11 ms·
Proton.B: What this Mac malware does
- Cole_Jontrane 9y agoDoes the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
- js2 9y agoWhich is its own attack vector: https://news.ycombinator.com/item?id=14296959 https://news.ycombinator.com/item?id=14296959
- ecma_horse 9y agoThe problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing. If the user is about to execute a malicious file anyway, then scanning it before only adds protection.
- danieldk 9y agoThe problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.
- hRrrm1 9y ago"scan everything before opening" is not always desirable as it exposes a large attack surface: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- AlexCoventry 9y ago"Avoid running your scan with elevated privileges" could have greatly mitigated this failure. > NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.
- aeontech 9y agoThere is XProtect that warns people about known malware - https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works/ https://www.howtogeek.com/217043/xprotect-explained-how-your... There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves). There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.
- pfranz 9y agoMac OS X Snow Leopard and malware detection https://support.apple.com/en-us/HT202234 https://support.apple.com/en-us/HT202234 Surprised I hadn't heard if this kicked in for Handbrake, but Apple maintains a list of malware (I assume by file hash?). I remember when this went into the OS because there were concerns about legit software being blacklisted.
- kalleboo 9y agoYes Apple has blacklisted the new malware in XProtect.
- ams6110 9y agoI've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website: HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums https://github.com/HandBrake/HandBrake/wiki/Checksums The Affected Download mirror (download.handbrake.fr) has been shutdown for investigation. The Primary Download Mirror and website were unaffected. Downloads via the applications built-in updater with 1.0 and later are unaffected. These are verified by a DSA Signature and will not install if they don't pass. Downloads via the applications built-in updater with 0.10.5 and earlier did not have verification so you should check your system with these older releases
- nerdponx 9y agoIt's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.
- yoodenvranx 9y agoIn KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.
- ReverseCold 9y agoWe need a right click > verify, then user pastes in the hash. It could also be added to the browser.
- grandalf 9y agoIs there a good virus scanner for OSX?
- desdiv 9y ago>The malware obtains the time and date by creating a new environment variable called $hcresult that contains what’s being returned by sending an HTTP request to the Google hosted link by executing this command: >curl -sL https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRbyzS4qMq1VucMVgVvhul5XqS9HkAyJY/exec https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb... What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts on there? What happened to googleusercontent.com?
- ryanlol 9y agoLooks like its getting the current time from the json response. How dare Google distribute the current time?
- wilkystyle 9y agoThe parent comment isn't talking about the payload being returned, it's about what domain Google is hosting user content on.
- deleted 9y ago[deleted]
- whatgoodisaroad 9y agoThe response from script.google.com is a 302 redirect to script.googleusercontent.com. IOW, google.com itself does not serve that user content.
- snowwrestler 9y agoBut why does Google redirect that? Why not just return an error? It's not like users will accidentally type in script.google.com and get mad if it fails. Those script URLs are being used only by app developers, who will test their apps and fix script source URLs that are broken. Calling a googleusercontent script at google.com should return a 4xx status code telling them to use the googleusercontent domain. Google.com is a trusted domain. I don't think it should be 302'ing to untrusted domains for arbitrary URLs.
- simonhamp 9y agoThe standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
- millstone 9y agoI think that's what TouchID is supposed to solve.
- andy_ppp 9y agoYes, should show the users login photo at the very least...
- diamondo25 9y agoAnd maybe dim the background, as wel as giving information about the creator of the application and if its codesigned. oh wait, that was too obtrusive and annoying
- eriknstr 9y agoNot sure if you're being sarcastic about how users feel or about that kind of configuration for UAC, but personally it's one of the many things I dislike when I'm on a Windows computer. For power users it's annoying and disruptive. For users that might benefit the most from it they quickly learn to press ok always whenever they are prompted for something, no matter what it's asking. In my opinion, an ideal OS would have absolutly no confirmation dialogs what so ever, but instead it would have unlimited systemwide undo for any action. Look at Gmail vs Microsoft 360 webmail. One is a pleasure to use, the other a pain in the but. Some of that difference comes from dialogs and extra steps in 360 where GMail instead lets you undo. Add powerful application isolation like in iOS, but make it as simple for the user to pass data between programs as it conceptually is to pipe text from one command to another in Unix, except that you shouldn't have to set up the pipeline first, instead you open a program work on something, pass it to another program work on it and so on. Each program also has an isolated location in the fs for persisting user data but since the only way for one program to access data from another program by the user explicitly sending it over, no application can access something it shouldn't have without the users interaction. So like iOS in that respect also. Of course the user can still be socially engineered into giving some data to a program that shouldn't have it but I don't think it could possibly be worse than what we have today. There are a bunch of other problems and challenges also that I've not gotten around to consider, but I feel that an operating system like the one I described, if open source under an acceptable license (ISC, BSD, MIT or similar preferably) existed, I'd gladly throw away the portability advantages of POSIX in change for it.
- polygot 9y agoThis Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website. Doesn't fix the root cause, but could have caught it much sooner.
- cpncrunch 9y agoDoes anyone actually do that? And what if you have a million files? And what happens within that 30 mins? I guess you could download and check your million files once ever 30 seconds...
- polygot 9y agoWell, you would just check the final download dmg/iso file, and only do it for the first n-versions or so (since those will be the most popular.) The other ones can be checked too, but at a much lower frequency.
- danieldk 9y agoOr you know, just sign the application bundle. macOS has bundle signing for a reason. To make it even better, enable sandboxing for the application as well.
- rco8786 9y agoSo everyone's supposed to maintain heartbeat servers for all their downloadable files now?
