Trend Micro tools tossed from Apple's Mac App Store after spewing fans' browser histories
Trend Micro anti-malware tools have vanished from Apple's Mac App Store – after they were spotted harvesting and siphoning off users' browser histories.
Dr Cleaner, Dr Antivirus, and App Uninstall – utilities owned by the Japan-headquartered security house and distributed on the Mac App Store – are no longer available for download. It is not entirely clear yet whether Apple took action itself and stripped the info-collecting software from its online macOS application store, or if Trend Micro pulled the apps itself following complaints. Its website today still links to the downloads even though they are no longer available.
While neither Apple nor Trend has responded to a request for comment on the matter, the removals are almost certainly a response to reports in recent days that the products appeared to covertly collect and upload private user data.
Mac security guru Patrick Wardle noted last week that in addition to the advertised functions of removing adware and malware from Macs, the software also collected people's personal data including their browsing history, then transmitted that data as a password-protected archive to a server on the internet.
"From a security and privacy point of view, one of the main benefits of installing applications from the official Mac App Store is that such applications are sandboxed," Wardle blogged.
"The other benefit is that Apple supposedly vets all submitted applications - but as we've clearly shown here, they (sometimes?) do a miserable job.)"
Fortunately, the newest version of Apple's OS appears to have addressed the first part of that. Wardle noted that those running preview versions of Mojave would have had the product running within new sandbox protections that would have blocked access to private data such as browsing history.
Still, as Wardle explained, the fact that both applications were signed off by Trend Micro and approved for the App Store by Apple should give users reason to be cautious when looking to get new software from even the Cupertino-sanctioned official portal and trusting Apple's own security protections which were in this case circumvented.
Source theregister
Latest Jobs
-
- PCI QSA needed. Discreet Opportunity | London | Client facing
- London
- N/A
-
CH08421 PCI QSA needed. Discreet Opportunity | London | Client facing. Payment Card Industry - Qualified Security Assessor - London Seeking someone looking to accelerate their career, into a variety of interesting clients / projects. Must be happy to be onsite with clients- this is not a fully remote role. You must currently hold a valid CISSP or CISM or ISO27001 lead implementer certification AND one of the following; CISA, GSNA, iso27001 lead Auditor, CIA or IRCA ISMS auditor+ Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- Security Operations / information Security Analyst / Engineer. London
- London
- N/A
-
Security Operations / information Security Analyst / Engineer needed for a London opportunity. A technical hands on role to investigate, escalate and proactively work to protect a globally recognised brand. Someone with SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Security Cleared Penetration Tester: United Kindom
- N/A
- N/A
-
Security Cleared Penetration Tester Deliver technical Penetration tests to the NCSC CHECK standard. Active CHECK Member or Leader status desirable either in Web Application or Infrastructure. Reach out to find out more. Whatsapp directly here https://wa.me/message/6USF5RAQBOZIP1 Or apply today