MacDefender trojan

I'd also appreciate hearing anything anyone might know, for inclusion in my Mac Virus Guide. My contact information can be obtained through a link on that page.

Linc, if you'll send me a real e-mail privately, I'll send you anything that comes to me, and will hope that you'll do the same in return.

I have given up looking for it. Here are some instructions from someone who may have actually seen it: https://discussions.apple.com/thread/3032009

Apparently it just installs itself as a Login Item and tries to get $99 from people.

First, an Installer package is not a "safe" file and shouldn't be opened automatically.

Absolutely! I suspect that we'll be seeing a security update to deal with this issue soon. Hopefully Apple doesn't drag their feet with that.

Honestly, I'm amazed this hasn't been exploited before, if that option truly opens any zipped installer file.

Second, unless a package is digitally signed by Apple, the Installer should warn the user that it's unofficial and is not to be trusted.

Yes, that's true, why isn't quarantine catching this? There's more going on than it seems.

Thomas A Reed wrote:

Absolutely! I suspect that we'll be seeing a security update to deal with this issue soon. Hopefully Apple doesn't drag their feet with that.

Honestly, I'm amazed this hasn't been exploited before, if that option truly opens any zipped installer file.

Yes, that's true, why isn't quarantine catching this? There's more going on than it seems.

Don't get your hopes up. This isn't a security vulnerability, it is a feature and the default setting.

I think it has been exploited before. Technically, exploited isn't the right term in the computer sense. Technically, everything is operating as designed and expected. It is just people that are being exploited. People don't know what a ZIP package is. They don't know what an installer is. They believe people who say that Macs have viruses. Then a screen pops up and tells them they do have viruses and asks for $99. They hand it over. This trojan author has probably already made more money than I will this year.

Quarantine isn't going to catch it because quarantine is designed for legitimate software you download from the internet that doesn't have an installer.

I don't think it will. MacDefender exploits the fact that Safari thinks it is a "safe" file. Such files are not trapped by quarantine.

This isn't a security vulnerability, it is a feature and the default setting.

No, it isn't. A .zip file ought to be a safe file, and could be opened, but that should not result in launching an installer contained within that .zip file, which would absolutely NOT be a safe file. Yet, somehow, that is happening.

Quarantine isn't going to catch it because quarantine is designed for legitimate software you download from the internet that doesn't have an installer.

An installer may, in many cases, be simply an application. Quarantine does not discriminate... any application downloaded from the internet via Safari, whether and installer or not an installer, whether zipped, in a disk image or whatnot, should be intercepted by Quarantine. As for .pkg or .mpkg files, those are not technically applications, but then neither are .html files, yet if you download an archive of zipped .html files from somewhere, Quarantine warns you about those.

I can't honestly swear, thanks to faulty memory, that I have seen Quarantine kick in when running a downloaded .pkg - but if it doesn't, that is a very, very serious security issue that needs to be addressed ASAP.

I just created my own MyTrojan.pkg.zip package. With the default Safari settings, just downloading this file will unzip it and start the installer. I could fill the installer with animated GIFs showing virus scans if I wanted. I could add the application to my Login Items (no authentication needed for that). I could add pre and post install scripts to do just about anything I want. It is quite easy. No password needed. No quarantine. It just works 🙂

The package is checked against some sort of database of known trojans. Neither MACDefender nor your test package is in that database.

As well as in the database of any of the AV programs. A clear illustration of the uselessness of AV -- especially ones that purport to do active scanning -- if you are unlucky enough to be among the first (including the first OS X virus in the wild, if and when that appears.)

All those programs, right now, are staring at this thing with their mouths wide open.

The malware "MacDefender" is a "driveby download" utilizing Javascript.

It's rather simple to defeat this from occuring:

1: Download Firefox 4.0

2: Install the NoScript Add-on

3: Install the Public Fox Add-on.

4: Hit the Toolbar Customize and drag the "Temp Allow All This page" NoScript button to the Toolbar

5: Setup Public Fox to require a password before a download occurs.

As you surf the web with NoScript, all "scripts" including JavaScript, will be turned off by default.

If you trust the site and need scripts to run, click the Temp Allow button.

If your Public Fox pops up with asking for your password, you know you got a driveby download, cancel it and notify the website owner.

"Public Fox" is searchable at Mozilla as "Public Fox"

Absolutely! I wouldn't use any browser that didn't allow me the kind of JS filtering that NoScript affords. That's why I stopped using Safari some years ago and went to Firefox almost exclusively. Didn't know about Public Fox.