Re:MacKeeper 0-day flaw more than 20M users affected
by wil421 on Wednesday May 13, 2015 @07:08AM
(#9538072)
Not sure if anyone knowingly installs MacKeeper but I accidentally accepted the download for MacKeeper when I was trying to install a Camera app. Big mistake and I tried to stop the installation.
MacKeeper is a nasty piece of malware. I couldn't quit the program, it would immediately start back and putting it in the trash did nothing. Ended up having to boot into safe mode and remove.
Well as soon as I got it off my computer in Safe mode and restarted I get a prohibited sign. Mac will not boot. Ended up having to reinstall OS X. Thankfully you are able to reinstall and keep your files. Now I stay up to date on my backups!
I don't see why apple doesn't ban them. Obviously they are shady.
Re:MacKeeper 0-day flaw more than 20M users affected
by thirdsun on Wednesday May 13, 2015 @07:33AM
(#9538148)
I once saw a coworker accidentially installing it and it surely is a nasty piece of malware. The problem is that one can never be quite sure whether every piece of the software was removed, which is why we ended up just reinstalling OS X and avoid guessing.
Since then, a few of my friends, who aren't into tech, almost installed MacKeeper. They all had a long history of using Windows and felt that installing some Anti-Virus, Anti-Malware junk was the most natural thing. For normal users it's really hard to distinguish between legitimate applications/websites and shady stuff.
Re:MacKeeper 0-day flaw more than 20M users affected
by orf on Wednesday May 13, 2015 @07:39AM
(#9538166)
Their website[1] looks awesome, I don't own a Mac (Windows user) but if I were to buy one I would definitely consider buying and using it. It's good that this site[2] is the second result on Google for "mac keeper" though.
Re:MacKeeper 0-day flaw more than 20M users affected
by pbhjpbhj on Wednesday May 13, 2015 @08:23AM
(#9538371)
Interestingly the toolkit shown is the Ikea toolkit "Fixa" - I wonder if there's not IP restrictions on their use of such an image.
Edit: I saw this quote on the Mackeeper website you linked (it is good design) "MacKeeper was noticed at Macworld by a journalist from Cult of Mac". So I chased that phrase and all I found was algorithmic page generators like this http://drgogek.com/is/is-mackeeper-really-a-scam-cult-of-mac....
Using a different tack CoM mention Mackeeper in a single page found from their search box, an affiliate promotion page ... using Google unearths more promotions, https://www.google.co.uk/search?q=site%3Acultofmac.com mackeeper.
So, it looks like their quoted reviews are from people they're paying to sell the product, that's a warning sign.
Re:MacKeeper 0-day flaw more than 20M users affected
by tracker1 on Wednesday May 13, 2015 @03:41PM
(#9541454)
Do a search on google for "chrome" and you get any number of adverts for junkware installers before the actual application... this is true of any number of legitimate apps. Let alone if you are duped by an illegitimate app to begin with.
Re:MacKeeper 0-day flaw more than 20M users affected
by thirdsun on Wednesday May 13, 2015 @09:58AM
(#9538934)
Surprisingly, it does - I just knew them for their shady ads and popups which clearly scream "don't install this!", but this website looks absolutely legitimate. Color me surprised.
> What's more, "uninstalling" MacKeeper doesn't get rid of all of it — you'll find various traces of it in your Mac's system library folder, and they take a bit to get rid of (just search for anything with zeobit or MacKeeper in the name, and you'll turn up files).
Re:MacKeeper 0-day flaw more than 20M users affected
by lpsz on Wednesday May 13, 2015 @09:14AM
(#9538600)
I don't see why apple doesn't ban them.
Even in the Mac App Store, Apple permits scammy apps such as "Memory Clean" [1] that consistently ends up in top ranks/top grossing. For one, "RAM cleaning" does nothing helpful and theoretically can make your Mac less performant. Bonus: the app calls home to push the developer's other apps.
I'm surprised stuff like this prospers in plain sight with Apple's tacit approval. Snake oil for non-power users who don't know better.
Re:MacKeeper 0-day flaw more than 20M users affected
by heimatau on Wednesday May 13, 2015 @10:12AM
(#9539035)
@lpsz can you support these statements? "For one, "RAM cleaning" does nothing helpful and theoretically can make your Mac less performant. Bonus: the app calls home to push the developer's other apps."
Re:MacKeeper 0-day flaw more than 20M users affected
by seanalltogether on Wednesday May 13, 2015 @07:45AM
(#9538186)
The GotoMeeting app did this as well, no matter how you tried to get rid of it, it would keep reinstalling itself into your applications folder. Nowadays all the sketchy tools I need for each client get installed in a VM.
