Apple security update will zap scareware - but only if you run OS 10.6

Apple has released a security update that will spot the "Mac Defender" scareware that has hit hundreds of Mac users in the past few weeks, and which will automatically update itself as new versions emerge.

However the protection is only available for users of Mac OSX 10.6.7, the most recent update of the newest version, 10.6 ("Snow Leopard") of the OS. Users of Mac OSX 10.5 ("Leopard") or 10.4 ("Tiger") are not covered by the update, because it uses a software framework called XProtect that is only implemented in Snow Leopard.

The update shows that Apple has been well and truly dragged into the malware arms race: the definition list will be checked for updates every day, and updated with new MD5 hashes of dangerous files.

This raises the question of whether Apple is going to carry out the search for malware itself, or whether it will farm it out to an outside company. That in turn depends on how aggressive the malware attacks become: only the gang behind the Mac Defender attack know how well it has worked, but the fact that the malware has mutated at least twice (to a different name, and then to a version which doesn't require a password to be installed) suggests that they have garnered at least a few credit card details from their efforts.

Update: Ed Bott reports that within hours of Apple releasing the security update, a new variant of Mac Defender is "in the wild", with a date/timestamp of 2124 PDF - eight hours after the Apple release. "As PC virus experts know, this game can go on indefinitely," he writes. "Your move, Apple."

It does indeed look as though Apple is going to have to rethink the tight interlinking that allows downloaded files to automatically trigger the installer program, for instance, and Safari's default behaviour of opening so-called "safe" files (which often aren't) after downloads complete.

It also suggests that the MacDefender gang are making some good money from their scam, or that they're interested in seeing where Apple's breaking point is; or both.

Even so, Google's executive chairman Eric Schmidt suggested at the All Things Digital conference on Tuesday that people should use Google's Chrome browser for security – and that "you could also use a Mac instead of a PC", adding: "The viruses that are present on the PC are not likely to affect you as much on the Mac." (Or not at all; but of course the people behind Mac Defender/Guard are creating their own.)

Schmidt's words aside, the usual strictures apply for those who don't want to be victims: don't run in an administrator account, and be suspicious of any and all files you download, and especially of dialog boxes asking you to agree to something where you don't recall starting it all off. (This applies for Windows too.)

Security Update 2011-003 includes an automated removal tool. Although it is optimised to act on downloads through Apple's Safari browser, it will spot attempts to open any package that fits the file definition for Mac Defender – which has already mutated to "Mac Guard".

The update provides an option on the System Preferences to opt out of the updates, though the default once installed is for it to go ahead.

Snow Leopard has always included a file with definitions of previously known malware that targeted the Mac; these were principally Trojans which masqueraded as video codecs, for example to change DNS settings so the user would be directed to specific sites while trying to visit others.

Apple also put out a support note about "Snow Leopard and malware detection" which explains the process.

At ZDNet, Ed Bott, who has made much of the running in pursuing the story of MacDefender's evolution, has posted two videos of the before and after of the security update. We've included them below.

Before:

After