Mac Security Update 2011-003 Takes Aim At Mac Defender Malware (UPDATE)

*Scroll down for update.

Apple has released a security update that addresses the Mac Defender malware phishing scam, which affected an estimated 60,000 to 125,000 Mac users.

According to an Apple Support post, security update 2011-003 will locate and remove "known variants" of Mac Defender installed on the user's computer.

This security update will also perform daily searches for new versions of the malware to prevent new iterations from spreading unchecked through the Mac community. If you happen to fall for the Mac Defender scheme, this update should promptly take care of the problem.

Users can also opt for automatic updates, which will take place in the background and won't disturb the user with notifications.

ZDNET praises the new feature, writing, "The update takes Apple one step closer to turning an obscure security feature into something very close to full-fledged antivirus software."

This update is now available for Mac OS X Snow Leopard (version 10.6.7) users at Apple Downloads or via Software Update.

---

UPDATE: It’s been barely a day since Apple released the Mac malware fix, and a new Mac trojan has already found its way around the block.

“The trojan arrives in a file called mdinstall.pkg and installs MacGuard, a malicious application that masquerades as security software the user needs to clean a Mac of some nasty infections said to be discovered during a recent hard drive scan,” The Register reports.

A similar malware attack circulating on Facebook is hitting Mac users (as well as PC users) with scareware.

Security update 2011-003 won’t stop you from downloading a malicious file, but a pesky Trojan will be quarantined and removed it once it’s discovered.

Since the update refreshes daily, users who downloaded malware after installing 2011-003 shouldn’t be troubled for long.

Comments

[stmpoodle]

12:10 AM on 06/02/2011

Only Mac Snowleopard gets the update fix?? Proof that Apple won't support older Operating Systems. I still use Mac OS Tiger because I refused to pay $130 when Leopard was released one month later. I hate APPLE!

[Pectin]

11:01 AM on 06/02/2011

If you fail to research a purchase and then buy something one month before an updated version is released, that's your fault.

Perhaps Ford should have continued building the Model T instead of improving their product line, so as not to upset someone who just bought last year's model, eh?

[BrassOnes]

08:52 PM on 06/01/2011

Finally all the 'nose in air' apple people can face my world. Enjoy.

[Pectin]

10:57 AM on 06/02/2011

Yup, and we can see where your nose is, as well...

[JackTheSkipper]

08:00 PM on 06/01/2011

Ditch this piece of cr4p called Mac. Use Windows!

[Pectin]

10:57 AM on 06/02/2011

Yeah, because one instance of malware simply isn't enough.

[Layman23]

05:45 PM on 06/01/2011

Maybe next time Steve will stop bad mouthing windows.

Not so secure anymore eh? What a bunch of marketing bull.

[LightShadow62]

04:22 PM on 06/01/2011

Another classic Apple approach to an issue, 99% marketing 1% actual remedy.

[Layman23]

12:05 PM on 06/01/2011

And thus Apple walked down the MS path of patches and updates.

[Sundialsvc4]

09:49 AM on 06/01/2011

Gentle Readers ... the notion that "Macs are invulnerable to malicious code written by clever but malicious people" is false. You'll never hear Apple saying otherwise, either.

Likewise ... the notion that "Windows is categorically pants-down to such code" is false, too ... IF you buy an edition that has security features and IF you take the time to learn to use them. (Which, unfortunately, Microsoft does not yet encourage.)

A digital computer knows exactly two things: 1 and 0; yes and no; on and off; allowed and refused. Nothing in-between. If the computer concludes that "Yes" a request should be honored, it has utterly no concept of, "but is that barrel pointed at the user's foot?" (Not unless it was explicitly programmed to do so. And if it sees you as "He Who Must Be Obeyed," it wasn't.)

Meanwhile: you operate in a world where things "are" as they "appear" to be, and this concept has been exploited in endless numbers of creative ways by everyone from Charles Ponzi to the United States Government. Therefore, you'll notice that most exploits are focused on You. And, you'll also notice that they are opportunistic. Throw a piece of rogue code at a hundred thousand computers and it will "stick" to some fractional number of them. The defense is to Be Prepared; to make sure that none of those "sticky" computers are yours.

[David Landry]

11:02 PM on 05/31/2011

There's no reason that Apple will not be in the same position as Windows, with the viruses, Trojans, and worms, and big footprint resource hogging security software to defend against them.

I guess it depends on how bad they skrewed up the security of underlying BSD OS to turn it into OSX as to whether it will end up slightly better or worst than Windows.

In the long run, either OS design needs to get a lot smarter (which will require Apple and MS to start going open source so the vulnerabilities can be better avoided, and fixed quicker when they do occur,) or Mac users, like Windows users, will have to learn to live with the consequences of either malware, or the software that protects them from it.

[SoulOfWit]

11:16 PM on 05/31/2011

You seem to be assuming--without basis--that Apple HAS undone the inherent security of BSD. Why?

[David Landry]

01:09 PM on 06/01/2011

So you think if I load load up a copy of BSD in a VM and go out and act like a dumb user and use that bogus virus scanner that the BSD VM will become infected the same as the MAC, without even being prompted for a admin/root password?

