Apple removes Trend Micro tools from Mac App Store over “data exfiltration” claims

Trend flatly denies experts’ claims it is stealing user data and sending it to China

Trend Micro website displayed on a smartphone device

A host of anti-malware tools developed by cyber security company Trend Micro have been removed from Apple's Mac App Store.

Six apps including Dr. Cleaner and Dr. Antivirus have disappeared from the Mac App Store after experts, including Malwarebytes Labs' head of Mac Thomas Reed, spotted that user data was needlessly being 'exfiltrated' from these products.

Advertisement - Article continues below

Examining the apps' code, Reed and others also claimed Trend Micro's repertoire of apps was sending data to a server in China based on the fact a domain was registered in the country - a charge Trend Micro flatly denies.

"It's blindingly obvious at this point that the Mac App Store is not the safe haven of reputable software that Apple wants it to be," Reed said.

"I've been saying this for several years now, as we've been detecting junk software in the App Store for almost as long as I've been at Malwarebytes. This is not new information, but these issues reveal a depth to the problem that most people are unaware of."

Apple, having revamped its rules earlier this year to prioritise user privacy, began removing Trend Micro's apps once alerted to the complaints two days ago - with all apps now off the store at the time of writing.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Facebook just last month clashed with Apple over data collection concerns surrounding its controversial Onavo Protect VPN app; voluntarily removing its service from the App Store after talks with the iPhone manufacturer.

Trend Micro denied all claims it was stealing user data and sending them to an unidentified server in China, branding them "absolutely false".

In a post responding to the controversy, the Japanese firm said it completed an investigation into the six apps removed from the Apple Mac Store and concluded they "collected and uploaded a small snapshot of the browser history on a one-time basis".

In a further update, Trend Micro confirmed it had removed the data collection features across the consumer products in question, and permanently dumped legacy logs stored on a US-based AWS server.

Finally, the company identified what it claimed to be a "core issue which is humbly the result of common code libraries", learning the data collection functionality was designed the same across all of its apps regardless of whether this was necessary for the app to work.

Advertisement - Article continues below

"The potential collection and use of browser history data was explicitly disclosed in the applicable EULAs and data collection disclosures accepted by users for each product at installation," the company said.

"The browser history data was uploaded to a U.S.-based server hosted by AWS and managed/controlled by Trend Micro.

"We apologise to our community for concern they might have felt and can reassure all that their data is safe and at no point was compromised."

IT Pro has approached Apple for comment but it had not responded at the time of publication. 

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now
Advertisement

Recommended

Visit/strategy/28185/what-is-data-mining
Business strategy

What is data and big data mining? An easy guide

26 Jun 2020
Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/security/vulnerability/356295/microsoft-patches-high-risk-flaws-that-can-be-exploited-with-a
vulnerability

Microsoft releases urgent patch for high-risk Windows 10 flaws

1 Jul 2020
Visit/laptops/34623/how-to-connect-one-two-or-more-monitors-to-your-laptop-including-usb-type-c
Laptops

How to connect one, two or more monitors to your laptop

29 Jun 2020