May test OS' automatic definition updates

Malware coders have already managed to bypass the initial antivirus signatures implemented with Security Update 2011-003, a report notes. A new version of Mac Defender, linked to a file called Mdinstall.pkg, appears to have been deliberately crafted to go undetected by up-to-date copies of Snow Leopard. The file is even timestamped to Tuesday at 9:24PM Pacific time, meaning that less than eight hours elapsed before attackers managed to once again circumvent Mac OS' protections.

Although all versions of Mac Defender require people to accept installation, as previously mentioned by MacNN, the new variant is among those that don't ask for an administrator password, making it easier to become infected without due skepticism. Apple may be able to respond more quickly than it did before, however, as 2011-003 turns on automatic definition updates, similar to antivirus programs like Microsoft Security Essentials. How exactly Snow Leopard might notify people of definition updates has gone unannounced.

Before the Security Update, Mac Defender is believed to have become a minor crisis for Apple. The malware was not only gaining media traction but generating numerous calls to AppleCare, dominating phone traffic at at least one call center. The trouble may, ironically, be based in part on Mac OS' relative safety, as some victims assumed that software being pushed to them was coming from Apple.

by MacNN Staff