I seriously doubt it, but it would be a good trick if it did.

[Sundialsvc4]

09:43 AM on 06/01/2011

There is one fundamental difference between "the position of Apple" and the (inexplicable) "position of Windows." And that is: in millions of "Home" editions of Microsoft Windows, its formidable security features are turned =off= and are quite difficult to turn on.

It is crucial for people to understand that "security is a process, not a product." An operating system is, in effect, a piece of machinery. (A digital computer certainly is.) If you use that piece of machinery wisely and with reasonable care, it is quite tough and well-defended. But if you do not, it will smash your hand just as easily as it will drive a nail. The difference between these two scenarios is ... you.

[David Landry]

01:18 PM on 06/01/2011

So how is what Mac is doing any different? It's probably actually worst for that matter, since it's still trying to hide the fact that Mac uses have to be careful out on the open Internet. Counting on a "behind the scene" virus checker is no different than what MS is now doing ... their anti-malware software is installed with the auto updates and is turned on by default.

Sure, XP may have had a different philosophy on how to deal with security, but W7 seems to be taking reasonable precautions .. granted, the cure is almost as bad as the disease, but Mac users will come to understand that problem soon enough.

Yes, I agree, "security is a process" ... and in those terms Windows users are probably better prepared to live by those words at this point.

Right now, Linux users are probably in the best position ... but that's not a guarantee that this will always be so, because even though today your average Linux user understands security without being overly burdened by the security process and software, if Linux ever goes mainstream then users, being users, will find a way to skrew that up as well.

[Neitherpartieslapdog]

09:55 PM on 05/31/2011

I guess Apple will be re-releasing "Flu Shot". I believe it was one of the first hard drive loaded anti-virus programs and came out in the late 80's or early 90's. Norton and Macafee will surely pick up some customers now that this is out in the open and is no longer in denial of this problem. Apple has always loaded updates to Macs even if you answer no Jobs still thinks you want it. Don't believe me? Answer no to the next update. then go and search for it. It will be there

[SoulOfWit]

10:56 PM on 05/31/2011

I can't recommend either Norton or McAfee for Macs. IMHO, they do more harm than good. The best prevention for malware (on all operating systems) is to only install software from trusted sources. If you wish to scan a Mac then download a FREE anti-malware. You'll be more likely to find Windows malware than Mac malware, but feel free.

Kudos to Apple. The auto-update of definitions is a step forward in making Mac OS X more secure.

Software Update can be told to "Ignore Update" for a specific software. It's a menu choice when Software Update is running. The ignored updates will NOT be shown in the future (unless you choose Reset Ignored Updates in the menu.)

[Shawn Wolfe]

09:06 PM on 05/31/2011

Nobody ever targeted MAC cause way more people used Windows PC's....Lot more people use MACS now. is this the beginning of malware nightmare for MACS? God I hope not.. I am soo sick of it on my Windows computer

[uncc49er]

10:53 PM on 05/31/2011

the bad news is that perhaps this is the beginning of the nightmare for Macs. But, structure of Mac OSX makes it still a much safer OS than Windows.

[David Landry]

11:10 PM on 05/31/2011

Maybe .... depends on what Apple hacked to make it OSX. Theoretically, yes, it should be more secure than Windows, but that was before Apple got their hands on it ... and Apple is far more concerned with form and user friendliness than they are with security - something they probably until now never gave a second though.

My guess is that the latest Macs will be quickly and purposely obsoleted and Apple will throw in some kind of big footprint embedded proprietary Apple security software that will chew up a couple of cores worth of processing power ... Apple will simply start selling their computers with the extra needed cores, a few extra sticks of memory, paint them some new color, and charge Mac fanbois a 300% markup .. that would be the Mac way.

[SoulOfWit]

10:58 PM on 05/31/2011

False. True. It's not. I'll take your word for it.

[DefineReality]

12:53 AM on 06/01/2011

The more people use it the more it will be targeted. It'd actually be very profitable for a while because the vast majority of those using Apple products have this illusion that they're more "secure" than Windows computer. So this possibly could be the beginning of malware and possibly viruses.

[brodieking]

08:50 PM on 05/31/2011

So much for safe computing on the Mac. Apple was long overdue for this to happen, anyway.

[SoulOfWit]

10:59 PM on 05/31/2011

Nonsense. Windows machines are much safer than they used to be. Macs are still significantly safer than (the now safer) Windows machines.

[AverageJill]

07:38 PM on 05/31/2011

Does this mean that people who are running operating system 10.4 are safe from this attack?

[SoulOfWit]

11:20 PM on 05/31/2011

It does not. Don't install software unless you know where it came from and you are sure that you want to install it.

Also, uncheck 'Open "safe" files after downloading' in Safari's preferences (General tab.)

[ringmaster]

07:10 PM on 06/01/2011

Good advice,
The update does not work for 10.4 owners. The malware appeared on my desktop today in a zip file.
No mention of how 10,4 owners are suppose to deal with it, if it gets installed, or starts appearing in a self loading form.

[Jack Daniels Esq]

07:44 AM on 06/01/2011

The k/b operator is the biggest single malware source ... 90%