Security Stories September 17
Security Stories September 13
While AT&T, Verizon, T-Mobile, and Sprint are often battling for an edge over each other, the major US carriers have come together to create a new approach to password management as well as a more secure 2FA solution. Named Project Verify, the new collaboration has the goal of replacing individual passwords with an approach that offers more security and a simpler user experience.
Security Stories September 12
Apple fails to fix fake website vulnerability in Safari three months after notification [Video]
A security researcher who found a security hole in Safari says that Apple has still not fixed it, more than three months after he informed the company. The same vulnerability was present in Microsoft’s Edge browser, but the company issued a patch a month ago …
Security Stories September 9
[Update 9/10 4:50 am PT: The certificate issued for the domain drcleaner.com is registered as Trend Micro, Inc. Also, the domain where the data is uploaded to is a subdomain of trendmicro.com, this means the apps are in fact distributed by Trend Micro, Inc.]
[Update 9/9 7:46 pm PT: The apps discussed in this article have been removed from the Mac App Store.]
When you give an app access to your home directory on macOS, even if it’s an app from the Mac App Store, you should think twice about doing it. It looks like we’re seeing a trend of Mac App Store apps that convince users to give them access to their home directory with some promise such as virus scanning or cleaning up caches, when the true reason behind it is to gather user data – especially browsing history – and upload it to their analytics servers.
Today, we’re talking specifically about the apps distributed by a developer who claims to be “Trend Micro, Inc.”, which include Dr. Unarchiver, Dr. Cleaner and others. This issue was reported before by a user on the Malwarebytes forum, and in another report. Other researchers followed up and found that apps distributed by this “Trend Micro, Inc.” account on the Mac App Store collect and upload the user’s browser history from Safari, Google Chrome and Firefox to their servers. The app will also collect information about other apps installed on the system. All of this information is collected upon launching the app, which then creates a zip file and uploads it to the developer’s servers.
Security Stories September 7
[Update 8:54 am PT: Apple has pulled Adware Doctor from the Mac App Store. See below for more.]
Adware Doctor, the number one paid utility in the Mac App Store, is secretly logging the browser history of users, and sending it to a server in China.
Security researcher Patrick Wardle says that he notified Apple of this a month ago, but the malware app still remains available in the Mac App Store today …