Understanding Malware on Macs Membership Participation Encouraged Tom Bonanno & Bruce Mitchell - December 8, 2020 Plenty of Mac users will tell you that Apple computers are inherently secure and don't require protection. We'd argue that they are wrong - or overconfident, at the very least. Mac threats increased by 400 percent in 2019 (compared to 2018) according to the a report from Malwarebytes. The bad guys are targeting Mac users these days and they're getting smarter and greedier. As a result, cyber security is more important than ever, and good antivirus software is the best place to start if you want to stay safe. https://www.intego.com/mac-malware-definitions What is Malware? Virus Trojan Horse Worm Spyware Botnet Definition: software that is specifically designed Spam to disrupt, damage, or gain unauthorized access Exploit to a computer system Malware is short for malicious software. small bits of code when opened infect files and applications Macs have very few viruses. Enters under the pretense of usefulness but actually contains malicious code Worms spread over networks files and carryout malicious actions Secretly monitors your computing behavior and collect personal information Compromises computers and then sends spam to attack other computers Can crowd your Mail inbox and cause significant loss of productivity breaks through your Mac’s security defenses There are sometimes internet sites which will try to deceive with fake web pages and pop-ups. Scam Do Not Call. It's important to understand that this is not a computer virus, and your Mac has not been infected with any malware. It is also very important that you do NOT call the phone number listed in this window. This is a scam, and you should not spend any money or share your personal information with anyone to get rid of these messages. If you do happen to call one of these phone numbers, you will more than likely be asked to install special software on your Mac that will allow them to remotely access information on your computer and possibly compromise your system further. https://support.intego.com/hc/en-us/articles/207113578-About-the-Web-Browser-Pop-up-Alert-Scam#whattodo So if you or a friend fell for the scam what would you do? Immediately call the credit card company to dispute or cancel the charge. Unfortunately they may need to cancel that credit card number as the bank may feel it was compromised. Then track down all auto payments. If you did call that number and downloaded something… There may also still be some screen sharing software installed on the computer. Typically it was a one time session download software that can easily be found in the download folder and thrown away. But another place to check is in System Preferences > User and Groups > Login Items. View in the Finder Nothing suspicious here This is Questionable Software Minus sign removes item In a web search for software there are bogus results that will install the malicious software. These suspicious software applications to get installed are like MacKeeper, Zip Cloud, Mega Backups, Mac Cleaner, and others. They begin to take over the menu bar, pop up windows in the Finder and create an annoyance outside of the web browser. Apple introduced a feature called Auto Resume where it creates a saved state of the application. When you reopen certain applications and you did not close a file or web page in this case that was open, it re-opens to the last page you had open automatically. By-pass that feature. https://support.apple.com/en-us/HT204005 Safe Mode or Command-S as you re-start Keep unchecked So to stop the issue, go to the Apple Menu and select Force Quit. Force Quit the web browser application with the fake pop-up. Here is the trick. Before attempting to open the web browser again, hold down your SHIFT key on the keyboard and while holding that down, click the web browser icon in the dock. This will force the browser to open the default page rather than the “saved state” of the malicious page. Malicious Software Adware are applications that inform the user that their Mac now has problems and viruses that their software can fix it. So they bait the user into believing there is a problem, then suggest the only way to fix it is to pay them for the software. Adware is unwanted software designed to throw advertisements up on your screen, most often within a web browser. Some security professionals view it as the forerunner of the modern-day PUP (potentially unwanted program). Typically, it uses an underhanded method to either disguise itself as legitimate, or piggyback on another program to trick you into installing it on your computer, tablet, or mobile device. https://www.malwarebytes.com/adware/ Get the latest software updates from Apple Keeping your software up to date is one of the most important things you can do to maintain your Apple product's security. Built-in Protection in Mac OS Gatekeeper Allows only trusted Apps to be Installed 10/23/20, 2:22 PM Page 1 of 1 Education Store Home Exit Safely open apps on your Mac Gatekeeper macOS includes a technology called Gatekeeper, that's designed to ensure that only trusted software runs on your Mac. The safest place to get apps for your Mac is the App Store. Apple reviews each app in the App Store before itʼs accepted and signs it to ensure that it hasnʼt been tampered with or altered. If thereʼs ever a problem with an app, Apple can quickly remove it from the store. If you download and install apps from the internet or directly from a developer, macOS continues to protect your Mac. When you install Mac apps, plug-ins, and installer packages from outside the App Store, macOS checks the Developer ID signature to verify that the software is from an identified developer and that it has not been altered. By default, macOS Catalina also requires software to be notarized, so you can be confident that the software you run on your Mac doesn't contain known malware. Before opening downloaded software for the first time, macOS requests your approval to make sure you arenʼt misled into running software you didnʼt expect. https://support.apple.com/en-us/HT202491 Running software that hasnʼt been signed and notarized may expose your computer and personal information to malware that can harm your Mac or compromise your privacy. View the app security settings on your Mac By default, the security and privacy preferences of your Mac are set to allow apps from the App Store and identified developers. For additional security, you can chose to allow only apps from the App Store. In System Preferences, click Security & Privacy, then click General. Click the lock and enter your password to make changes. Select App Store under the header “Allow apps downloaded from.” Open a developer-signed or notarized app If your Mac is set to allow apps from the App Store and identified developers, the first time that you launch a new app, your Mac asks if youʼre sure you want to open it. An app that has been notarized by Apple indicates that Apple checked it for malicious software and none was detected: Prior to macOS Catalina, opening an app that hasn't been notarized shows a yellow warning icon and asks if you're sure you want to open it: If you see a warning message and canʼt install an app If you have set your Mac to allow apps only from the App Store and you try to install an app from elsewhere, your Mac will say that the app can't be opened because it was not downloaded from the App Store.* If your Mac is set to allow apps from the App Store and identified developers, and you try to install an app that isnʼt signed by an identified developer or—in macOS Catalina—notarized by Apple, you also see a warning that the app cannot be opened. If you see this warning, it means that the app was not notarized, and Apple could not scan the app for known malicious software. You may want to look for an updated version of the app in the App Store or look for an alternative app. If macOS detects a malicious app If macOS detects that an app has malicious content, it will notify you when you try to open it and ask you to move it to the Trash. How to open an app that hasnʼt been notarized or is from an unidentified developer Running software that hasnʼt been signed and notarized may expose your computer and personal information to malware that can harm your Mac or compromise your privacy. If youʼre certain that an app you want to install is from a trustworthy source and hasnʼt been tampered with, you can temporarily override your Mac security settings to open it. In macOS Catalina and macOS Mojave, when an app fails to install because it hasnʼt been notarized or is from an unidentified developer, it will appear in System Preferences > Security & Privacy, under the General tab. Click Open Anyway to confirm your intent to open or install the app. The warning prompt reappears, and you can click Open.* The app is now saved as an exception to your security settings, and you can open it in the future by double-clicking it, just as you can any authorized app. *If you're prompted to open Finder: control-click the app in Finder, choose Open from the menu, and then click Open in the dialog that appears.