Apple users have been dealing with a bad bout of malware over the last few weeks ironically called Mac Defender. Its modus operandi involves scaring the Apple user with claims of malware in a phony file browser and giving them a magical option to remove all problems. That option is actually the malware, but since the users are convinced they are downloading anti-malware they will often allow it to happen and provide their admin password. At that point, they are prompted to provide their credit card number to actually remove the now-present infection. Apple was actively quiet about the whole experience but has now gone vocal about the experience. Also, a new revision of Mac Defender just got substantially harder to avoid.

 
The most insecure part of your computer.
 
Apple received criticism recently for demanding that their technical support staff would not be able to assist customers suffering from the Mac Defender bug. That stance was apparently leading up to a recent announcement from Apple for how to remove Mac Defender and its known variants as well as a promise to release a software update which will remove and prevent clean users from installing known variants of the malware. This was then offset by the news that a more recent version of Mac Defender, known as Mac Guard, can install without requiring the input of the admin password.
 

It should be noted that admin password or not; Apple or not; patch or not; this form of malware strikes the most vulnerable point of any system: the user’s complacency. It does not matter how good of an antivirus solution you have, or how protected your operating system and programs are (though in many cases both of those are lacking as well) you need to be cautious about what you do with any device that accepts information that is not yours. Food for thought: software that can jailbreak an iPhone steal admin privileges from Apple and give it to you. Even in a locked down system such as an iPhone where the user does not have admin rights, what would have happened had you not been the recipient of the admin privileges?