The Mac Defender protection is already broken, 02/06/2011 - Your reactions

[machmeter]

It took even less time than we expected, just a few hours to break the protections put in place by Apple to protect the Mac (only running on Snow Leopard).
A new version of the malware with a different signature is already circulating and it can go around the protection without any problem.


The situation could be even worse now than it was before the update as many users are now misinformed about the risks, and they might not be as careful as they were before the update.
It will now be a race between hackers and Apple, and for now, Apple cannot win as the signature system can only be put in place when a new version has been detected, so the hackers will always be ahead.
We wouldn't say that Apple has lost even before the battle, but it has been 20 since anti-virus have been around on PCs and they have not been able to eradicate all the viruses, just like we probably will never be able to get rid of all the diseases on Earth.
Apple is now forced to go forward with dedicated teams, which will have to react as fast as they can to detect the new versions and add them in the database.


Another thing is going to be the media, as with this malware, Mac OS X attacks and security risks will from now on, receive more coverage.
By Machmeter, original by Lionel

[AaronD12]

Apple has the ability to update definitions as frequently as daily with the latest software update. Stop worrying and stop installing software from unknown sources!

-Aaron-

[geraldapple]

I agree stop this nonsense of downloading every thing you see on the internet regarding to all these anti virus programs and listen to Apple.

[machmeter]

I'm not worried about myself nor most HardMac readers, the problem is people who say yes to every single box popping up on their screen, especially if it's something telling them that a virus has been detected.
Then, the strength of MacDefender is that it downloads itself if the user clicks on an infected webpage.
Plus it doesn't require the admin password to be installed, one click and it's done.
I think there are reasons to be worried since it is well designed (it creates a Finder window), some users know that it is nonsense and that it is a fake, but many people have no idea.
As for the update of the signatures, yes they can do it rapidly, but they can only update after the new signature has been detected, meaning that there will still be users affected, while they think they are protected.
Some might think that the update blocks the malware once and for all while it is not the case.