^X
                • .rodata segment
                • Guard pages
                • Randomized malloc()
                • Randomized mmap()
                • atexit() and stdio protection
              • Privilege separation
              • Privilege revocation
              • Chroot jailing
              • New uids
              • ProPolice
              • ... and others

          • Re:Oh no! (Score:5, Insightful)

            by dryeo (100693) on Wednesday January 16 2008, @12:20AM (#22062888)

            1. Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system.
            So you figure it is better to only lose your home directory containing everything you care about, email, pictures, personal documents, all your settings like bookmarks etc. As long as the rest of the system, which is easy as hell to reinstall, is not compromised?
            As a desktop user I severely disagree, I'd rather lose everything but ~ and if I'm stupid enough to run malware that malware will have the necessary permissions to delete everything I care about.
            And about opensource being better because people can look at it and find vulnerabilities. Have you ever looked at the Mozilla code? Lots of people have and yet regularly there are new exploits found, some that have been there since the browser was called Mozilla.
            I monitor a few open source applications mailing lists and often when a security vulnerability is found, it has been there a long time. How many more are lurking in that mess of C++ code?

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.