2 ms·
That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure abo
by kitsunesoba 11y ago
That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.
- joosters 11y agoJust put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.
- kitsunesoba 11y agoUnless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.
- crazysim 11y agoI thought Gatekeeper only applies to GUI launched programs?