[esusatyo]

Isn't this the time when Mac App Store supposed to shine? When they found something that's dodgy and linked to a company that has apps on App Store, can't they just turn on the kill switch? That way the malware won't have anywhere to direct the users to.

[glhaynes]

It's not clear whether this "adware installer" is signed by a developer cert. I'm gonna guess it isn't, which means under the default settings, if a user double-clicks it to execute it, they'll be presented with a message saying that the app can't be run because it's "from an unknown developer" and the current settings disallow it. The user can get around that by right-clicking it and choosing "Open" (or switching Gatekeeper to be more relaxed), but the error message doesn't allude to this.

Edit: And if it is signed: yes, I believe Apple could and presumably would push out a malware update that would invalidate the cert.

[noondip]

One could easily make an "app" which just runs a shell script with this exploit - no code signing needed.

[taspeotis]

> When they found something that's dodgy and linked to a company that has apps on App Store, can't they just turn on the kill switch? That way the malware won't have anywhere to direct the users to.

If Apple did this you could take down any app from the App Store by writing some malware and making it "advertise" the App Store listing.