I like to consider myself a long time Apple user, but that would be an insult to those who have been using Mac products since before my birth. However, in the last ten years, I have used Apple products, almost exclusively. I spent three years working at an Apple Authorized Service Provider, repairing Apple products, primarily working on computer hardware and software (I dabbled in iOS devices for about a year). That being said, I have repaired many Macs that are infected with malware, trying to rid them of issues. One commonly recurring problem has been one threat vector, that I would say was the cause to over 75% of malware-infected machines was the utilization of a fake Adobe Flash Player installer.
I don’t have enough fingers and toes to count the number of times I have talked to someone who has a Mac infected with malware, and it occurred when they “received a notification for an Adobe Flash update” while perusing a website. They then click on the update link. Suddenly, they have a malware problem.
Attackers have made their fake Adobe Flash Player downloaders look more and more like the real thing. Now when I say “the real thing," I don’t necessarily mean that it looks just like Adobe’s installation webpage, but they do make it look legitimate. Take a look at the image to the right. It is a piece of malware that is wrapped to look like a downloader for an Adobe Flash Player update. Now typically these pop-ups occur on websites that aren’t secure. One common theme I would see frequently is a pop-up after pirating media, whether it be ripping YouTube videos, or on well known torrenting sites. I have typically placed 99% of the blame directly on Apple for multiple reasons. The first and foremost is that they have been known to spread the rumor that “Macs don’t get viruses.” Again, this is an all-out falsehood. Apple tried very hard to make that phrase popular, but the truth is that Mac malware has been skyrocketing.
You see a large amount of the malicious software installed on users that are under 25 years of age and over 55. I think the reason for this depends on the group. For the older generation, they are typically more trustworthy. They can’t rationalize why someone would want to infect their computer, and their thought process is understanding.
I thought that there had to be more to this issue than simply Apple’s issue of not cracking down hard enough of malware. The Macs built-in protection, in the form of MRT (Malware Removal Tool) and XProtect, simply don’t work well enough. You need supplemental software to protect your machine. A follow-up issue to that is that these malware removal apps are not available in the App Store. Actually, let me clarify - there are apps in the App Store, but they are not good. To host your app in the App Store, there has to be very specific things it can and can’t do. Some of the things that Apple restricts in their App Store are necessary for a good A/V (antivirus) to have. I’ll give you some great malware-removal tools and AVs at the bottom of this post.
So where does Adobe fit into all of this?
It’s obvious that this threat vector is extremely common. But why? I started digging through Adobe’s webpages, and I started looking into their release notes. Typically, when a piece of software is provided an update by the developer, the developer also includes “Release Notes,” which is, usually, a short summary or itemized list of bugs that were fixed, glitches that were resolved, security issues patched, and on and on. When you look at the release notes for Adobe Flash Player, the list is incredibly long. Not just the list of release notes, but the number of releases.
It’s not unlike Adobe to push out more than one update/release per month. This is a lot of releases. They’re averaging one/month so far in 2019, and averaged above that throughout 2018. What this does is shows that Adobe’s Flash Player truly does need to be updated regularly, and as users, we have become so accustomed to this software’s need for updates that since Adobe Flash Player’s inception in 1996, users constantly blindly trust that Adobe does need to update its software. Why? Because we’re used to it actually needing to be updated. When Adobe is typically giving you monthly notifications that you need to update their software to navigate to certain websites or to watch videos on specific webpages, we don’t get surprised when we navigate to a certain website, get a pop-up saying the software needs to be updated, and click Accept. Now we definitely shouldn’t just be clicking Accept on random websites just because we see a pop-up saying that Adobe Flash Player needs to be updated, however, how come we’ve never criticized Adobe for pushing these monthly releases or for not being more forthcoming about how malware uses their logo and name to mask themselves. The only place you’ll see this type of comment on an Adobe website is on their forums, where users are asking about how to get rid of malware after installing a fake Adobe Flash Player. So I’m calling for Adobe to step up to the plate and address this issue that has be plaguing Mac users for years now.
Since it’s unlikely this issue will be resolved any time soon, let’s play a little defense. There are many pieces of software that can help prevent malware and can detect these fake Adobe installers the second they hit your machine. There are also additional tools for more advanced users that can help you do a little digging.
For me, the best piece of software you have have is Malwarebytes for Mac. Malwarebytes for Mac, which used to be a piece of software called Adware Medic, was created by Thomas Reed and was used to search a computer for malware, adware, and potentially unwanted software. The software used to be free, but now it is a mostly paid software that is subscription-based. If you’re frustrated that you can’t necessarily just buy the software outright, I will explain right now that everything is going the way of subscriptions. There’s no way to get around it. For developers, subscriptions is a more effective way to get and keep subscribers. Malwarebytes still has a limited free version that will clean your Mac, but it’s preventative features will disable after the 14-day trial expires. I highly, highly recommend buying the Premium subscription, that runs at only $39.99/year for one device. You won’t find a better deal than that or a better product. (By the way, this is in no way a sponsored post, this is simply my opinion). Another great part of Malwarebytes is that now they offer an iOS app, which will help you recognize spam calls, provide web protection, and ad blocking. Again, I can’t recommend it enough.
Another piece of software is brought to you by the incredible folks over at Objective See. All of the software you find over at Objective See is both open source and free. They offer something called What’s Your Sign. This small program, once installed, allows you to right-click on software and see if it is “signed.” All software is signed. This means that the developer has digitally signed it to show that it is authentic. When you right-click the Signing Info option, you get a small window that shows if it is signed. We see in the image to the right that the signing authority is Objective See LLC, who is the creator of What’s Your Sign. So with something like Adobe, we should see that the software is assigned by Adobe proper, similarly to how apps coming from Apple’s App Store need to be signed by Apple proper. We also see in the above photo, the lock is locked.
Now let’s look at this fake Adobe Flash Player. Notice how the lock is unlocked, and it says that the signing authority is unsigned.
Objective See and the app’s creator, Patrick Wardle, make fantastic tools that you should check out. Check them out at Objective-See.com.
As per usual, let me know if you have questions regarding your machine. See something suspicious, don’t hesitate to tell me.