Mac Defender and Apple Evolve
As mentioned on our blog, Apple has released a security update for Snow Leopard that will monitor downloads and alert you if Mac Defender attempts to install itself. Dubbed Security Update 2011-003, it was released on May 31st and should have appeared in your Software Updates list. (If not, you can download it directly from Apple here. Sorry Leopard users, it’s for 10.6.7 only.) Just as Apple released the update, a new variant of Mac Defender surfaced in an attempt to bypass the malware filter. Rather than play cat-and-mouse with the malware writers, Apple included the ability to update malware definitions automatically in the Security Update. This means if a new version of Mac Defender were to come out tomorrow, your Mac would be ready for it.
If you took our advice and disabled the Safari option to Open “safe” files after downloading, you may have wondered how Safari determines what is and what isn’t a “safe” file. Mac OS X has built-in malware detection that will watch what you’re downloading via Safari and alert you if it shows up on the list. (Even if the file is not on the list, you will still get a warning about the file being downloaded from the Internet.) This list of “safe” files is updated from time to time with Security Updates, but not everyone downloads updates when they come in.
Given how many people have fallen for the Mac Defender “virus warnings,” the 2011-003 update sets your system to automatically check for updates to this list every 24 hours. You don’t have to do anything, it just quietly grabs the latest list from Apple once a day. If you’re really paranoid, you can force it to update more often. To do this: go to System Preferences -> Security -> General and look for the new option: “Automatically update safe downloads list.” Remove the checkmark, wait a few seconds, then check it again. If you want to check what version of the malware definitions are installed, you can download a utility called Safe Download Version, courtesy of The Mac Observer.
As has been said in the past, the best way to avoid malware is to pay attention to what you see. First, a web site cannot detect viruses on any computer just by loading a page. Second, you should never enter your administrator password unless you are absolutely sure you know what you’re allowing access to. Do a quick search on Google if you aren’t sure what the program is doing. If you’re really concerned, don’t use an Administrator account for everyday use. There isn’t any legitimate reason to set your account as Administrator, even if you are the only person using your computer. Use a separate Administrator account for system updates, and use a Standard account for email and web surfing. That way if something does slip through, it can’t do any damage. Finally, stay on top of security updates. Snow Leopard is up to v10.6.7 now, with v10.6.8 just around the corner—there’s no reason you should still be on v10.6.3.