Apple is improving this situation with macOS Mojave, but the App Store review process should have caught these practices and rejected the apps for violating the user’s privacy. Users do not expect sandboxed apps to get this level of access to their systems, but it is important to note that when an open file dialog is opened by a sandboxed app, if you use it to open your home directory, the app can potentially get access to lots of private information including browsing history, iMessage conversations, e-mail messages and more. This is a massive privacy issue and we expect Apple to pull these apps from the Mac App Store fairly quickly. Unarchiver” is the nº 12 most popular free app in the US Mac App Store. Inspecting the files the app archives and uploads to their servers revealed the full browser history for Safari, Google Chrome and Firefox, separate files specifically dedicated to storing the user’s recent Google searches on the same browsers and a file containing a complete list of all apps installed on the system, including information about where they were downloaded from, whether they are 64-bit compatible and their code signature.Īs of today, “Dr. After allowing access to the home directory, the app proceeded to collect the private data and upload it to their servers (we blocked that with a proxy). Selecting “Scan” launched an open dialog with the home directory selected, this is how the app gets access to a user’s home directory, which it needs in order to collect the history files from browsers. After extracting a zip file with the app, it offered an option to “Quick Clean Junk Files”. We were able to confirm these reports, at least with the Dr. All of this information is collected upon launching the app, which then creates a zip file and uploads it to the developer’s servers. The app will also collect information about other apps installed on the system.

Other researchers followed up and found that apps distributed by this “Trend Micro, Inc.” account on the Mac App Store collect and upload the user’s browser history from Safari, Google Chrome and Firefox to their servers. This issue was reported before by a user on the Malwarebytes forum, and in another report. Today, we’re talking specifically about the apps distributed by a developer who claims to be “Trend Micro, Inc.”, which include Dr.

It looks like we’re seeing a trend of Mac App Store apps that convince users to give them access to their home directory with some promise such as virus scanning or cleaning up caches, when the true reason behind it is to gather user data – especially browsing history – and upload it to their analytics servers. When you give an app access to your home directory on macOS, even if it’s an app from the Mac App Store, you should think twice about doing it.

Dr cleaner pro mac site