Sunday, May 15, 2011

[NEWS] Mac OSX First Ever Fake Antivirus

The first fake antivirus has been released on Mac OS X recently which is called MacDefender/MacProtector/MacSecurity.

I had a chance to come across this fake av when I did google image search a few days back. Unsurprisingly, this Mac fake av does exactly the same way as what Windows fake av did that is it also presents a fake browser page showing the user that their machine has been infected with malware.

When I did a google image search, I opened an image indexed by google in which google will redirect me to a compromised website with a "hidden" (from novice computer user point of view) javascript. After the compromised page is opened, it will immediately redirect user to another page with URL top level domain "cz.cc" which is where the fake av page will be displayed.

Figure 1: Image Indexed by Google


Figure 2: Script Redirection From Compromised Site


Figure 3: Fake AV Scan Result

Immediately after the scan finished, it will prompt a dialog box to ask download and execute the file after user clicked "Remove all" button.

Figure 4: Download Fake AV File


If you are interested a get a registered version of this MacSecurity, you can visit this post from Kaspersky Lab, http://www.securelist.com/en/blog/11252/Mac_Protector_Register_your_copy_now where you can get a list of valid license key!

Figure 5: Fake AV Scanning in Action

Now I have a registered MacProtector to clean the "detected" file  =)

Figure 6: Registered Copy of MacProtector

Reference


You can visit http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-poison-google-image-search-results/ for the excellent research on google image SEO poisoning technical information.

Have fun!

Signing off @x9090

2 comments:

win antivirus said...

Hello, thanks for posting this information, I was trying to find information on this topic –this was very helpful.

dolly chaudhary said...


There is a reason why I bought a Mac, it was not to be one of the cool kids that wanted the best of the best. No it was because of the music production I do on it. Hours and hours sitting in front of my Mac copying, pasting, moving, deleting, hour after hour just beating on my Mac in a endless assault to get my work done. That is the key part, my work. I work from home, it is great, but even if it is from home it is still work and it still needs to get done. So my Mac, I have it because it is fast, gets the job done and comes back for more.

But what happens when it doesn't want to do those things anymore?

I move around massive amounts of information and yes even on the almighty Mac this can cause a problem after a while. Things fragment, programs get corrupted issues come up. My light speed Mac slows down to a crawl and all of the sudden I simply can not get any work done. Because I work from home there is no IT guy to call and ask to come fix it. No instead I have to figure out what is wrong. I am lucky, I did, but not after trying everything under the sun first and wasting countless hours looking for one program that can do what I needed instead of ten programs. One program to lead them all….okay that was a lame Lord of the rings reference, but that program was/is Detox My Mac. A simple to use program that did not just fix my issues, it put my Mac on overdrive again. A few clicks and my Mac was clean and ready to rock and roll again.

Read more here:- http://detox-my-mac.com?duhhf9265hskfhf98346