Apple Secretly Updated Mac OS X’s Anti-Malware Protection

Snow Leopard, the new version of Apple’s Mac operating system, is sufficiently short on new user features that Apple wouldn’t have hidden one of the more significant additions. But that’s exactly what they’ve done, presumably because it conflicts with the company’s marketing message.

Snow Leopard contains a component that checks for the “signatures” of known malware alerts users when a Web download, e-mail attachment, iChat instant message contains code that the system thinks is malicious.

Sophos, an IT Security and Data Protection firm claims that Apple secretly updated Mac OS X’s anti-malware protection with this week’s release of Mac OS X 10.6.4.

The System update includes limited protection against the OSX/Pinhead-B Trojan, (called HellRTS by Apple), Sophos says. This is a backdoor Trojan which can allow remote hackers to gain control over Macs for the purposes of identity theft, spying and the distribution of spam.

Sophos has been detecting OSX/Pinhead-B since April, when the malware was distributed disguised as the popular iPhoto application by malicious hackers.

"It's good that Apple has updated its Mac OS X malware protection, as this Trojan can give hackers the green light to send spam email from your computer, take screenshots of what you are doing, access your files and clipboard and much much more," said Graham Cluley, senior technology consultant at Sophos.

"But what's curious to me is why Apple didn't announce they were making this update in the release notes or security advisory that came with Mac OS X 10.6.4. It's almost as if they don't want to acknowledge that there could be a malware threat on Mac OS X."

Researchers at Sophos also discovered that Apple updated a file called XProtect.plist that contains elementary signatures of a handful of Mac threats - to detect "HellRTS". "It's true to say that there are far far fewer malware threats for Mac than there are for Windows - but that doesn't mean the problem is non-existent,” the security consultants warn. Cluley went on to take Apple to task for its lack of transparency in issuing the secirity patch. This lack of awareness isn't helped when Apple issues an anti-malware security update by stealth, rather than informing the public what it has done. You have to wonder whether marketing motives are at play behind such decisions,” he said.

Sophos is warning Mac users to install the latest System patch if they want to avoid becoming soft targets for hackers in future.

Check out the video below, which was compiled last year demonstrating what Mac OS X Snow Leopard can and can't do to stop malware.