"The Mac-based Adware Doctor is one of the most popular apps in the Mac App Store and the 4th highest-grossing application. Apple positions the Mac Store as the safest place to download Mac software and literally states in its ad copy that “The safest place to download apps for your Mac is the Mac App Store.” A new investigation of the application, however, proved that Adware Doctor did far more than block advertising.
According to Patrick Wardle of Objective-See, who undertook an investigation of the application, Adware Doctor is a capital piece of spyware — and it took Apple more than a month to remove the app from the Mac Store even once Wardle had turned over his findings. He notes that he worked closely with @privacyis1st to compile the report.
While Adware Doctor does indeed contain a malware detection database, when you actually tell it to clean your system, it gets busy… exfiltrating all of your data. It then creates a file to hold this information (history.zip) and contacts its own servers to upload it. It exports your entire browser history, along with data from the App Store and other information. This, it must be noted, should be impossible. Apps downloaded from the App Store are supposed to be immune to this kind of exfiltration. But AD requests permission to access the Home directory (for the purposes of performing a malware scan), which means it’s also been granted permission to perform a whole host of other activities, including gathering your browser history.
There are also some previously unacknowledged holes in Apple’s sandboxing capabilities, given that the malware is able to extract a list of all running processes (Wardle steps through how it accomplishes this). But the larger issue here is that all of this is taking place under Apple’s very nose, in an application that has supposedly been through a rigorous review process, with multiple capabilities that fly directly in the face of Apple’s published rules.
Apps that collect and store data must receive permission to do so. Apps must not trick or force people to reveal information unnecessarily. Developers that use these or similar surreptitious behaviors will have their apps removed from the App Store. Apple did finally remove Adware Doctor from the App Store once this story started to break, but as Wardle notes, he reported his findings to Apple a month ago and was promised a swift response. That response only happened once Apple realized the issue had gone public. In the meantime, every single person who bought or used Adware Doctor in the 30 days since Wardle made the initial report has had their data exfiltrated to China.
The App Store is the safest place to download apps for your Mac. Except, of course, when Apple knowingly distributes for malware for at least a month."
Popular Mac Adware Blocker Found Sending All Browser History to China - ExtremeTech
very app in this group--or should it be a "practice" since they're all doctors?--appeared to steal data in the same way. They looked like legitimate applications, with several of them making best-selling apps lists, then they'd work their way around the sandboxing Apple uses to prevent apps from accessing data they shouldn't. From there, all they had to do was gather and send the browser history.
Of course, this isn't supposed to happen. The whole point of the Mac App Store, much like the iOS App Store, Google's Play Store or their equivalents, is to assure consumers that software downloaded from those marketplaces is safe. Store owners are supposed to vet every app they sell to make sure they aren't secretly gathering personal information.
These problems raise serious questions about the security of software downloaded from the Mac App Store. Apple missed all of these problems while it was vetting these utilities, and the apps' malicious activities largely went unnoticed despite their popularity. Even after security researchers investigated these claims, confirmed their validity and reported the issues to Apple, it took more than a month for Adware Doctor to be removed.