New Apple antivirus signatures bypassed within hours by malware authors [Update]
Update June 1, 6:00AM PDT: The bad guys have wasted no time. Hours after Apple released this update and the initial set of definitions, a new variation of Mac Defender is in the wild.
Context & Ripple Effects
The warning Ed Bott issued in his May 2011 argument that Mac malware was on its way has arrived faster than most defenders expected. After February's OS X backdoor Trojan in beta testing, the Mac Defender scarecrow campaign became the first Mac malware with real distribution scale — and Apple, which has long left antivirus duties to third parties, responded by shipping its own malware signature definitions.
That response lasted hours. Malware authors reworked Mac Defender into a variant the new definitions miss, turning Apple's first signature drop into a live test of whether the company can run the rapid-update cycle that Windows-side defenders have operated for years.
First-order effects
- Mac users who rely on Apple's built-in definitions are unprotected against the new variant right now, since the signatures target the older build.
- Apple must either push definition updates on a cadence it has never had to sustain or cede detection of active Mac Defender variants to Sophos and other third-party vendors already shipping their own.
Second-order effects
- Third-party Mac antivirus vendors get their strongest sales pitch in years: a demonstrated gap between Apple's response time and attackers' iteration speed.
- If variants keep mutating daily, Apple faces pressure to supplement signatures with structural defenses — blocking installers, warning on downloads — rather than playing per-sample whack-a-mole.
Third-order effects
- A sustained arms race would end the era in which Mac OS X's small market share functioned as de facto protection, forcing Apple into a Windows-style security posture with regular malware-definition releases.
- Security software on the Mac could shift from optional niche purchase to mainstream default if Apple's built-in effort keeps trailing the malware authors by hours-to-days.
The trend: Mac malware is crossing from curiosity into an update-driven arms race, with Apple forced to operate antivirus response at the cadence Windows defenders have long accepted.