124 ms·
I would be bothered about this. It shouldn't be that hard to include this in the metadata on the filesystem, similar to what Windows does.
by breakingcups 6y ago
I would be bothered about this. It shouldn't be that hard to include this in the metadata on the filesystem, similar to what Windows does.
- pwinnski 6y agoThere is, in fact, a quarantine bit, but that metadata isn't very hard to change for a process that has enough access to a file to run it. `xattr -rc` and you're in. Disclaimer: I've not even begun to really dig into this, beyond reading a few assorted pages like this one: https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/ https://www.sentinelone.com/blog/macos-malware-researchers-h... and this one: https://blog.malwarebytes.com/101/2019/02/macos-protect-malware/ https://blog.malwarebytes.com/101/2019/02/macos-protect-malw...