4 ms·

That's why I'm always hesitant executing .pkg installers. Luckily, the .app in most .pkg files can simply be extracted on the command line using xar.

by andor 6y ago

choeger 6y ago
Maybe this is a stupid question, but what makes you trust the app when you mistrust the installer? Or mistrust the installer when you trust the app? Shouldn't both come from the same more or less trustworthy source?
- bilkow 6y ago
  The installer needs root (admin) permission, which may be abused.
  - pjmlp 6y ago
    Having access to $HOME is already gone enough to produce irrecoverable damage, specially if there is Internet connection.
    - blub 6y ago
      Modern macOS doesn't give access to specific home subfolders to apps.
      - pjmlp 6y ago
        Which not everyone is using, this is only enabled since Catalina.
    - 2cb 6y ago
      To add to blub's response, macOS operates on a permissions system similar to iOS. A new application has to ask permission the first time it tries to access anything in your home folder. Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.
      - pjmlp 6y ago
        Only since Catalina.
    - _qulr 6y ago
      As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "overpackage" their software. For example, Microsoft distributes Edge for Mac with a pkg installer, even though Edge is based on Chromium, and Google just distributes Chrome as a drag and drop app in a dmg. But you can extract the Edge app out of the pkg and just install that, skipping whatever junk Microsoft decides to do in their installer scripts. I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.
      - forgotmypw17 6y ago
        I would consider mandatory "telemetry" to be malware-ish...
- KarlKemp 6y ago
  I believe the .pkg installer usually asks for a password and runs privileged, while moving the app only uses root privilege to move the bundle, but never executes any external code it’s privileges? I’m not sure how relevant the difference is considering most valuable data is owned by the user, but also because MacOS has evolved the security model well beyond the UnIX standard.
aequitas 6y ago
A .app can install a persistent service or alike just as easily as a .pkg. Unless the .pkg is from a untrusted source but the .app is signed. But then again why even install from an untrusted source without signature.
- bilkow 6y ago
  The installer asks for root permission and (I believe) may abuse it, being able to modify system files for example. I also chown + chmod LanchAgents and LauchDaemons in both libraries so that only root may write to it.
2cb 6y ago
There's also a very easy attack vector with pkg installs where an installer can "run software to ensure it's compatible with this machine" that's been there since forever. Not sure if it was removed in Big Sur or not but I hope so. Zoom used that hole to gain admin permissions and install itself before the user even completed the installation process if the user was admin[1] (and we know most people use admin accounts as their main ones). I'm sure plenty of other malware has done this as well. If this was simply delivered as a trojan with one of those fake "Flash Player needs updating" type popups, it could have very well abused that. If it's installing without user interaction the attack vector is a far more advanced 0day exploit chain. I'll be very interested to find out. I am also curious about how they can get away with using AWS and Akamai as C&C. Surely now this malware has been found, those providers will just shut down the accounts being used? They'll also have some kind of trail towards whoever's behind it, it's not like AWS takes payment in crypto. [1] https://twitter.com/c1truz_/status/1244737672930824193 https://twitter.com/c1truz_/status/1244737672930824193
- NateEag 6y ago
  Speculation, but I'd not be at all surprised if the C&C servers are compromised boxes that have other uses.
Toutouxc 6y ago
I like .app a bit more than .pkg, but have no idea whether a .pkg installer without admin rights can actually do anything more than a bunch of shell scripts before and after the installation. Can you link me to an article or a piece of documentation that would explain it to a non-mac-developer?
_qulr 6y ago
A really great app for this is Suspicious Package: https://www.mothersruin.com/software/SuspiciousPackage/ https://www.mothersruin.com/software/SuspiciousPackage/
1over137 6y ago
>Luckily, the .app in most .pkg files can simply be extracted on the command line using xar Or for a GUI option: Pacifist from https://www.charlessoft.com/ https://www.charlessoft.com/

That's why I'm always hesitant executing .pkg installers. Luckily, the .app in most .pkg files can simply be extracted on the command line using xar.

