It’s a given that Mac users have less to worry about with viruses and spyware than our Windows brethren, but the times they are a-changing, if a security memo issued today from Intego is any indication.
Mac security expert Intego has issued a memo on Tuesday regarding OSX/OpinionSpy, a spyware application that is being “installed by a number of freely distributed Mac applications and screen savers found on a variety of websites,” including MacUpdate, VersionTracker and Softpedia.
While OSX/OpinionSpy is not actually contained in the application itself, the spyware is downloaded during the installation process, then sets out on its nefarious course of action, ranging from scanning files to recording user activity, and even sending such information to remote servers or opening a backdoor on infected Macs.
“The information provided with some of these applications contains a misleading text that users must accept explaining that a ‘market research’ program is installed with them,” Intego notes in their security memo issued June 1, “but not all of these specify this. Some of these programs are also distributed directly from developers’ web sites with no such warning.”
Intego notes that this type of malware has existed on Windows since 2008, but has upgraded the ‘market research’ program to spyware based on the number of “insidious actions” performed by the software.
“The fact that this application collects data in this manner, and that it opens a backdoor, makes it a very serious security threat,” Intego concludes. “In addition, the risk of it collecting sensitive data such as user names, passwords and credit card numbers, makes this a very high-risk spyware. While its distribution is limited, we warn Mac users to pay careful attention to which software they download and install.”
If you download a lot of freeware or shareware from MacUpdate, VersionTracker or Softpedia, it might be worth your time to purchase and install Intego VirusBarrier X5 or X6 in order to detect and eradicate OSX/OpinionSpy -- but first make sure your threat filters are dated May 31, 2010 or later before checking your computer.
Update: Intego has issued a second security memo with a preliminary list of applications that install the OSX/OpinionSpy spyware, which itself is installed as an application named PremierOpinion. Thus far only one application appears to be at risk, which is MishInc FLTV to MP3; the remainder of the list is made up of screensavers from one company, 7art-screensavers. Intego is continuing their investigation into this spyware and will post updates to their Mac Security Blog as necessary.
