As reported by MacRumors and various other sources, Mac apps that use the Sparkle back-end software to auto-update are potentially vulnerable to a hack attack.
Says MacRumors:
Apps that use a vulnerable version of Sparkle and an unencrypted HTTP channel for server updates are at risk of being hijacked to transmit malicious code to end users. The Sparkle framework is used by apps outside of the Mac App Store to facilitate automatic software updates.
In other words, apps that use the Sparkle back-end over the secure HTTPS are NOT affected. Only those that use HTTP might be.
What it means is that malicious interests can essentially take-over the update routine, offering users hacked apps that might open their system to attack. The user will be unaware because the app will look legitimate. This hasn’t happened yet, and likely will never happen. But it remains a possibility.
You can find out what applications on your system use the Sparkle back-end by opening a Terminal window (you’ll find it in the Utilities folder in the Applications list) and pasting in the following single line command. Potentially affected apps will then be listed:
find /Applications -name Sparkle.framework | awk -F'/' '{print $3}' | awk -F'.' '{print $1}'
This will not distinguish between those that use HTTP or HTTPS, though.
Alternatively, you can use the following command for a more precise scan. It will scan apps for their update server addresses and produce a list of those that use HTTP, and that therefore might be vulnerable. Because URLs are reported you might have to do some detective work to find out what the affected app name is, because the URL will probably be that of the developer rather than one dedicated to the app itself:
for i in /Applications/*/Contents/Info.plist; do defaults read "$i" SUFeedURL 2>/dev/null; done|grep -iv https
If any of the apps you discover using the above command flash-up an update message when you start them (see above for an example of how it might look), be safe and cancel the dialog box. Then head over to the app developer’s website and download the latest version of the app manually.
