Apple secretly updates Mac malware protection

Filed Under: Apple, Malware, Video

Apple Mac
Apple's 10.6.4 operating system upgrade earlier this week silently updated the malware protection built into Mac OS X to protect against a backdoor Trojan horse that can allow hackers to gain remote control over your treasured iMac or MacBook.

Although there is no mention of it that we could find in Apple's release notes for Mac OS X 10.6.4, or the accompanying security bulletin, Apple has updated XProtect.plist - the rudimentary file that contains elementary signatures of a handful of Mac threats - to detect what they call HellRTS.

XProtect update

HellRTS, which Sophos products have been detecting as OSX/Pinhead-B since April, has been distributed by malicious hackers disguised as iPhoto, the photo application which ships on modern Mac computers.

If you did get infected by this malware then hackers would be able to send spam email from your Mac, take screenshots of what you are doing, access your files and clipboard and much more.

Unfortunately, many Mac users seem oblivious to security threats which can run on their computers. And that isn't helped when Apple issues an anti-malware security update like this by stealth, rather than informing the public what it has done. You have to wonder whether their keeping quiet about an anti-malware security update like this was for marketing reasons. "Shh! Don't tell folks that we have to protect against malware on Mac OS X!"

It seems their own employees can be amongst the worst offenders when it comes to giving users security advice. Just a few days ago I saw a former colleague of mine tweet about the poor advice about malware protection being offered in Apple retail stores.

Tweet from Ian Whalley

There's a lot less malicious software for Mac computers than Windows PCs, of course, but the fact that so many Mac owners don't take security seriously enough, and haven't bothered installing an anti-virus, might mean they are a soft target for hackers in the future.

And I'm afraid that although I welcome Apple doing something to reduce the malware problem on Mac OS X, I don't consider it a replacement for real anti-virus software. Here's a video I made last year, demonstrating what Mac OS X Snow Leopard can do to stop malware, and - importantly - what it can't do to stop malware:

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

Apple's update to detect "HellRTS" more than doubles the size of the XProtect.plist file from 2.4k to 5.1k. There are still a lot of Mac threats it doesn't protect against.


Hat-tip: Thanks to Sophos's Ben Jupp for letting me know about this silent update to Apple's Mac OS X security.

, ,

You might like

One Response to Apple secretly updates Mac malware protection

  1. john · 971 days ago

    so, now you are stung and have the HellRTS infection. Norton cleaned the MAC and wiped out the but we are still sending emails. how can i restore the MAC?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.