5 ms·

It might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or chec

It might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.

kccqzy 10y ago
This makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement? Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.
- lloeki 10y ago
  Alternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).
  - deleted 10y ago
    [deleted]
- j_s 10y ago
  Good idea! Talk to this guy: https://objective-see.com/products.html https://objective-see.com/products.html
- sneak 10y ago
  It's called Little Flocker. Essential OSX software. Looks like F-Secure just bought it in the last month or two. :(
watson 10y ago
In this case the attacker actually guessed the names of the git repos based on knowlege that the owner of the attacked computer was a Panic employee. The attacker guessed the repo names was Panic software names. So it was a very manual process indeed
- kingosticks 10y ago
  Yeh sure, but possibly (probably?) after an automated process shifted through all the victims looking for what's described above. Once you've got a shortlist of potentially more valuable targets you can invest manual efforts on those.

kccqzy 10y ago

This makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement? Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.

lloeki 10y ago
Alternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).
- deleted 10y ago
  [deleted]
j_s 10y ago
Good idea! Talk to this guy: https://objective-see.com/products.html https://objective-see.com/products.html
sneak 10y ago
It's called Little Flocker. Essential OSX software. Looks like F-Secure just bought it in the last month or two. :(

watson 10y ago

In this case the attacker actually guessed the names of the git repos based on knowlege that the owner of the attacked computer was a Panic employee. The attacker guessed the repo names was Panic software names. So it was a very manual process indeed

kingosticks 10y ago
Yeh sure, but possibly (probably?) after an automated process shifted through all the victims looking for what's described above. Once you've got a shortlist of potentially more valuable targets you can invest manual efforts on those.