Re:MacKeeper 0-day flaw more than 20M users affected
by wil421 on Wednesday May 13, 2015 @08:28AM
(#9538395)
If it was only that easy! Those instructions never worked for me and some other users from at least 2014.[1] Its entirely possible they send different versions for bundled installs or it was modified. The app it was bundled with got promptly deleted and never opened.
Re:MacKeeper 0-day flaw more than 20M users affected
by anonfunction on Wednesday May 13, 2015 @06:56AM
(#9538017)
The person who found the 0-day set up a website that exploits the flaw by uninstalling MacKeeper.
Mr. Thomas released a proof-of-concept (POC) demonstrating how visiting a specially crafted webpage in Safari causes the affected system to execute arbitrary commands – in this case, to uninstall MacKeeper.
Re:MacKeeper 0-day flaw more than 20M users affected
by nsxwolf on Wednesday May 13, 2015 @10:14AM
(#9539048)
They used to run this beautifully integrated ad on speedtest.net, where the robot character was rendered in the same neon green motif. It looked like it was just part of the site. That meant that Ookla must have had an incredibly close working relationship with the ad people at MacKeeper. Feels so dirty.
Re:MacKeeper 0-day flaw more than 20M users affected
by aidos on Wednesday May 13, 2015 @09:16AM
(#9538617)
MacKeeper will execute arbitrary base64 encoded commands on a custom url as root.
I guess it's a "flaw" but whoever put that in knew that would come back to bite. Haha, it's so insanely irresponsible that I don't even know where to start.
We need something like a hippocratic oath, and probably a governing body (or however grown up industries manage themselves), to stop people responsible for this sort of code from having a license to practice.
Re:MacKeeper 0-day flaw more than 20M users affected
by technologia on Wednesday May 13, 2015 @08:59AM
(#9538516)
Wait, MacKeeper is actual software? I just thought it was just another piece of malware with a strangely good pop-up in comparison to other malware pop-ups.
Re:MacKeeper 0-day flaw more than 20M users affected
by sjwright on Wednesday May 13, 2015 @09:01AM
(#9538527)
You're not wrong, that's pretty much all it is.
(Oh, and it bundles a bunch of inferior versions of features already built-in to Mac OS X, like backups, file searching, data encryption, secure delete, login item disabling, default app selection, etc.)
Re:MacKeeper 0-day flaw more than 20M users affected
by bluedino on Wednesday May 13, 2015 @09:38AM
(#9538802)
Let's say there is an installed base of 2 billion personal computers, let's say 10% of those are Macs, that's 200 million, 10% of those would have to have MacKeeper installed to hit 20m users.
Re:MacKeeper 0-day flaw more than 20M users affected
by cekanoni on Wednesday May 13, 2015 @07:39AM
(#9538164)
Their compani is based in Ukraine so you would probably need russian language to dig a bit in tho publicly available documents, but i found that number somewhere on twitter, and am sure its correct. Another proof how much dumb people are living on this wonderful planet..
Re:MacKeeper 0-day flaw more than 20M users affected
by bontoJR on Wednesday May 13, 2015 @09:06AM
(#9538556)
I honestly thought it was an out of mind number, but thinking about how aggressive is their advertising campaign, sometimes almost misleading and the average knowledge of a user, well, I am not sure is out of mind anymore...
Re:MacKeeper 0-day flaw more than 20M users affected
by koyote on Wednesday May 13, 2015 @08:05AM
(#9538270)
"We found users in the US typically use more data and the alternative plans start at around 500MB."
This is interesting considering that the UK providers generally provide more data to users for less money than US providers (with quite a few offering unlimited).
Re:MacKeeper 0-day flaw more than 20M users affected
by parandroid on Wednesday May 13, 2015 @08:11AM
(#9538298)
I have a MacKeeper related question: are apps such as this (cleaners, antivirus etc.) necessary for Mac computers? Judging by the number of users affected by this, there are a lot of people thinking they do need it, I guess.
Re:MacKeeper 0-day flaw more than 20M users affected
by pidg on Wednesday May 13, 2015 @08:20AM
(#9538352)
I don't feel they are necessary, even for less advanced users. Apple do a reasonably good job of keeping things safe and up-to-date.
The number of users may also reflect their pushy "you need this!" marketing. I installed MacKeeper a few days after switching from Windows to Mac, as I had no idea what I was doing. Ended up uninstalling it, then reinstalling OS X from scratch just in case.
