Apple users tend to blindly trust the company’s app store out of a belief that the applications must be secure since they are vetted by the company. However, two cases of data theft have brought to light the vulnerability of Apple’s Mac Store.
Data theft by Trend Micro apps
Trend Micro has four apps at the Mac Store. These include an antivirus product called Dr. Antivirus and three others — Dr. Cleaner, App Uninstall, and Dr. Unarchiver. These apps were reportedly harvesting user’s browser histories and sending them to an Amazon server based in the U.S. Though the company claims that the activity was declared in the disclosures accepted by the users during the install, many people were unaware of it since very few actually read the fine print of an app installation.
The harvesting was done 24 hours after the app was installed by the user. This was done to check whether the computer had come across any adware or other security threats. By recording user browser history, Trend Micro could potentially share it with other third parties. When news broke out about the data theft, Trend Micro went into a damage control mode and removed the browser history collection feature from the apps.
In a bid to maintain trust among its users, Apple decided to remove all the affected apps of Trend Micro from the Mac App Store. (Image: Screenshot via YouTube)
“We have learned that browser collection functionality was designed in common across a few of our applications and then deployed the same way for both security-oriented as well as the non-security oriented apps such as the ones in discussion. This has been corrected,” PC Mag quotes a statement by Trend Micro.
In a bid to maintain trust among its users, Apple decided to remove all the affected apps of Trend Micro from the Mac App Store. But despite assurance from Trend Micro and Apple, many security experts said they were not too sure anymore about the safety of apps at the Mac Store.
“This does just go to show that the Mac App Store cannot be trusted. I’ve said it multiple times, mostly in regard to all the fake anti-virus programs in the Mac App Store, and this is just further evidence,” CSO quotes Malwarebytes Mac specialist Thomas Reed.
Adware Doctor
Trend Micro apps are not the only ones that have been accused of compromising user’s private data. A very popular app called Adware Doctor was also discovered to be secretly copying its user’s browsing history and sending collected data to a domain based in China. Interestingly, Adware Doctor is the fourth highest “Top Paid” software program on the Mac Store and has been installed on millions of computers.
Adware Doctor was discovered to be secretly copying its user’s browsing history and sending collected data to a domain based in China. (Image: Screenshot via YouTube)
“We tore apart Adware Doctor… [and] our research uncovered blatant violations of user privacy and complete disregard of Apple’s App Store Guidelines… There is rather a massive privacy issue here. Let’s face it, your browsing history provides a glimpse into almost every aspect of your life,” Threat Post quotes Patrick Wardle, chief research officer at Digita Security and founder of Mac security company Objective-See.
The breach of privacy with Trend Micro and Adware Doctor just goes to show how unsafe previously-trusted platforms have now become, and why users have to be careful when installing apps. These applications had several five-star reviews and yet turned out to be involved in data theft. At the very least, users should read through the disclosure statements during app installations no matter how tedious it might be. This should help in blocking out a few shady apps.
Follow us on Twitter, Facebook, or Pinterest
