{"id":3071,"date":"2016-04-04T12:18:58","date_gmt":"2016-04-04T17:18:58","guid":{"rendered":"http:\/\/www.splasmata.com\/?p=3071"},"modified":"2016-04-04T14:14:30","modified_gmt":"2016-04-04T19:14:30","slug":"macupdate-we-have-a-problem-macupdate-installer-and-the-pua-osx-installcore","status":"publish","type":"post","link":"https:\/\/www.splasmata.com\/?p=3071","title":{"rendered":"MacUpdate, we have a problem: MacUpdate Installer and the PUA.OSX.InstallCore"},"content":{"rendered":"

MacUpdate<\/a>, a very helpful\u00c2\u00a0resource that’s led\u00c2\u00a0users to discover our applications and kept them up-to-date for the last 13 years, has a plan to\u00c2\u00a0make the entire update process easier for users. \u00c2\u00a0When you download from MacUpdate now, you\u00c2\u00a0may\u00c2\u00a0<\/em>receive a MacUpdate Installer disk image, which includes a single application, MacUpdate Installer<\/strong>, that you double-click to install the desired update. \u00c2\u00a0Here’s what you’ll see:<\/p>\n

\"Audiobook<\/a><\/p>\n

This all might<\/em> be easier for some (really?), but it comes with one very concerning\u00c2\u00a0caveat:<\/p>\n

Malware scanners, like ClamXav and Avast, can\u00c2\u00a0report MacUpdate Installer is infected with something named similarly to PUA.OSX.InstallCore<\/strong>.<\/em><\/p>\n

At first glance, this could\u00c2\u00a0send a shiver down your spine. \u00c2\u00a0After all, news outlets have been telling you for 30 years on that infection means your data is at risk, your identity could be stolen, and your bank accounts are about to be drained. \u00c2\u00a0This time around, none of that is\u00c2\u00a0true.<\/strong><\/p>\n

PUA<\/strong>\u00c2\u00a0means Potentially Unwanted Application<\/strong>, and that’s the case\u00c2\u00a0with MacUpdate Installer. \u00c2\u00a0It comes with potentially unwanted software that advertises other products you might be interested in, like much of the rest of today’s\u00c2\u00a0free<\/em><\/strong>\u00c2\u00a0digital experience. \u00c2\u00a0It’s not enough anymore that you trade seconds of your life viewing\u00c2\u00a0ads on MacUpdate itself, you’re craving an extra dose of selling your self while drumming your fingers waiting for that update to install. \u00c2\u00a0Right?<\/strong> \u00c2\u00a0Yeah, didn’t think so.<\/p>\n

And, while PUA.OSX.InstallCore<\/strong>\u00c2\u00a0means something to us, to the average person it still looks an awful lot like their Mac is about to get jacked.<\/strong> \u00c2\u00a0So, last week, when one of our users\u00c2\u00a0reached out to us for some kind of explanation and immediate resolution, thank you very much, we reached out to MacUpdate, in turn. \u00c2\u00a0Here’s how\u00c2\u00a0that went down:<\/p>\n

 <\/p>\n

\n
\n
Hi Keith,<\/div>\n
<\/div>\n
Thank you for providing me with that. I am still not showing on the listing that the installer is present. Either way, the installer is not an “infection” it is used to help users get the app installed instead of it sitting in their downloads folder.<\/div>\n
<\/div>\n
There is nothing harmful about the installer and it is something that we use and create ourselves.<\/div>\n
<\/div>\n
Please let me know if you have any other questions.<\/div>\n
<\/div>\n
Cheers,<\/div>\n
<\/div>\n
Joel<\/div>\n
Content Editor\/Support<\/div>\n
MacUpdate<\/div>\n
<\/div>\n
<\/div>\n
Click this link to view frequently asked questions:\u00c2\u00a0http:\/\/deals.macupdate.com\/faq<\/a><\/div>\n
<\/div>\n
\n

Ticket:\u00c2\u00a0https:\/\/macupdate.freshdesk.com\/helpdesk\/tickets\/23620<\/a><\/p>\n<\/div>\n

<\/div>\n<\/blockquote>\n<\/div>\n
\n

On Fri, 1 Apr at 10:26 AM\u00c2\u00a0, Keith Gugliotto <keithg@splasm.com<\/a>> wrote:<\/p>\n

Hi Joel! \u00c2\u00a0Thanks for getting back to us.<\/div>\n
<\/div>\n
\n

We downloaded ClamXav and only used it to scan the MacUpdate Installer.app on the MacUpdate Installer disk image. \u00c2\u00a0The issue only occurs with the MacUpdate Installer version of the download. \u00c2\u00a0Here\u00e2\u20ac\u2122s a screenshot showing the infection:<\/p>\n

<\/div>\n
\"\"<\/div>\n
<\/div>\n
I\u00e2\u20ac\u2122ve also come across reports that this has happened with other developers\u00e2\u20ac\u2122 applications delivered via MacUpdate Installer.<\/div>\n
\n
\n
<\/div>\n
Keith Gugliotto<\/b><\/div>\n
Primordial Sea Captain<\/i><\/div>\n
keithg@splasm.com<\/a><\/div>\n
http:\/\/www.splasm.com<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
On Apr 1, 2016, at 8:48 AM, Joel L – MacUpdate <support@macupdate.com<\/a>> wrote:<\/div>\n
\n
\n
\n
\n
\n
Hi Keith,<\/div>\n
<\/div>\n
Thanks for reaching out to us. Are you referring to this listing:http:\/\/www.macupdate.com\/app\/mac\/23162\/audiobook-builder<\/a>?<\/div>\n
<\/div>\n
If so, when downloading it I as unable to replicate the issue that you mentioned in the email. Do you have any screenshots of this issue?<\/div>\n
<\/div>\n
Please let me know if you have any other questions.<\/div>\n
<\/div>\n
Cheers,<\/div>\n
<\/div>\n
Joel<\/div>\n
Content Editor\/Support<\/div>\n
MacUpdate<\/div>\n
<\/div>\n
Click this link to view frequently asked questions:\u00c2\u00a0http:\/\/deals.macupdate.com\/faq<\/a><\/div>\n
<\/div>\n