Re:MacKeeper 0-day flaw more than 20M users affected
by parandroid on Wednesday May 13, 2015 @08:36AM
(#9538420)
That's what I thought, thanks. I'm a newish Mac user, so I was a bit confused by the whole situation, since other Mac I know told me not to install anything of that kind.
Re:MacKeeper 0-day flaw more than 20M users affected
by mauz0r on Wednesday May 13, 2015 @09:14AM
(#9538604)
If you stick to official software and don't care to scan documents for windows viruses and such, you won't need any antivirus.
I do however use CleanMyMac 2 to remove stuff I don't use, this is the only piece of "cleaning" software that I think is actually worth it.
I like how it helps me getting rid of logs and language files in a lazy way :)
MacKeeper is a nasty piece of malware. I couldn't quit the program, it would immediately start back and putting it in the trash did nothing. Ended up having to boot into safe mode and remove.
Well as soon as I got it off my computer in Safe mode and restarted I get a prohibited sign. Mac will not boot. Ended up having to reinstall OS X. Thankfully you are able to reinstall and keep your files. Now I stay up to date on my backups!
I don't see why apple doesn't ban them. Obviously they are shady.
Since then, a few of my friends, who aren't into tech, almost installed MacKeeper. They all had a long history of using Windows and felt that installing some Anti-Virus, Anti-Malware junk was the most natural thing. For normal users it's really hard to distinguish between legitimate applications/websites and shady stuff.
1. http://mackeeper.com
2. http://www.imore.com/avoid-mackeeper
Edit: I saw this quote on the Mackeeper website you linked (it is good design) "MacKeeper was noticed at Macworld by a journalist from Cult of Mac". So I chased that phrase and all I found was algorithmic page generators like this http://drgogek.com/is/is-mackeeper-really-a-scam-cult-of-mac....
Using a different tack CoM mention Mackeeper in a single page found from their search box, an affiliate promotion page ... using Google unearths more promotions, https://www.google.co.uk/search?q=site%3Acultofmac.com mackeeper.
So, it looks like their quoted reviews are from people they're paying to sell the product, that's a warning sign.
Didn't investigate further.
http://www.imore.com/avoid-mackeeper
> What's more, "uninstalling" MacKeeper doesn't get rid of all of it — you'll find various traces of it in your Mac's system library folder, and they take a bit to get rid of (just search for anything with zeobit or MacKeeper in the name, and you'll turn up files).
Even in the Mac App Store, Apple permits scammy apps such as "Memory Clean" [1] that consistently ends up in top ranks/top grossing. For one, "RAM cleaning" does nothing helpful and theoretically can make your Mac less performant. Bonus: the app calls home to push the developer's other apps.
I'm surprised stuff like this prospers in plain sight with Apple's tacit approval. Snake oil for non-power users who don't know better.
[1] https://itunes.apple.com/us/app/memory-clean/id451444120?mt=...
[1] http://mackeeper.com/uninstall_mackeeper
[1]https://discussions.apple.com/thread/6502268
Mr. Thomas released a proof-of-concept (POC) demonstrating how visiting a specially crafted webpage in Safari causes the affected system to execute arbitrary commands – in this case, to uninstall MacKeeper.
Source: http://securemac.com/MacKeeper_Security_Advisory_Revised.php
Or, you know, don't use MacKeeper ever?
I guess it's a "flaw" but whoever put that in knew that would come back to bite. Haha, it's so insanely irresponsible that I don't even know where to start.
We need something like a hippocratic oath, and probably a governing body (or however grown up industries manage themselves), to stop people responsible for this sort of code from having a license to practice.
Seriously, given the intensely spammy nature of the product's ads I'm unclear if this counts as a 0-day or a FEATURE.
(Oh, and it bundles a bunch of inferior versions of features already built-in to Mac OS X, like backups, file searching, data encryption, secure delete, login item disabling, default app selection, etc.)
-- MacKeeper campaign, 2013
This is interesting considering that the UK providers generally provide more data to users for less money than US providers (with quite a few offering unlimited).
The number of users may also reflect their pushy "you need this!" marketing. I installed MacKeeper a few days after switching from Windows to Mac, as I had no idea what I was doing. Ended up uninstalling it, then reinstalling OS X from scratch just in case.
Get to any Windows user, and ask him when was the last time his anti-virus stopped him from doing anything. Malware has adapted since the 90's.
http://haktuts.blogspot.in/2015/05/how-to-view-hidden-friend...