'MACDefender' malware targets Mac users via web links
updated 12:10 pm EDT, Mon May 2, 2011
Attack dependent on user gullibility
A new piece of malware called MACDefender is currently targeting users of Mac OS X, says security firm Intego. The exploit begins with a person clicking on a link to a malicious site with special embedded JavaScript code. The code triggers a ZIP file download; if a browser like Safari is set to open downloaded files automatically, people are then presented with an installer interface.
Mitigating the seriousness of the threat is that the malware requires people to accept installation and provide an administrator password. It is also possible to disable automatic launch of downloaded files, assuming the option has been turned on in a browser in the first place. Apple support forum posters observe that it's possible to scrub the malware by killing processes in Activity Monitor and then dragging MACDefender from the Applications folder to the Trash.
The software coincidentally shares a name with a small company responsible for two apps, GCStatistic and DTmatrix. The outfit denies any association with the malware. "I would never release an application named like this," MacDefender's operator says.
Fresh-Faced Recruit
Joined: Jan 2003
Huh?
So let me get this straight:
1 - I must search for something on the Internet that leads me to that link (probably suspicious already);
2 - Javascript, IF activated, will start downloading a file, even though such a process can be stopped in the Safari downloads window;
3 - The suspicious ZIP file MUST be opened;
4 - I must then OPEN the unzipped suspicious file, which will then lead me to a suspicious installer;
5 - I must AUTHORIZE the computer to install the suspicious file by providing my password;
6 - EVEN after doing all that, I can just kill processes and delete the file so that all is fine again.
And people still wanna call that "virus" or "malware"? Gimme a break! I've got a lot more damage from script kiddies who once sent me a disguised terminal command as a PDF file. This is a non-issue...