Proton.B: What this Mac malware does
cybereason.com
Proton.B: What this Mac malware does
1–10 of 94 posts
Re: Proton.B: What this Mac malware does
#2Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
Re: Proton.B: What this Mac malware does
#3I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website:
HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums
The Affected Download mirror (download.handbrake.fr) has been shutdown for investigation.
The Primary Download Mirror and website were unaffected.
Downloads via the applications built-in updater with 1.0 and later are unaffected. These are verified by a DSA Signature and will not install if they don't pass.
Downloads via the applications built-in updater with 0.10.5 and earlier did not have verification so you should check your system with these older releases
Re: Proton.B: What this Mac malware does
#4Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
Which is its own attack vector:
Re: Proton.B: What this Mac malware does
#5Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
"scan everything before opening" is not always desirable as it exposes a large attack surface:
https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
Re: Proton.B: What this Mac malware does
#6Is there a good virus scanner for OSX?
Re: Proton.B: What this Mac malware does
#7Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
There is XProtect that warns people about known malware - https://www.howtogeek.com/217043/xprotect-explained-how-your...
There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves).
There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.
Re: Proton.B: What this Mac malware does
#8Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.
Mac OS X Snow Leopard and malware detection
https://support.apple.com/en-us/HT202234
Surprised I hadn't heard if this kicked in for Handbrake, but Apple maintains a list of malware (I assume by file hash?). I remember when this went into the OS because there were concerns about legit software being blacklisted.
Re: Proton.B: What this Mac malware does
#9Is there a good virus scanner for OSX?
Avast, ClamXav, Antidote, mcafee, kaspersky, eset
Re: Proton.B: What this Mac malware does
#10>The malware obtains the time and date by creating a new environment variable called $hcresult that contains what’s being returned by sending an HTTP request to the Google hosted link by executing this command:
>curl -sL https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb...
What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts on there? What happened to googleusercontent.com?