4 ms·

I thought myself fairly well informed about macOS, having run it since the 10.1 days, administering it over the years, etc. But TIL that the quarantine bit and

by js2 7y ago

I thought myself fairly well informed about macOS, having run it since the 10.1 days, administering it over the years, etc. But TIL that the quarantine bit and gatekeeper which normally prevent unauthorized executables from running is trivially bypassed, as was the case in this attack. My paranoia level has increased. https://objective-see.com/blog/blog_0x43.html https://objective-see.com/blog/blog_0x43.html https://speakerd.s3.amazonaws.com/presentations/9e724ea233434f9fb083bff26bc7fb4b/ShmooCon_2016.pdf https://speakerd.s3.amazonaws.com/presentations/9e724ea23343... Yeesh.

ultrarunner 7y ago
I just checked my login items and found runChmm, adware that was apparently installed as part of an FTP client used at work. I was trying to replicate a scenario we see at work and got adware. Paranoia level increased indeed.
asveikau 7y ago
> gatekeeper ... is trivially bypassed It's almost as if they waste a legit user's time, and developer's nominal fees on certs, notary, etc., for something that malware will not actually be subject to. Maybe that's a little disingenuous as Apple can work to close gaps, holes and bugs.... But when it doesn't actually stop malware in the real world and honest people need to jump through hoops, the cynic's reading is easy to make. Similar discussion to be had around DRM.