by andor 6y ago

That's why I'm always hesitant executing .pkg installers. Luckily, the .app in most .pkg files can simply be extracted on the command line using xar.

choeger 6y ago

Maybe this is a stupid question, but what makes you trust the app when you mistrust the installer? Or mistrust the installer when you trust the app? Shouldn't both come from the same more or less trustworthy source?

bilkow 6y ago
The installer needs root (admin) permission, which may be abused.
- pjmlp 6y ago
  Having access to $HOME is already gone enough to produce irrecoverable damage, specially if there is Internet connection.
  - blub 6y ago
    Modern macOS doesn't give access to specific home subfolders to apps.
    - pjmlp 6y ago
      Which not everyone is using, this is only enabled since Catalina.
  - 2cb 6y ago
    To add to blub's response, macOS operates on a permissions system similar to iOS. A new application has to ask permission the first time it tries to access anything in your home folder. Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.
    - pjmlp 6y ago
      Only since Catalina.
  - _qulr 6y ago
    As far as "malware" is concerned, there's no reason to trust an app over a pkg. Either one is going to get you. But there are legit companies that definitely "overpackage" their software. For example, Microsoft distributes Edge for Mac with a pkg installer, even though Edge is based on Chromium, and Google just distributes Chrome as a drag and drop app in a dmg. But you can extract the Edge app out of the pkg and just install that, skipping whatever junk Microsoft decides to do in their installer scripts. I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.
    - forgotmypw17 6y ago
      I would consider mandatory "telemetry" to be malware-ish...
KarlKemp 6y ago
I believe the .pkg installer usually asks for a password and runs privileged, while moving the app only uses root privilege to move the bundle, but never executes any external code it’s privileges? I’m not sure how relevant the difference is considering most valuable data is owned by the user, but also because MacOS has evolved the security model well beyond the UnIX standard.

aequitas 6y ago

A .app can install a persistent service or alike just as easily as a .pkg. Unless the .pkg is from a untrusted source but the .app is signed. But then again why even install from an untrusted source without signature.

bilkow 6y ago
The installer asks for root permission and (I believe) may abuse it, being able to modify system files for example. I also chown + chmod LanchAgents and LauchDaemons in both libraries so that only root may write to it.

2cb 6y ago

There's also a very easy attack vector with pkg installs where an installer can "run software to ensure it's compatible with this machine" that's been there since forever. Not sure if it was removed in Big Sur or not but I hope so. Zoom used that hole to gain admin permissions and install itself before the user even completed the installation process if the user was admin[1] (and we know most people use admin accounts as their main ones). I'm sure plenty of other malware has done this as well. If this was simply delivered as a trojan with one of those fake "Flash Player needs updating" type popups, it could have very well abused that. If it's installing without user interaction the attack vector is a far more advanced 0day exploit chain. I'll be very interested to find out. I am also curious about how they can get away with using AWS and Akamai as C&C. Surely now this malware has been found, those providers will just shut down the accounts being used? They'll also have some kind of trail towards whoever's behind it, it's not like AWS takes payment in crypto. [1] https://twitter.com/c1truz_/status/1244737672930824193 https://twitter.com/c1truz_/status/1244737672930824193

NateEag 6y ago
Speculation, but I'd not be at all surprised if the C&C servers are compromised boxes that have other uses.

Toutouxc 6y ago

I like .app a bit more than .pkg, but have no idea whether a .pkg installer without admin rights can actually do anything more than a bunch of shell scripts before and after the installation. Can you link me to an article or a piece of documentation that would explain it to a non-mac-developer?

_qulr 6y ago

A really great app for this is Suspicious Package: https://www.mothersruin.com/software/SuspiciousPackage/ https://www.mothersruin.com/software/SuspiciousPackage/

1over137 6y ago

>Luckily, the .app in most .pkg files can simply be extracted on the command line using xar Or for a GUI option: Pacifist from https://www.charlessoft.com/ https://www.charlessoft.com/