Ticket:\u00c2\u00a0https:\/\/macupdate.freshdesk.com\/helpdesk\/tickets\/23620<\/a><\/div>\n

 <\/p>\n

<\/div>\n<\/div>\n<\/div>\n<\/blockquote>\n
\n

On Tue, 29 Mar at 11:20 AM\u00c2\u00a0, Keith Gugliotto <keithg@splasm.com<\/a>> wrote:<\/p>\n

Topic: Developer Question

Hi there!

We updated our application, Audiobook Builder, yesterday and had a user report ClamXAV says the disk image they downloaded is infected. We tested a download from your site this morning and found the same issue – MacUpdate Installer.app is infected with PUA.OSX.InstallCore. It looks like users of other applications have recently found the same, and that it may be related to how MacUpdate now wraps developer updates with the MacUpdate Installer and presents ads. Is this something you can address?

Thanks for your help!

Keith Gugliotto
Primordial Sea Captain
Splasm Software

—
Member Information:
Name: Keith Gugliotto
Username:\u00c2\u00a0
Email:\u00c2\u00a0keithg@splasm.com<\/a>

System Information:\u00c2\u00a0
Browser: Safari 9.1
OS: OS X 10.11
MacUpdate Desktop Version #:\u00c2\u00a0
—
This e-mail was sent from the contact form on MacUpdate Support<\/div>\n<\/blockquote>\n<\/div>\n<\/div>\n<\/div>\n<\/blockquote>\n<\/div>\n<\/blockquote>\n<\/div>\n

 <\/p>\n

So, the official word from MacUpdate is\u00c2\u00a0MacUpdate Installer is intended to be helpful.<\/strong> \u00c2\u00a0We can’t\u00c2\u00a0argue with\u00c2\u00a0good intentions.\u00c2\u00a0 Simply opening a disk image and copying the included application to the Applications folder may be harder than using MacUpdate Installer and sitting through an advertisement. \u00c2\u00a0With the range of experience levels out there, who knows? \u00c2\u00a0What matters right now, though, is\u00c2\u00a0if you read between the lines, MacUpdate\u00c2\u00a0isn’t\u00c2\u00a0planning\u00c2\u00a0to do anything about how some folks\u00c2\u00a0out there may experience\u00c2\u00a0that dreadful shiver I mentioned earlier when they\u00c2\u00a0perceive\u00c2\u00a0PUA.OSX.InstallCore is\u00c2\u00a0a bona fide threat to their data, identity, and finances. \u00c2\u00a0Causing users any kind distress is not cool with us.<\/strong><\/p>\n

I’m gonna throw\u00c2\u00a0http:\/\/www.macintouch.com\/readerreports\/security\/topic4743-013.html into the mix. \u00c2\u00a0Search for “MacUpdate” on that page and you’ll find it occurs 82 times, with some pretty clear indications\u00c2\u00a0this\u00c2\u00a0isn’t just\u00c2\u00a0our imagination\u00c2\u00a0– others aren’t really taking to MacUpdate Installer, either. \u00c2\u00a0Alarm, disgust, distrust.<\/strong> \u00c2\u00a0All reactions you want associated with your brand, right?<\/p>\n

Joel is right about one thing, though.<\/strong> \u00c2\u00a0We can’t get the Audiobook Builder update from MacUpdate to come down as the MacUpdate Installer disk image we saw last Tuesday. \u00c2\u00a0Was it a fluke? \u00c2\u00a0Seems doubtful. \u00c2\u00a0 \u00c2\u00a0But, as long as our users are getting\u00c2\u00a0the original disk image from us when they click the Download button at MacUpdate, we’ll continue to release our updates there. \u00c2\u00a0If that changes,<\/strong> or if it becomes clear they’re spot testing, delivering the original disk image in some cases and the MacUpdate Installer disk image in others, we’ll likely have to break up with MacUpdate.<\/p>\n

Here’s hoping MacUpdate\u00c2\u00a0updates\u00c2\u00a0MacUpdate Installer so that it doesn’t trip alarms in common malware scanners, or they get in touch with those malware scanner developers to see if they can prevent\u00c2\u00a0MacUpdate Installer from being called out as truly infected. \u00c2\u00a0Either way works for us. \u00c2\u00a0As long as they save users from the anxiety of imagining their digital life might go up in smoke, we’re cool.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

MacUpdate, a very helpful\u00c2\u00a0resource that’s led\u00c2\u00a0users to discover our applications and kept them up-to-date for the last 13 years, has a plan to\u00c2\u00a0make the entire update process easier for users. \u00c2\u00a0When you download from MacUpdate now, you\u00c2\u00a0may\u00c2\u00a0receive a MacUpdate Installer … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,1,7],"tags":[],"class_list":["post-3071","post","type-post","status-publish","format-standard","hentry","category-audiobook-builder","category-general","category-opinion"],"_links":{"self":[{"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/posts\/3071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3071"}],"version-history":[{"count":16,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/posts\/3071\/revisions"}],"predecessor-version":[{"id":3088,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=\/wp\/v2\/posts\/3071\/revisions\/3088"}],"wp:attachment":[{"href":"https:\/\/www.splasmata.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3071"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3071"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.splasmata.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}