3 ms·
Our small shop had to clean up one of these yesterday. It's not hard, for now, but there are all sorts of really neat hidey-holes in MacOS for these kinds of th
by thaumaturgy 15y ago
Our small shop had to clean up one of these yesterday. It's not hard, for now, but there are all sorts of really neat hidey-holes in MacOS for these kinds of things, and so far this piece of malware has been evolving pretty fast. It's changed names three times, and it first started propagating as a fake JavaScript alert on sites that looked like a Windows screen; now there's a pretty reasonable Finder mock-up doing the dirty deed instead.
It doesn't help that there's a setting in Safari to automatically run "safe" downloads.
I'm intensely curious about how far this thing goes. If it were to, say, start hooking into launchctl ... well, that would be interesting indeed.
- cbf 15y agoIt doesn't help that there's a setting in Safari to automatically run "safe" downloads. This feature has always struck me as a cordial invitation from Apple to trick their users via some means or other.
- flomo 15y agoIt used to be worse. Early versions of Safari would automatically execute a shell script as part of a "safe" download. They 'fixed' it by changing the disk image spec rather than the Safari feature. This type of exploit probably reflects how much thought was put into the feature. The "safe download" social engineering attack was outlined years ago, so it's somewhat surprising it took this long to widely exploited.
- kennywinker 15y ago>They 'fixed' it by changing the disk image spec rather than the Safari feature. Which was the right thing to do, by the way. I don't want disk images running shell scripts when they are mounted manually OR automatically.