Slashdot Mirror
MacKeeper Discloses 13 Million Mac Users' Details With Poor Hash Protection (mackeeper.com)
An anonymous reader writes: Mac security software suite MacKeeper is recovering after a hack leaked millions of users' personal information. Kromtech, the software developer, confirmed that it had received notice of the hack yesterday, discovering a hole in its security which was exposing customer usernames, email addresses and other personal data for as much as 13 million users. The hole was patched within a matter of hours after security researcher Chris Vickery had published details of the error over the weekend. Vickery, who had been unfamiliar with both MacKeeper and Kromtech, explained that he had discovered the security fault by browsing the connected devices search engine Shodan.io.
With the amount of "MacKeeper" subterfuge style pop-up ads that appear all over the place, I've always assumed that it was a scam. Kind of like the random calls you get from India saying your Windows machine has a virus - even if you don't use Windows.
FTA:
‘The data was/is publicly available. No exploits or vulnerabilities involved. They published it to the open web with no attempt at protection,’ Vickery wrote in a Reddit post. He noted that Kromtech was alerted and was able to quickly patch the vulnerability.
There was no need for a hack because it was published to the open web!
Peter predicted that you would "deliberately forget" creation 2000 years ago...
This is really big news, 13 million Mac users were gullible enough to buy MacKeeper!
Monstar L
How is MacKeeper Apple's tech? Did I miss something here?
It's certainly not the first data leak from the an Apple platform but MacKeeper has as much to do with Apple as Symantec has to do with Microsoft.
Don't be one of those asshats that blame someone because of what a third party manufacturer fucked up.
I almost mean that. Over the weekend I received a marketing email from our electric utility - Green Mountain Power - detailing their new program to provide Tesla Powerwalls to interested customers as part of a new program.
The problem was instead of blind copying the HUNDREDS OF RECIPIENTS they included all our email addresses in the TO: field exposing our names & addresses to everyone who got the message (in violation of their own Privacy Policies). I replied, basically asking them "WTF?" and wondered if they were as careless with their SCADA systems...
The response I got from one of their marketing droids was classic:
"Thanks so much for your email about our mistake in not bcc’ing our Tesla email list. We are very excited about the offering and made a mistake in the way we communicated with you all with the latest news. I tried to give you a call this afternoon to apologize and chat with you about it.
"Would love to connect, please let me know when might be a good time and way to reach you.
"All the best,
Betsy"
I asked her why on earth I would want to "connect" with her and, well, I haven't heard back... not that I expect to.
My point being - this carelessness, lack of concern about privacy, haphazard security all has led me to all but abandon the web which is depressing considering my job IS, for the most part, web-oriented. Not at home any more. And I'm slowly but surely extricating all my online persona since nobody seems to do it right and I'm tired of preaching about it to people who don't give a shit. And why should they? There are no consequences.
There. I feel much better now.
Which Apple hardware or software was targeted in this case?
Wow, that's a huge number of Mac users. I work as a Mac specialist (have now for over 20 years) and maybe I just do a better job of educating my clients than most, but I would put the number of machines I've actually seen MacKeeper on at under a dozen. Total. Out of many, many hundreds or even thousands of machines I've worked on since it became a threat. That 13 million users would download such an obvious scam is disheartening. Then again, the entire scamware and malware thing wasn't a huge issue on the Mac platform for most of the platform's history. Sure, there were a few things around back in the classic System days, but even those were pretty hard to come by and you didn't encounter them all that often.
That YouPorn has at least 13 million users...
The DB belonged to MacKeeper, which is one of those scam tune-up scareware programs that you get popups for on pirate bay and porn sites. Any of the compromised accounts were already compromised by virtue of being in MacKeepers DB.
with companies like Apple and Microsoft it's often months before they agree to fix and close vulnerabilities. They take Mac security more serious than Apple themselves, which says a lot about Apple...
Ah a court jester who doesn't even know that MacKeeper is basically scamware or garbageware.
I love it when knowledgable people share their comments.
"I am NOT an Apple user" he says --- no kidding!
That's nonsense. It was just some random site that got hacked. The fact that it happens to be associated with a Mac product is irrelevant. If the news was that purplekittens.com got hacked, would you say "It's a good thing that purple kittens are getting attacked like green dogs have been attacked in the past!"?
First line should read
Mac malware vendor Mackeeper
I bet now that you've had time to think about it, you regret this post. But don't! It appears you've won the Duncical Internet Post (DIP) award for Tuesday 15 December. Congratulazioni!
I was trying to download LibreOffice and somehow wound up with MacKeeper. The installation process didn't even tell me what it was. Once I realized it was a scam (which didn't take very long), it was a bitch to get rid of! It has processes that would respawn after they were killed. That's not a good sign, especially for something that isn't essential to system functionality. And it kept starting up on boot-up even if you moved it to the trash. You had to empty the trash and remove some files in Library in order to totally get rid of it.
I'm almost thinking this is a planted story (not on /. part) so they look legit and people keep MacKeeper on their systems. I agree with others, 13 million sounds very high. They have some brass balls!
MacKeeper is scam ware that has been around a long time, its not new.
I'm staggered they got 13 million users
I thought they were some spyware thing. Who the hell is using that?
“He’s not deformed, he’s just drunk!”
It uses immorale advertising tactics to sell itself to people. Says they have viruses when they don't and scares old people.
I've always been told MacKeeper is malware.
Which Apple hardware or software was targeted in this case?
iOS devices running MacKeeper?
Um well least MS fix's their flaw's in a timerly manner. crApple is hard pressed to do it within 2 months most the time. That is WITH the code to fix it within the day of a flaw being found. Flashback virus? Before people say it wasn't a flaw in apple's software, yea it did effect windows as well. But windows had fix the next day and took Apple 8 weeks to release the fix.
Anyone else notice that tons of apps on SourceForge (owned by the same great overlord as /.) are bundling MacKeeper with the installer? Seriously, I've tried to grab a few apps from SourceForge recently only to find the app I'm trying to grab wrapped with some kind of crap-ware installer. Apparently it's wrapped at random and doesn't always happen to everyone. After seeing a few installers that I got from SF fail or never install my app or attempt to connect to the internet (and thankfully able to be stopped by Little Snitch), I did a few google searches to figure out WTF... Apparently SF has been doing this for a while now - and so really, I partially blame them for the fact that so many people have this kind of crap installed on their machines... See the reviews on FileZilla for some reviewers complaining about this very thing.
You originally said: "Apple is starting to gain market share and now they're seeing targeting done towards their hardware and software."
Then you said: "I was speaking more to the fact that people are TARGETING Apple related products more often. Not just Apple software/hardware."
Dumbass.
I'm surprised that there are actually 13 Million MacKeeper users. What the actual...?!?!
Speak for yourself.
Krom is a Dutch word that means 'crooked'. A company calling themselves that, well...
Were because these asshats would prevent me from leaving the web page when I was redirected there...
## ::1 localhost
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
fe80::1%lo0 localhost
127.0.0.1 mackeeperapp.mackeeper.com
127.0.0.1 www.mackeeper.com
Once I was a four stone apology. Now I am two separate gorillas.
His stash disappeared as a result. Total bummer dude!
Didn't they say that Mac users didn't believe Macs would need such tools? So why would they download them if that were the case?
Of course news about a fake are Fake News.