Microsoft links fake Mac AV to Windows scareware gang

Similarities point to Russian group that's also responsible for one of 2010's most widespread security scams

Microsoft said this week that it has evidence of a link between the fake security software now plaguing Mac users and a hard-charging family of similar software on Windows.

Phony security software, labeled "rogueware" and "scareware" by experts, has long been a huge thorn in Windows' side. But earlier this month researchers announced the discovery of a Mac-specific scam that claims the machine is heavily infected.

Once installed, the software nags users with pervasive pop-ups and fake alerts until they fork over a fee to purchase the worthless program.

To get rid of the program's alerts -- and the occasional pornographic page that pops up in the browser, a new twist intended to make victims think their computers have been hijacked -- many Mac owners pay the $79.50 "registration fee" for the worthless program.

Mac users have reported being duped into downloading the fake software on Apple's support forums and increasing numbers to Mac-centric antivirus vendor Intego, which has identified at least three names for the same product: MacDefender, MacSecurity and MacProtector.

The bogus program is believed to be the first security software scam on the Mac.

On Tuesday, engineers who work for the Microsoft Malware Protection Center (MMPC) said that users who visit a Web page posing as a free online virus scanner get served either Mac or Windows scareware.

"This distribution component reads the client's [browser] user agent in order to discern the operating system, and then serves up a malicious application designed for that operating system," said Hamish O'Dea and Tareq Saade on the MMPC blog.

The site delivers scareware dubbed "Win32/Winwebsec," while Macs get "MacOS_X/FakeMacdef," O'Dea and Saade said, using Microsoft's labels for the OS-specific versions of the fake security software.

There's also evidence that the same cyber criminal, or gang of scammers, created both versions.

O'Dea and Saade cited several similarities in the code of the two phony security programs, including nearly-identical URLs as the destination for "phone home" transmissions, similar Web addresses for the purchase pages of the pair, and sharing the same payment gateway, the site where users enter their credit card information to buy the useless utilities.

For the latter, a filename change from "buy.php" to "mac.php" alters the gateway from the Windows to the Mac version.

Microsoft's engineers also suspect that the maker of both pieces of scareware is Russian.

"FakeMacdef contains most of its resources in a directory named "ru.lproj," as opposed to "en.lproj" ... this strengthens our suspicion that the developer may be Russian," O'Dea and Saade said.

Winwebsec, the designation of the Windows part of the duo, is a fast-climbing family of scareware, according to a recent Microsoft analysis of 2010's threat landscape.

In the tenth volume of its semi-annual security intelligence report -- which was released last week -- Microsoft said that its free malware cleaning tool had detected and deleted Winwebsec on over 600,000 Windows PCs in the fourth quarter of 2010.

Although it wasn't among the most prolific scareware variants for the entire year, Winwebsec was the third-most-common fake security family in the last three months of 2010, beat only by "FakeSpypro," which had double the number of infections than any other throughout the year, and "FakePAV," scareware that masquerade's as Microsoft's own Security Essentials software.

Microsoft tabulated scareware deletions from data provided by the Malicious Software Removal Tool, a free utility the company updates monthly and pushes to Windows users.

Microsoft's O'Dea and Saade told Mac users to invest in an antivirus program built for the Mac to keep FakeMacdef off their machines, or to remove it once there.

Several antivirus vendors prominent in the Windows market -- such as Symantec -- also sell Mac security software, while others, including Sophos and the Mac-only Intego, offer free or free trial antivirus programs.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Topic Center.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags MicrosoftAppleoperating systemssoftwareCybercrime and HackingMac OSSecurity Hardware and SoftwareIntego

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments

Essentials

James Cook University - Master of Data Science Online Course

Learn more >

Mobile

Exec

Budget

TerraCycle Zero Waste Box Pens and Markers Small

Learn more >

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?