{"id":38860,"date":"2015-03-23T16:15:07","date_gmt":"2015-03-23T23:15:07","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=38860"},"modified":"2015-03-23T16:15:07","modified_gmt":"2015-03-23T23:15:07","slug":"inside-the-ask-toolbar-installed-with-java-for-mac","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/inside-the-ask-toolbar-installed-with-java-for-mac\/","title":{"rendered":"A Look Inside the Ask Toolbar Installed with Java for Mac"},"content":{"rendered":"

\"Java<\/a><\/p>\n

It’s back!\u00a0And it’s likely here\u00a0to stay. A few weeks ago,\u00a0Intego\u00a0pointed out\u00a0that Mac users were no longer being\u00a0offered to install the Ask toolbar during the installation of Java for Mac<\/a>.\u00a0At that time, the Ask toolbar had mysteriously disappeared\u00a0from Java installations.<\/p>\n

We suspect that, due to media backlash, Oracle temporarily suspended the process that allows the JRE installer to install the Ask toolbar\u2014depending on a country check. Intego was able to reproduce the Ask installation with the Java 8 Update 40 available on Java.com, at the following URL:<\/p>\n

http:\/\/java.com\/en\/download\/mac_download.jsp?locale=en<\/p>\n

We have discovered that the JRE installer does a country check through http:\/\/rps-svcs.sun.com\/services\/countrylookup<\/a> to determine if the Ask toolbar needs to be activated, using a server hosted by Akamai.<\/p>\n

\"JRE<\/a><\/p>\n

Intego researchers believe that the Ask toolbar is activated and promoted during Java installations depending on the user location. If a user is located in France, for example, he or she will not get the offer, while a U.S. customer will receive it.<\/p>\n

\"Java<\/a><\/p>\n

The Ask toolbar is deployed through a framework, Sponsors.framework<\/strong>, and downloaded during the Java installation. This framework is installed in ~\/Library\/Application Support\/ of the user\u2019s Home folder.<\/p>\n

\"The<\/a><\/p>\n

In all cases, the Ask toolbar components are silently installed regardless of country location, even if the user was\u00a0not prompted to activate the offer. We found that, for French Mac users, the Sponsors.framework gets installed in OS X after running the Java installer and without any Ask offer notifications. We would not be surprised if the offer is extended in the\u00a0near future through an auto update.<\/p>\n

Inside this framework, the APNSetup.app<\/strong> is responsible for setting the Ask toolbar in the relevant browsers. The APNSetup.app targets the user\u2019s default browser (Ask.com options can differ depending on the user\u2019s browser version).<\/p>\n

Java and Ask Toolbar Installation Process<\/h3>\n

At the beginning of the installation process, the Java installer creates a temporary helper,\u00a0com.oracle.JavaInstallHelper, in \/Library\/PrivilegedHelperTools\/.<\/p>\n

\"Java<\/a><\/p>\n

It appears to set Java specific components (such as\u00a0\/Library\/Internet Plug-Ins\/JavaAppletPlugin.plugin) and it sets privileges. This helper is deleted when installation is complete, and it does not appear\u00a0to have any relation with the Ask toolbar setup.<\/p>\n

There are difference scenarios in which Mac users may receive the Ask toolbar during Java installations. These are as follows:<\/p>\n

Scenario 1: Safari as the default browser<\/strong><\/p>\n

If the user is detected to be located in the United States, the Java installer displays a panel to set the Search App by Ask.<\/p>\n

Safari users can uncheck \u201cSet Ask.com as my browser homepage.\u201d<\/p>\n

\"Installing<\/a><\/p>\n

When the Java installation is complete, the Java installer redirects the user to the Java website. Safari instantly prompts to install an extension.<\/p>\n

\"Safari<\/a><\/p>\n

If the user does not uncheck anything and allows the extension, both the homepage is set to Ask.com and the Ask toolbar is installed.<\/p>\n

The Ask toolbar displays a Hide button, which effectively hides it.<\/p>\n

\"Safari<\/a><\/p>\n

Scenario 2: Firefox as default browser<\/strong><\/p>\n

If the user is detected to be located in the United States, the Java installer displays a panel to set the Search App by Ask.<\/p>\n

The user can uncheck \u201cSet Ask.com as my default search provider\u201d and \u201cSet Ask.com as my browser home page and new tabs page.\u201d<\/p>\n

\"Install<\/a><\/p>\n

When the Java installation is complete, the Java installer redirects the user to the Java website. Firefox prompts to restart in order to finish the installation.<\/p>\n

\"Firefox<\/a><\/p>\n

After restart, Firefox notifies to install new add-ons and the user can allow or disallow the installation. Firefox has to be restarted again.<\/p>\n

\"Firefox<\/a><\/p>\n

If the user does not uncheck anything and allows the extension, both the homepage is set to Ask.com and the Ask toolbar is installed.<\/p>\n

\"Firefox<\/a><\/p>\n

Scenario 3: Chrome as the default browser<\/strong><\/p>\n

If the user is detected to be located in the United States, the Java installer displays a panel to set the Search App by Ask.<\/p>\n

Chrome users can uncheck \u201cAdd the Search App By Ask.\u201d<\/p>\n

\"Install<\/a><\/p>\n

When the Java installation is complete, the Java installer redirects the user to the Java website. Chrome prompts to restart in order to complete the installation.<\/p>\n

\"Chrome<\/a><\/p>\n

If the user does not uncheck anything and allows the extension, both the homepage is set to Ask.com and the Ask toolbar is installed.<\/p>\n

The Ask toolbar displays a Hide button, which effectively hides it.<\/p>\n

\"Chrome<\/a><\/p>\n

How to Get Rid of the Ask Toolbar<\/h3>\n

It is important to note that, regardless of the user\u2019s country location, the Java installation will download the Sponsors.framework and install it. We believe that the Ask toolbar may be activated in future auto-updates without having to run the Java installation. This means that if the Ask toolbar offer is disabled when installing the Java update, the framework still gets updates silently if already installed. (The user would not need to update Java to get the Ask toolbar; it is still there silently.)<\/p>\n

Intego VirusBarrier<\/a> protects Mac users against the Ask toolbar extensions for Safari and Firefox, detected as\u00a0OSX\/AskToolbar<\/strong>. Unfortunately, we are unable to block the toolbar for Chrome without destroying the Chrome database; therefore, Chrome users will need to uninstall the Ask toolbar manually. Google Chrome users can head over to\u00a0the Chrome support page for help\u00a0uninstalling\u00a0extensions<\/a>, which includes the Ask toolbar.<\/p>\n","protected":false},"excerpt":{"rendered":"

It’s back!\u00a0And it’s likely here\u00a0to stay. A few weeks ago,\u00a0Intego\u00a0pointed out\u00a0that Mac users were no longer being\u00a0offered to install the Ask toolbar during the installation of Java for Mac.\u00a0At that time, the Ask toolbar had mysteriously disappeared\u00a0from Java installations. We suspect that, due to media backlash, Oracle temporarily suspended the process that allows the JRE […]<\/p>\n","protected":false},"author":4,"featured_media":9921,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[5,11],"tags":[323,2044,2038,75,2080,174,183,2041,2032,2083],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n