Last night the malware authors behind the Mac Guard fake anti-virus changed their methods again to bypass the updates Apple released yesterday afternoon to protect OS X Snow Leopard users.
Apple fired back shortly after 2 p.m. Pacific Daylight Time today with a new update to XProtect. Computers that have Apple update 2011-003 for Snow Leopard now check for updates every 24 hours.
As the cat-and-mouse game continues it will be interesting to see how the attackers proceed. The major change to bypass Apple’s detection yesterday was to use a small downloader program to do the initial infection, then have that program retrieve the actual malware payload.
This approach may be successful as it will be easier for the malware authors to continually make small changes to the downloader program to evade detection while leaving the fake anti-virus program largely unchanged.
Why is this important? Apple’s XProtect is not a full anti-virus product with on-access scanning. XProtect only scans files that are marked by browsers and other tools as having been downloaded from the internet.
If the bad guys can continually mutate the download, XProtect will not detect it and will not scan the files downloaded by this retrieval program. Additionally, XProtect is a very rudimentary signature-based scanner that cannot handle sophisticated generic update definitions.
Apple now detects this malware as OSX.MacDefender.C. Sophos Anti-Virus for Mac detects individual components of this malware as OSX/FakeAV-DWK, OSX/FakeAV-DWN, OSX/FakeAvDl-A and OSX/FakeAVZp-C.
It also appears that this malware is using the tried-and-true affiliate distribution method. The writers recruit other people to perform black-hat SEO, infect web pages and post blog spam and assign each one a unique affiliate ID to use in the URL for their traffic.
This allows the criminals to track which affiliate referred the victim and pay them a commission upon purchase of the fake software, enabling the criminals to cast a much wider net by sharing a portion of the profits with their “affiliates.”
Considering that XProtect only updates once a day, and only on OS X 10.6 Snow Leopard, I recommend users install a proper anti-virus tool. If you want to make sure Apple’s solution is up to date you can open a terminal on your Mac and type the following command:
/usr/libexec/XProtectUpdater
Even if I didn’t work for a security company, I would install a proper anti-virus tool rather than hope that Apple provides an update every time a new threat appears. We make our Sophos Anti-Virus for Mac Home Edition available absolutely free. No registrations, no email, just free protection.
Thank you to Naked Security reader Patrick Fergus for the tip about Apple’s update to XProtect and Mrs. W. for carving our delicious apple with a perfect X.
