4 ms·

God dammit. I downloaded this a few days ago and sure enough, I'm infected. What are reasonable mitigation steps to prevent this in the future? I noticed handbr

God dammit. I downloaded this a few days ago and sure enough, I'm infected. What are reasonable mitigation steps to prevent this in the future? I noticed handbrake said it must "install additional codecs" which is mighty odd, but I didn't think much of it at the time. Is there a security product on OSX that would have prevented this?

deleted 9y ago
[deleted]
hughw 9y ago
You can (should) check the SHA hash of the .dmg file you download against the ones here: https://github.com/HandBrake/HandBrake/wiki/Checksums https://github.com/HandBrake/HandBrake/wiki/Checksums
- danieldk 9y ago
  One possibility is that the credentials of one of the developers is obtained. Then this only adds marginal security, since the page with hashes could have been updated as well.
nol13 9y ago
Get a PeeCee.
donatj 9y ago
I downloaded it 3-4 days ago and I don't appear to be infected as far as I can tell but this gives me serious concerns about if I might be in some other way. Sigh.
danieldk 9y ago
Is there a security product on OSX that would have prevented this? Little Flocker. Unfortunately, it was sold to F-Secure [1]. I'm infected Personally, I would wipe the whole system (rather than just removing the malware as in the steps that they describe) and change all credentials (passwords, SSH keys, etc.). [1] https://9to5mac.com/2017/04/06/little-flocker-acquisition/ https://9to5mac.com/2017/04/06/little-flocker-acquisition/
- oceanghost 9y ago
  Ironically-- the reason I didn't have little flocker installed... I had just wiped my machine. When I reinstalled (the reason I redownloaded HB), flocker was on longer available.
rovr138 9y ago
The problem with just nuke & pave, is that you don't know what might be vulnerable. > Further Actions Required > Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores. First take note of everything that might be vulnerable. You need to take care of this too, not just the infection.

deleted 9y ago

[deleted]

hughw 9y ago

You can (should) check the SHA hash of the .dmg file you download against the ones here: https://github.com/HandBrake/HandBrake/wiki/Checksums https://github.com/HandBrake/HandBrake/wiki/Checksums

danieldk 9y ago
One possibility is that the credentials of one of the developers is obtained. Then this only adds marginal security, since the page with hashes could have been updated as well.

nol13 9y ago

Get a PeeCee.

donatj 9y ago

I downloaded it 3-4 days ago and I don't appear to be infected as far as I can tell but this gives me serious concerns about if I might be in some other way. Sigh.

danieldk 9y ago

Is there a security product on OSX that would have prevented this? Little Flocker. Unfortunately, it was sold to F-Secure [1]. I'm infected Personally, I would wipe the whole system (rather than just removing the malware as in the steps that they describe) and change all credentials (passwords, SSH keys, etc.). [1] https://9to5mac.com/2017/04/06/little-flocker-acquisition/ https://9to5mac.com/2017/04/06/little-flocker-acquisition/

oceanghost 9y ago
Ironically-- the reason I didn't have little flocker installed... I had just wiped my machine. When I reinstalled (the reason I redownloaded HB), flocker was on longer available.

rovr138 9y ago

The problem with just nuke & pave, is that you don't know what might be vulnerable. > Further Actions Required > Based on the information we have, you must also change all the passwords that may reside in your OSX KeyChain or any browser password stores. First take note of everything that might be vulnerable. You need to take care of this too, not just the infection.