MacUpdate, we have a problem: MacUpdate Installer and the PUA.OSX.InstallCore

MacUpdate, a very helpful resource that’s led users to discover our applications and kept them up-to-date for the last 13 years, has a plan to make the entire update process easier for users.  When you download from MacUpdate now, you may receive a MacUpdate Installer disk image, which includes a single application, MacUpdate Installer, that you double-click to install the desired update.  Here’s what you’ll see:

This all might be easier for some (really?), but it comes with one very concerning caveat:

Malware scanners, like ClamXav and Avast, can report MacUpdate Installer is infected with something named similarly to PUA.OSX.InstallCore.

At first glance, this could send a shiver down your spine.  After all, news outlets have been telling you for 30 years on that infection means your data is at risk, your identity could be stolen, and your bank accounts are about to be drained.  This time around, none of that is true.

PUA means Potentially Unwanted Application, and that’s the case with MacUpdate Installer.  It comes with potentially unwanted software that advertises other products you might be interested in, like much of the rest of today’s free digital experience.  It’s not enough anymore that you trade seconds of your life viewing ads on MacUpdate itself, you’re craving an extra dose of selling your self while drumming your fingers waiting for that update to install.  Right?  Yeah, didn’t think so.

And, while PUA.OSX.InstallCore means something to us, to the average person it still looks an awful lot like their Mac is about to get jacked.  So, last week, when one of our users reached out to us for some kind of explanation and immediate resolution, thank you very much, we reached out to MacUpdate, in turn.  Here’s how that went down:

So, the official word from MacUpdate is MacUpdate Installer is intended to be helpful.  We can’t argue with good intentions.  Simply opening a disk image and copying the included application to the Applications folder may be harder than using MacUpdate Installer and sitting through an advertisement.  With the range of experience levels out there, who knows?  What matters right now, though, is if you read between the lines, MacUpdate isn’t planning to do anything about how some folks out there may experience that dreadful shiver I mentioned earlier when they perceive PUA.OSX.InstallCore is a bona fide threat to their data, identity, and finances.  Causing users any kind distress is not cool with us.

I’m gonna throw http://www.macintouch.com/readerreports/security/topic4743-013.html into the mix.  Search for “MacUpdate” on that page and you’ll find it occurs 82 times, with some pretty clear indications this isn’t just our imagination – others aren’t really taking to MacUpdate Installer, either.  Alarm, disgust, distrust.  All reactions you want associated with your brand, right?

Joel is right about one thing, though.  We can’t get the Audiobook Builder update from MacUpdate to come down as the MacUpdate Installer disk image we saw last Tuesday.  Was it a fluke?  Seems doubtful.    But, as long as our users are getting the original disk image from us when they click the Download button at MacUpdate, we’ll continue to release our updates there.  If that changes, or if it becomes clear they’re spot testing, delivering the original disk image in some cases and the MacUpdate Installer disk image in others, we’ll likely have to break up with MacUpdate.

Here’s hoping MacUpdate updates MacUpdate Installer so that it doesn’t trip alarms in common malware scanners, or they get in touch with those malware scanner developers to see if they can prevent MacUpdate Installer from being called out as truly infected.  Either way works for us.  As long as they save users from the anxiety of imagining their digital life might go up in smoke, we’re cool.