Apple’s latest macOS version Big Sur will no longer allow user profiles to be installed on Macs without user consent
Adware is one of the biggest pests for PC and laptop users and perhaps a bigger threat for macOS powered PCs and MacBooks. At its World Wide Developer Conference (WWDC) last month, Apple said it would remove a feature that had allowed profiles to be installed via the command line without user input or interaction.
Adware makers abused this particular feature to access servers used to deploy Mac systems across an organization to install malicious profiles without any user interaction. Once the profile was installed, the adware would run amok on the macOS run PC/laptop.
Apple has decided to stop this abuse. In the next macOS release, Big Sur, profiles are to be treated as downloads, with users required to complete installation manually.
Adware has been a malaise for Apple Mac users. Last year, an Adware called NewTab was the single most prevalent type of malware on Macs according to Malwarebytes. The user profile allowed adware and potentially unwanted programs (PUPs) to be installed without macOS owner’s knowledge or consent.
Malwarebytes said earlier this year it had detected 30 million adware installations on Macs in 2019, compared to 24 million on Windows.
The surge in adware helped push the Mac platform past Windows for the total number of threats detected per endpoint last year, with Malwarebytes detecting 11 threats per endpoint on Macs and 5.8 per endpoint on Windows – although the firm noted that Windows threats tended to be more serious.
“The average number of threats detected on a Mac is not only on the rise but has surpassed Windows – by a great deal,” Malwarebytes said in its study.
Apple has done EXACTLY what I was hoping they would do to cope with the plague of adware installing malicious configuration profiles! In Big Sur, it will no longer be possible to install these profiles via the command line, or in any way without explicit user consent! 🤩 pic.twitter.com/di3xFutozs
— Thomas Reed (@thomasareed) June 23, 2020
The security researchers have appreciated Apple’s change in security policy in Big Sur. Thomas Reed, director of Mac and Mobile at security firm Malwarebytes noted that profile installation would now require “explicit user consent”, making it far more difficult for attackers to carry out such attacks.