Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 7

30,735 points

Defense: Malware targeting Mac's

Mac's users running any browser with JavaScript turned on by default are vulnerable to being tricked into clicking on a trick image and/or link.

That image may appear to be a standard OS X window with a close box or the typical OS X looking window asking a question with OK or Cancel. It can look like anything really, it's purpose is designed to get you to click anywhere on it and initiate a download to your computer.

Safari tries to be helpful and "Open Safe Files" by default, which is being used with numerous success to run code on one's machine, by bypassing the normal user action of 'open the downloads folder and then clicks on the download to run' process in exchange for convenience.

Most Mac's are used with one person, and the initial setup of a new Mac (or a new OS X install) is the first user is automatically a Administrator User. Running one's typical day to day use while in Admin User mode gives any code running on one's machine more privileges and access than it would receive if the user of the computer created another OS X account and ran most of their computer use as a General User.

The ultimate access for rogue code would be Root User, which on Mac's is turned off by default, however a temporary access window to Root User is allowed when a Admin User provides his or her Admin Password. Once rogue code gets Root user access, it's all over, OS X is completely compromised.

The key to security on a Mac, or any computer system actually, is a process called "Compartmentalized Security" where the more privileges code receives, the more it's subjected to time and scrutiny to determine it's legitimacy.

Web browsers are the forward troops facing a overwhelming enemy, the World Wide Web. Not one modern web browser is 100% safe, not Safari, not Firefox, not IE, not Chrome, not Opera. Neither are plug-ins or scripts that run within these browsers 100% safe.

So the key to maintaining security is to provide a high level of "Compartmentalized Security" steps which shifts the exploit potential further down the privilege level so it can't do much of anything or gain further access.

People can get carried away with downloading and installing software in a rapid fire manner, this provides a ripe opportunity for malware to get onto one's computer, even gaining root access right away.

So in order to provide better compartmentalized security, provide more time and steps before potentially installing rouge code. I suggest the following actions:

1: Run most of your day to day computer use as a General User with less privileges. This can be done by creating a new Admin User, logging out of the present user and into the new Admin User, then turning the first user into a General User.

Whenever certain actions are needed, like accessing the Application's folder (where programs can be changed by malware) a Admin Name and Password will be required. A small hassle, but it provides another step for it to get past.

2: Use Firefox web browser and the following Add-ons: NoScript, Ad Block Plus and Public Fox.

Under the Toolbar customization, drag the NoScript button to the toolbar. NoScript turns off all scripts and plug-ins by default, which if you trust the site your on, you click the button for turning them on and the page automatically reloads.

In Public Fox preferences, set a password on downloads, this way a popup window appears before any download occurs, keeping malware from sneaking into your downloads folder and potentially being clicked on.

With Ad Block Plus, subscribe to the Easy List which automatically appears in the browser window. This will auto-update to keep advertising, which has been used numerous times as a attack venue, from appearing.

Click&Clean, Ghostery, BetterPrivacy, FlagFox, WOT, HTTPS-Everywhere (from the Electronic Frontier Foundation) are also highly recommended add-ons.

3: In Safari preferences, turn off "Open Safe Files" install the Ad Block Plus add-on and the Click2Flash add-on. If any add-on appears in the future to simulate what NoScript and Public Fox does on Firefox, then enable those add-ons.

4: Check the staus of your browser plug-ins. These websites makes it easy, bookmark them in a obvious place so you remember to visit them routinely. As soon as a vulnerability appears, either update or turn off the affected plug-in in your browser until a patch is issued.

https://www.mozilla.com/en-US/plugincheck/

https://browsercheck.qualys.com/

5: If you enjoy surfing the backalleys of the Internet and you have at least a decent dual core Intel based Mac, I'd highly advise installing the free VirtualBox and loading a free ISO of Linux Mint DVD 32 bit 10.10 (most consistent and easy to use, everything included, Linux distro)

http://www.virtualbox.org/

http://www.linuxmint.com/download.php

The object is to load and install Linux Mint into the virtual machine like installing a operating system onto a regular computer. Once completed, then save a snapshot to revert to after your Firefox browsing session (in Linux) is completed. All and any potential malware, caches etc is flushed when you revert the entire guest OS back to the earlier state. Keep the Guest OS updated via the Software Update option and save a new snapshot.

6: Use common sense, if it don't look right, then stop and flush the OS X based browser from memory via the Apple > Force Quit menu.

7: Install the free ClamXav, it will remove the OS X malware it knows about, offering some after the fact defense and Windows malware from their files.

http://www.clamxav.com/

I don't advise a full time, always on and running anti-virus solution for Mac's due to Apple's tendancy to change the underlining OS themselves to thwart potential malware. So something like Norton which maintains tight control over OS X should be avoided.

Malware on Mac's are a scarce thing because of Apple's top down approach, but trojans are a potential attack venue and people need to insure more steps to avoid being tricked.

MacBook Pro, Mac OS X (10.6.7), XP, Vista, 7 many Linux distros

Posted on May 8, 2011 4:40 AM

Best reply

thomas_r.

