'Adware' is the broad definition for malicious code that displays unwanted or unauthorized ads when people browse to websites the ads are often in the form of irritating pop-ups. Almost every day we see new adware coming to the Mac.' 'Malware itself is very rare on Macs,' Reed acknowledged. The adware installer that monkeys with sudoers is delivered as a Trojan horse, Reed added, which poses as a file download utility.Īlthough Reed said Malwarebytes did not have enough data to describe the extent of the campaign waged against Yosemite-powered Macs, he did say that the vulnerability was being put to work by adware shillers. The change to sudoers 'gives any user, even guest users, rights to write to any file,' said Reed of Malwarebytes. Sudoers is a Unix file that, among other things, determines which users have 'root' permissions in a Unix shell. 'The modification made to the sudoers file, in this case, allowed the app to gain root permissions via a Unix shell without needing a password,' wrote Thomas in an Aug. Mac users are typically required to enter an administrator password before installing code to their systems. Malwarebytes' Adam Thomas found the vulnerability exploit in the wild after examining an adware installer, which used the escalation of privilege flaw to drop its payload without the user's knowledge.

According to a Korean researcher who goes by the nickname 'beist' on Twitter, the bug had been reported to Apple before Esser revealed the flaw.Įsser took heat from some quarters for not informing Apple before publishing his findings. The vulnerability - which is Yosemite-specific - was publicly disclosed last month by German researcher Stefan Esser, who also posted exploit code.

Download malwarebytes for el capitan