8

I was away from the computer when this popup appeared and I've no idea what triggered it. How do I know if it's legitimate popup from App Store or a phishing attempt by some malware?

Back in my WindowsNT days I would be prompted to press CTRL+ALT+DEL which is intercepted in the kernel and always opens system password prompt, so it's more secure.

prompt screenshot

4
  • 1
    I'm guessing first step would be to identify process that has created the window. I've found and built developer.apple.com/library/mac/samplecode/SonOfGrab/…. SonOfGrab identified process as "storeuid". "ps aux" lists this process with path /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid. There's also python script to investigate window: blog.loudhush.ro/2014/04/…. I was hoping for something more convenient. – Wojtek Kruszewski Oct 23 '15 at 10:11
  • you will need to analyse the network activities of your machine (netstat ?) and it processes (ps ... ?) – user45139 Oct 23 '15 at 10:13
  • I do not think you can: OSX has no concept of secure desktop so, as a user, you pretty much have no choice but try to guess, based on your activity, if the prompt is expected or not. – Stephane Oct 23 '15 at 10:13
  • These are appearing more as additional apps get integrated into iCloud. You may have a background process for iTunes signing in to download album artwork or FaceTime may be communicating with the server regardless of your actual use thereof. GateKeeper, App store, SIP should prevent malware... but who knows ultimately? I hope someone can answer this too! – Dave Oct 23 '15 at 18:03
2

The safest thing to do would be to cancel that popup and then select app store from the main menu and if it prompts for your ID, you can enter it. OSX will then cache this information. Unless your system has been so compromised that the app store app has been hacked, this should be safe.

More than likely, the reason this popup has occurred is because your OSX has detected there are updates to be applied. However, you have not signed in and therefore it cannot connect to the app store to download the update. One way you could verify this is to cancel the popup and then select updates from the app store and see if there are some updates waiting to be applied.

1
  • Indeedy. And applies to prompts like this in general. If you didn't initiate it, cancel/exit/close/quit out. – user79537 Oct 25 '15 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.