Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - Why is your Mac all for sudden using Bing as a search engine? InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Why is your Mac all for sudden using Bing as a search engine?

Published: 2014-10-02
Last Updated: 2014-10-02 21:14:51 UTC
by Johannes Ullrich (Version: 1)
4 comment(s)

Even as a Mac user, you may have heard about Bing, at least you may have seen it demonstrated in commercials [1]. But if your default search engine on your Mac is all for sudden switched to Bing, this may be due to another piece of legacy software that some Mac users may have a hard time living without : Microsoft's Internet Explorer. So why not just search ("google") if there is a version for OSX:

Google Search for "mac internet explorer"

Sure enough, there is a FREE! Internet Explorer for Mac available. Lets download it, and see what happens. 

As it turns out, the page that you are going to download (the usual .dmg file) is signed by a valid Apple developer signature. It will install fine with Maverick's default "gate keeper" setting. Upon installation, it offers a couple additional free product. A "Shopping and Search Helper" as well as some software that will clean your Mac and make it run faster and safer.

In some ways, I have to say I admire how honest the search optimizer is in its EULA. The software will (the original uses all upper case for this section, like shown below):

.. RESET YOUR HOME PAGE AND/OR DEFAULT SEARCH FOR INTERNET EXPLORER, FIREFOX AND CHROME TO TROVI SEARCH...

... BLOCK AND NOTIFY YOU OF ATTEMPTS BY OTHER SOFTWARE TO CHANGE YOUR SELECTED HOME PAGE AND/OR DEFAULT SEARCH...

The Trovi privacy policy is similarly explicit, and not hiding must. The software will collect among other items [2]:

  • IP Address and device identifiers like UDID 
  • web pages you visit and the content you see, access and utilize... 
  • interactions on social networks
  • registration information you provide like name, address, e-mail, phone number, gender birthday

In the end, you end up with a bunch of adware, and , an actual legit version of Internet Explorer 5, which used to run on Mac OS, but doesn't really run on OS X Mavericks. 

For a full walk through see this YouTube video: https://www.youtube.com/watch?v=bVwyxaYJgKY

??

In short: I don't think this software does anything illegal. It clearly advertises what it does. If you feel otherwise, you can file a complaint with courts in Cyprus where the company is located.

[1] https://www.youtube.com/user/bing
??[2] http://info.trovi.com/Privacy

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

Keywords: adware OS X
4 comment(s)
Diary Archives