42 ms·
What a silly title. It may not have some active payload right now, but that doesn't mean it won't tomorrow. Seems like a reasonable strategy to spread the malwa
by beervirus 6y ago
What a silly title. It may not have some active payload right now, but that doesn't mean it won't tomorrow. Seems like a reasonable strategy to spread the malware as wide as possible, then push an update to trigger whatever behavior you want. And yes, it does check for updates.
> Every hour, the persistence LaunchAgent tells launchd to execute a shell script that downloads a JSON file to disk, converts it into a plist, and uses its properties to determine further actions.
https://redcanary.com/blog/clipping-silver-sparrows-wings https://redcanary.com/blog/clipping-silver-sparrows-wings
- Wowfunhappy 6y agoBut no one knows what the payload will do. I thought the title was fine.
- ASalazarMX 6y agoA more honest title would have ended with "no one knows what for".
- beervirus 6y agoI guess that’s right. I was reading the title as “no one know why they bothered infecting these computers with a virus that doesn’t do anything.”
- 0x008 6y ago> In short, it doesn’t do anything. That’s not all that reassuring, given that tens of thousands of Macs could have potentially been infected, but based on the findings and investigations of multiple strains, the virus was “positioned to deliver a potentially impactful payload at a moment’s notice.” Was the article changed after your comment?
- learnstats2 6y ago> In short, it doesn’t do anything. > “positioned to deliver a potentially impactful payload at a moment’s notice.” In my view, these are contradictory statements. It hasn't done anything (according to evidence at the time of writing) is not the same as it doesn't do anything.