Apple adds basic anti-malware to Snow Leopard

New OS designed to sniff out a pair of Mac-specific Trojans

Apple has expanded a download warning feature in Mac OS X 10.5 to create rudimentary anti-malware detection in the new Snow Leopard operating system due out Friday, sources have confirmed.

Out of the box, Snow Leopard will be able to detect only two Trojan horses, although Apple will be able to push other signatures to users through the Mac operating system's Software Update service, those sources said.

The confirmation came after reports that Snow Leopard had taken its predecessor's File Quarantine feature a step further, and actually scans files downloaded by Safari, Mail or iChat for malicious code.

Where Leopard only warned users that a file had been obtained from the Internet -- and thus was potentially dangerous -- Snow Leopard scans files for possible malware.

According to a screenshot posted Monday by Mac-only antivirus maker Intego, Snow Leopard sniffs out the malware, then puts up a warning that recommends users dump the downloaded file in the Trash rather than open it.

Neither of the two Trojans -- dubbed "RSPlug.a" and "Iservice" by Symantec -- that Snow Leopard currently detects is new. The former was first spotted in October 2007, while the latter debuted in January.

RSPlug made news in late 2007 when security researchers found the malware on numerous pornographic Web sites; if downloaded to a Mac, the Trojan changes the machine's DNS (Domain Name System) settings to redirect users to alternate or spoofed sites.

Iservice, on the other hand, was spotted earlier this year piggybacking on pirated copies of iWork '09 , Apple's productivity suite, by users who had downloaded the software from file-sharing sites.

Several researchers and bloggers, including Computerworld's Seth Weintraub, spotted a new .plist file in Snow Leopard that the OS uses to store malware signatures. That file, "XProtect.plist," has been tucked into the "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources" folder.

Future signature updates will presumably be added to the XProtect.plist file.

Because Apple regularly bashes Microsoft over the flood of Trojans, worms and viruses that target Windows -- most recently in a new television ad -- its admission that malware affects Macs is a setback, albeit small, to its marketing, said one analyst.

"If Apple includes anti-malware, weak or strong, it does undermine Apple's marketing message, but only slightly," said Ezra Gottheil, an analyst with Technology Business Research.

"Apple doesn't claim that Macs cannot be successfully attacked; it claims that they are not often successfully attacked, and that is true. So if adding basic anti-malware software helps keep Macs relatively clean, given their lower [attack] profile, that helps Apple's primary message: Macs are less hassle."

Snow Leopard goes on sale Friday, and requires an Intel-based Mac. People upgrading from Leopard can purchase a $29 single-license, or a $49 five-license Family Pack.

Users running Mac OS X 10.4, aka Tiger, must instead purchase the more expensive Box Set, which costs $169 for a single license and $229 for a five-license pack. The Box Set also includes the iLife '09 creativity bundle and the iWork '09 productivity suite.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Applesnow leopardMac OS Xanti-malwaremalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?