Software download might be a hack

Question

Hey All,
Recently had an issue not sure i have the right place to post this but sadly mac has failed to get me to the right people to discuss it.
2 weeks ago i had a software update I did it and the (mac app) icon appeared I browsed the apps 4 in all and didn't like anything i saw, that said within a week my bank called and notified me that there were 2 0 balance purchases for mac apps and 4 fraud purchases on my card totaling 1900.00 to a place called kitbag in Middleton UK , the bank stopped the purchases and gave me back the money but mac could not get me to the right dept. to notify them and explain it..anyone else have an issue or who do i call

Answer 1

Whether there's a connection here, I don't know.
Not much to go on here, and there are many possible triggers.
[Here is the generic Apple security statement|http://www.apple.com/macosx/security>.
There are various bits of malware which can and do target Mac OS X and Mac OS X Server boxes.
I'd be surprised if an Apple software update caused this. It's conceivable that a malware web site or a compromised web site caused this, or that there's some third-party app that did this, or that there's some local configuration vulnerability, or a network-level vulnerability, or that there was a weak password or an exposed password. While there have been cases of trojan horses reported for Apple application software, these compromised products were reportedly not downloaded from Apple servers, but rather from third-party sites.
As for support for investigating the trigger here, asking for somebody to review and determine if your box has been breached is not a small project. I've done a few of these reviews for customers, and it can take a day or three of serious effort to figure out what happened, and to make a reasonable guess as to how far the attacker got within the operating system. That's a whole pile of work, too. And it's not at all clear that there was a breach within your operating system.
[Here is a general write-up on recovering from a server breach|http://labs.hoffmanlabs.com/node/1214]; you're probably running Mac OS X client here, so not all of that material will apply to you.
This forum probably won't have the best audience for your questions, for that matter. This is the Mac OS X Server 10.5 (Leopard Server) Open DIrectory (LDAP) forum, and your question is the first potential security breach with associated credit card exposures that I've seen posted here.