Fake security software catches out Apple owners Published duration 19 May 2011

image caption The fake software tries hard to look like a legitimate program

A fake security program for Apple computers called MACDefender has racked up a significant number of victims.

Hundreds of people who installed the software have turned to Apple's forums for help to remove it.

The program's tactic of peppering screens with pornographic pictures has made many keen to get rid of it.

MACDefender seems to have been successful because of the work its creators did to make it appear high up in search results.

The number of people seeking help was uncovered by ZDNet journalist Ed Bott. In a blog post, he wrote about finding more than 200 separate discussions on Apple's official forums about MACDefender.

The volume of reports about the problem was "exceptional" in his experience, he said.

The fake Mac anti-virus software, which goes by the name of both MACDefender and Mac Security, began circulating in early May and has steadily racked up victims.

Such programs, often called scareware, urge people to install software that then pretends to scan a machine for security problems. It then fabricates a list of threats it has found and asks for cash before it will fix these non-existent problems.

Graham Cluley, senior technology consultant at Sophos, said the scareware's creators had turned to search engines to get the program in front of potential victims by linking it with innocuous phrases such as "Mother's Day".

"You search for something on Google Images, and when you click on an image you are taken to a webpage which serves up the attack - regardless of whether you are running Mac OS X or Windows," he said.

One trick the software uses to make people cough up cash quicker was to fire up the browser of unattended machines and call up one of several different pornographic websites.

Mr Cluley said the vast majority of malware that Sophos and other security firms see is aimed at Windows users. About 100,000 novel malicious programs for Windows are detected every day, he said.