Level 7

31,989 points

Posted on May 8, 2011 5:11 AM

Run most of your day to day computer use as a General User with less privileges.

That causes problems for some apps, which won't run on anything but an admin account or on the account they were installed on. And it's not a guarantee of security - a user who gets in the habit of authenticating to admin to install stuff from their Standard account is no safer than the user who gets in the habit of authenticating to install from their Admin account. This is a good general suggestion, but may not work for everyone and provides practically no real security against "social engineering" by itself.

2: Use Firefox web browser and the following Add-ons: NoScript, Ad Block Plus and Public Fox.

Again, using things like these won't protect you by themselves. How do you know if a site is trusted and should have JavaScript turned on? And most folks are finding this malware via trusted sites that have had malicious JavaScripts "sneaked" into their code, through malicious ads or search engine optimization poisoning. How can you know if your trusted site is affected? And, given how much this malware has been jumping around over the last week, I seriously doubt Ad Block Plus can keep up.

3: In Safari preferences, turn off "Open Safe Files" install the Ad Block Plus add-on and the Click2Flash add-on.

Note that even folks with Safari's Open "safe" files after downloading option turned off have been affected by opening the installer manually. And some have been alerted to the presence of malware by the automatic appearance of the installer. I'd still agree, though, but would add that you should keep your Downloads folder cleaned out, so that any suspicious items that turn up will be easily recognized, and not mistaken for something you downloaded earlier.

As to Click2Flash, I think nobody should be on the web without it! I don't trust Flash as far as I could throw Adobe.

I'd highly advise installing the free VirtualBox and loading a free ISO of Linux Mint DVD 32 bit 10.10

That is not a realistic suggestion for the average person, who will have neither the desire nor the knowledge to run Linux.

6: Use common sense, if it don't look right, then stop and flush the browser from the Apple > Force Quit menu.

This should have been #1! AV software has struggled to keep up with all the variants of MacDefender, malware sites move on sometimes an hour-by-hour basis and malicious code sneaks into trusted sites. In all, no automated defense tool will protect you from a new threat... only your "wetware" can do that!

View in context

86 replies

ds store Author

Level 7

30,735 points

May 9, 2011 5:50 PM in response to Barney-15E

Barney-15E wrote:

I guess I don't consider that to be a vunerability. It's doing what it is supposed to do. I often click on direct download links and want the browser to download the file. It's just another Trojan trying to take advantage of people's ignorance. If you want to make an OS safe for those people, don't let them log in at all.

Other browsers confirm with the user that they initiated the download, offer a opt out. Safari doesn't.

If Apple fixed the problem like they should have YEARS ago when this same issue popped up we wouldn't be here right now.

Barney-15E

Level 10

112,830 points

May 9, 2011 5:56 PM in response to ds store

ds store wrote:

Barney-15E wrote:

I guess I don't consider that to be a vunerability. It's doing what it is supposed to do. I often click on direct download links and want the browser to download the file. It's just another Trojan trying to take advantage of people's ignorance. If you want to make an OS safe for those people, don't let them log in at all.

Other browsers confirm with the user that they initiated the download, offer a opt out. Safari doesn't.

If Apple fixed the problem like they should have YEARS ago when this same issue popped up we wouldn't be here right now.

But I don't want to click twice to download something. I know when I download something, and I know when the installer should be running. If confirming the download is more secure, why not be really secure and have it ask a second time?

Are you really sure you want to download this file?

ds store Author

Level 7

30,735 points

May 10, 2011 7:11 AM in response to Barney-15E

Barney-15E wrote:

But I don't want to click twice to download something. I know when I download something, and I know when the installer should be running. If confirming the download is more secure, why not be really secure and have it ask a second time?
Are you really sure you want to download this file?

Well sure you most certainly should have a option to turn off the warning, but it should be on by default. See the article here:

Barney-15E

Level 10

112,830 points

May 9, 2011 7:14 PM in response to ds store

Why did you post a link with a fake address in the name?

Do people really just click on links posted by clowns with eggs on their faces without checking out where the link actually points?

ds store Author

Level 7

30,735 points

May 9, 2011 7:36 PM in response to Barney-15E

Barney-15E wrote:

Why did you post a link with a fake address in the name?

To prove a point.

Barney-15E wrote:

Do people really just click on links posted by clowns with eggs on their faces without checking out where the link actually points?

Yes they do, you did or you wouldn't be upset right now. Even the best of us gets fooled once in awhile.

Which is why Safari needs a warning before a download occurs.

If I was a malicious type, you would be staring at a screen of blinking fake anti-malware warnings right about now. 🙂

No hard feelings I hope, you did want to give Glimmerblocker a try perhaps?

glimmerblocker DOT org 😉

Barney-15E

Level 10

112,830 points

May 9, 2011 7:44 PM in response to ds store

I didn't download anything. I did drag the link across the page to see what it actually pointed to. Since it wasn't pointing to what you put in the link, I didn't "click" the link.

Do you actually not know that you can do that? You seemed smarter.

