5 ms·
I'm a bit surprised at the "personalized attention" from the attacker: that a human on the other end takes time to poke around individual machines, recognize th
by masto 9y ago
I'm a bit surprised at the "personalized attention" from the attacker: that a human on the other end takes time to poke around individual machines, recognize the developer, and tailor a source code theft + ransom campaign to them. I had assumed that these are bulk compromises of at least thousands of machines and they just blast out scripts to turn them into spam proxies or whatever.
Maybe given the limited scale of this one and the obvious interest the attacker has in producing trojaned versions of popular software, this is actually what they were hoping for in the first place.
- wlesieutre 9y agoIt might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.
- kccqzy 9y agoThis makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement? Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.
- lloeki 9y agoAlternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).
- deleted 9y ago[deleted]
- j_s 9y agoGood idea! Talk to this guy: https://objective-see.com/products.html https://objective-see.com/products.html
- sneak 9y agoIt's called Little Flocker. Essential OSX software. Looks like F-Secure just bought it in the last month or two. :(
- watson 9y agoIn this case the attacker actually guessed the names of the git repos based on knowlege that the owner of the attacked computer was a Panic employee. The attacker guessed the repo names was Panic software names. So it was a very manual process indeed
- kingosticks 9y agoYeh sure, but possibly (probably?) after an automated process shifted through all the victims looking for what's described above. Once you've got a shortlist of potentially more valuable targets you can invest manual efforts on those.
- matt4077 9y agoEven the Mac's malware authors are more hands-on, engaged, and approachable :)
- draw_down 9y agoStandard practice in lead-generation these days :) You want to devote your efforts to the most potentially-rewarding opportunity.