4 ms·
Apple has revoked the dev certificates to stop further infection: https://www.macrumors.com/2021/02/22/apple-revokes-silver-sparrow-certificates/ https://www.ma
by trollied 6y ago
Apple has revoked the dev certificates to stop further infection: https://www.macrumors.com/2021/02/22/apple-revokes-silver-sparrow-certificates/ https://www.macrumors.com/2021/02/22/apple-revokes-silver-sp...
- tamaharbor 6y agoSo what are they doing about previously infected computers?
- j0hnml 6y agoIf I had to guess, I'd say they will probably roll out new XProtect signatures [1] soon, assuming they haven't done so already for these samples. I also just learned that you can see when the last update was with the following command: ``` system_profiler SPInstallHistoryDataType | grep -A 5 "XProtectPlistConfigData" ``` And then any updates are added to `/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara` (for macOS 11, at least). [1] https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web https://support.apple.com/guide/security/protecting-against-...