Another option to check out unknown links is to right-click on them, select "Copy Link" and then paste it into the address bar--just don't hit return.

ds store Author

Level 7

30,735 points

May 9, 2011 8:16 PM in response to Barney-15E

Barney-15E wrote:

I didn't download anything. I did drag the link across the page to see what it actually pointed to. Since it wasn't pointing to what you put in the link, I didn't "click" the link.

Do you actually not know that you can do that? You seemed smarter.

Another option to check out unknown links is to right-click on them, select "Copy Link" and then paste it into the address bar--just don't hit return.

Nice tips, thanks. I asked the Hosts to remove the link so it won't bother anyone else.

I have to go, getting very tired, you have a good night. 🙂

Dogcow-Moof

Level 8

36,233 points

May 9, 2011 11:32 PM in response to ds store

ds store wrote:

People's machines are being exploited and the vulnerability is Safari not asking the users permission before initiating a download.

No, the actual problem is entering your password and installing software that you are not completely aware of the origin of and/or have taken explicit action to download and install.

Just because an installer is downloaded and even run doesn't mean you should be supplying your admin password willy-nilly.

WZZZ

Level 6

13,226 points

May 10, 2011 6:31 AM in response to Dogcow-Moof

I think the point is even if it can't get to the Mac installer without an admin password, the Safari default "open "safe" files after downloading" (thereby eliminating any download notice) makes it that much easier, for people who don't know better, to install a Trojan. This is especially true if they have actually seen that Preference setting in Safari -- not usually the case, I admit -- and, as a result, think that anything that gets downloaded and opened is "safe."

And, even though people could still be tricked, Apple needs to put anything .mpkg into quarantine so it can't bypass the warning message "... is an application downloaded from the Internet. Are you sure you want to open it?"

Anything that might make them pause and hesitate before authenticating is to the good.

Tropicoco

Level 1

145 points

May 10, 2011 6:38 AM in response to ds store

Too much pluggins and too much security just cripple your web experience and it will not protect it from the ultimate vulnerability, the user.

Advice: Free is not always free and you don't win the lottery without buying a ticket

roam

Level 6

13,637 points

May 10, 2011 6:42 AM in response to Barney-15E

Another option is to have the browser's status bar showing at the bottom, so that hovering the mouse over the fake link shows the true address in the status bar. Available in both Safari and Firefox ( and presumably others).

May 10, 2011 6:55 AM in response to roam

thank you for that reminder. I use Firefox and have completely forgotten about that which is a BIG Help. Several forums that I belong to often have sites that members suggest and I am increasingly hesitant to use them, though I do have the WOT plug in which has "saved" me several times. Sometimes its the easy things that are overlooked.

Laverne's Mom

🙂

ds store Author

Level 7

30,735 points

May 10, 2011 7:32 AM in response to Dogcow-Moof

William Kucharski wrote:

No, the actual problem is entering your password and installing software that you are not completely aware of the origin of and/or have taken explicit action to download and install.

Just because an installer is downloaded and even run doesn't mean you should be supplying your admin password willy-nilly.

A Admin password is not needed to run malicious code on a Mac.

It can do quite a bit of harm running in General User space, or a lot more harm in Admin User space and gain further privilege escalation in both until it roots the box.

ds store Author

Level 7

30,735 points

May 10, 2011 8:39 AM in response to roam

roam wrote:

Another option is to have the browser's status bar showing at the bottom, so that hovering the mouse over the fake link shows the true address in the status bar. Available in both Safari and Firefox ( and presumably others).

One can't judge by the true address if a link is safe to click on. It might redirect to more malicious sites in a blink.

Laverne's Mom wrote:

I use Firefox and have completely forgotten about that which is a BIG Help. Several forums that I belong to often have sites that members suggest and I am increasingly hesitant to use them, though I do have the WOT plug in which has "saved" me several times. Sometimes its the easy things that are overlooked.

Good thing about Firefox is it will stop a download from starting and display a big enough window asking for user input before it proceeds.

If you want to lock the downloads further (kids), use Public Fox to set a password on the downloads.

I also like WOT, it has saved me a few times as well, from cloned download sites that somehow been gaming the new Goolge algorithm and landing in the top spots on the search results.

May 10, 2011 9:14 AM in response to ds store

Can you please explain to me how that is going to happen. I have reported 2 methods to apple on privilege escalation so I am fully aware that it is very possible to exploit system access, but I am questioning this dogma you are ranting about that everything is an open book and nothing is safe. It is far easier to get a user to give you an admin password than it is to exploit the system for it. It is easier because you can just keep doing it, but once apple finds an exploit such as user escalation they are going to do a system patch and your exploit is gone thus rendering your malicious code inert. Now, please correct me if I am wrong here but if you wanted to raise **** with a user you do not need to authenticate anything, if you wanted to really wreck their system you will need to authenticate if you are anything short of root. I was unaware that it was possible to "auto-run" things on download Snow Leopard now has a checker in it that will prompt you before you can run anything you just downloaded. I know somewhere in here was a point you are trying to make about how users need to be careful, which I agree that they do. However that is not grounds for spouting all this non-sense about how everyone should be hiding in their basements in fear that anything they click could steal their data or destroy their computer. That is just flat out wrong.

Defense: Malware targeting Mac's