- inopinatus 9y ago"Dialog boxes asking for passwords are a very popular social engineering tactic designed to trick users into giving attackers their passwords" Apple is extremely guilty of normalizing the frequent entry of passwords. I recently reinstalled a Mac and an iPad, and for each device I must've entered my Apple ID password seven or eight times. in the normal course of getting things done I then enter either this, or my local login password, many times a week. When your password is twenty characters of line noise or an extended passphrase this is thoroughly irksome, especially on virtual keyboards like the iPad. It is no surprise to me that less security conscious folks, faced with this onslaught of excessive credential demand, choose shorter i.e. easily cracked passwords; and no surprise that everyone becomes less suspicious of the sham password dialog. So when reading of yet another photographic burglary from a cracked iCloud account, we should always lay part of the blame at Apple's feet, for systematically normalizing the frequent entry of credentials. That is not the end of Apple's social engineering enablement shame. Another glaring blunder is in Apple Mail, where the "To:" field is shown with your real name, even when the sender did not include this. The humans respond positively to the use of their given name, so this heightens the verisimilitude of scam messages.
- peckrob 9y agoYup. My Apple password is one of the very few remaining ones that isn't a random string generated by 1Password because Apple makes me enter it all the time. :(
- Mtinie 9y ago"For your protection". I agree, the number of times per week that I somehow end up entering my Apple ID password is egregious. Couple that with the abysmal iCloud/Apple ID/iPhone number conflicts that inevitably show up when you have more than one device. I've spent more hours than I care to remember working on my parents' devices fixing glitchy synchs.
- jasonmp85 9y agoFWIW I use 1pw's diceware generator for any password I might have to enter on iOS, Roku, PS4, etc. Much easier to remember when looking from screen to screen and fewer keyboard shifts.
- onmobiletemp 9y agoWhy were they going after 1password filevaults? I assume 1password is like keypass, where all your passwords are in an encrypted file? How could they decrypt all those files? Or do they assume people use weak passwords?
- danieldk 9y agoAccording to the article this malware also does keylogging. So, presumably, they'll have the vault password as well.
- onmobiletemp 9y agoDerp
- bigiain 9y agoI'm intrigued and curious about why they download your 1Password databases… I wonder if that's speculative - or if offline bruteforcing them works often enough for it to be worthwhile for the malware authors?
- jorvi 9y agoThey're betting on a future weakness being discovered. Sure, it costs them some storage space to sit on these databases in the short run, but if they do get cracked, they hit the absolute motherlode.
- mrcarrot 9y agoThey have all your saved passwords from your web browser, too, and your mac user account's password. I'd guess there's a reasonable amount of people who re-use at least one of those as their 1password master password.
- sxcurry 9y agoJust a reminder when discussing any item with Mac in the title. Please make sure not to make any comments related to the content of the item. Please restrict yourself to noting how bad Apple and Mac are, and how you have spent the last 6 months working full time to build a Huckintosh that almost works except that you have to sacrifice a chicken on the keyboard to get WiFi to work. Extra points if you can reference irrelevant Steve Jobs references.
- dang 9y agoPlease don't do this here. It only makes things worse.
- diimdeep 9y agoI have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing. $ brew cask install handbrake ==> Satisfying dependencies complete ==> Downloading https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg Already downloaded: /Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg ==> Verifying checksum for Cask handbrake ==> Installing Cask handbrake ==> Moving App 'HandBrake.app' to '/Applications/HandBrake.app'. handbrake was successfully installed!
- diimdeep 9y agoHomebrew added new policy https://github.com/caskroom/homebrew-cask/pull/33538/files https://github.com/caskroom/homebrew-cask/pull/33538/files > When updating the `sha256` stanza of an existing Cask, the `version` also has to have changed. Otherwise, the new checksum has to be confirmed by the developer.
- kalleboo 9y agoHomebrew updated their hash to the infected one (differing from the Handbrake download page!), so people who installed using Homebrew got infected too. Do NOT trust homebrew. https://news.ycombinator.com/item?id=14282116 https://news.ycombinator.com/item?id=14282116
- danieldk 9y agoHomebrew Cask distributed the infected Handbrake: https://github.com/caskroom/homebrew-cask/commit/461af7672fa267ed42bd5572c20bf337cb4da87e https://github.com/caskroom/homebrew-cask/commit/461af7672fa... Note that hash 013623e5e50[...] is the infected Handbrake. Even worse, they changed the correct SHA-256 hash to the hash of the malwared Handbrake.
- eecc 9y agoMobile OS security models are bound to land on the desktop soon-ish. What does any random App have to do with anything in ~/Library that is not its own Application Support or .plist preferences? To be honest I don't mind if all Apps are sandboxed with the exception of a couple "user super-user"; I don't really care if my machine's root account is secure if all my horses sitting in $HOME are let loose on the net.
- sleepychu 9y ago> Note: The domains in red were not registered at the time of my research, although they were registered last night by an unknown entity. They seem to be back up domains in case one of the first two stops working. Or they could be domains for checking if you're in a sandbox like WanaCrypt. Why wouldn't you just use 20 well known domains otherwise?
- vels 9y agoIve got handbrake saved in my users application folder So i ran the following in terminal COMMAND : `cd /Applications shasum -a 1 HandBrake-* && shasum -a 256 HandBrake-` and got this response which seems to be blank.. any ideas wether this is saying that i have an infected file or if ive just run the initial terminal command wrong ? RESPONSE : `shasum: HandBrake-: Sams-MacBook-Pro:Applications Sam$ `
- hackerboos 9y agoYou run it against the DMG not the app.