The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
Proton.B: What this Mac malware does
11–20 of 94 posts
Re: Proton.B: What this Mac malware does
#12The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
Yes, should show the users login photo at the very least...
Re: Proton.B: What this Mac malware does
#13I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website: HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums The Affected Download mirror (download.handbrake.fr) has been…
It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.
Re: Proton.B: What this Mac malware does
#14I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website: HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums The Affected Download mirror (download.handbrake.fr) has been…
It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.
In KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.
Re: Proton.B: What this Mac malware does
#15>The malware obtains the time and date by creating a new environment variable called $hcresult that contains what’s being returned by sending an HTTP request to the Google hosted link by executing this command: >curl -sL https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb... What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts…
Looks like its getting the current time from the json response. How dare Google distribute the current time?
Re: Proton.B: What this Mac malware does
#16The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
Yes, should show the users login photo at the very least...
And maybe dim the background, as wel as giving information about the creator of the application and if its codesigned. oh wait, that was too obtrusive and annoying
Re: Proton.B: What this Mac malware does
#17>The malware obtains the time and date by creating a new environment variable called $hcresult that contains what’s being returned by sending an HTTP request to the Google hosted link by executing this command: >curl -sL https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb... What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts…
Looks like its getting the current time from the json response. How dare Google distribute the current time ?
The parent comment isn't talking about the payload being returned, it's about what domain Google is hosting user content on.
Re: Proton.B: What this Mac malware does
#18The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
On Windows NT you had to press Ctrl-Alt-Delete at the login prompt
because that was a key combination that no other application could
intercept. Nowadays you work as a non-privileged user but then you have
to enter your admin password in various dialog boxes with no way of
knowing if its legit (sometimes ubuntu shows you an ugly-looking
(i.e. wrong styled) gtk input dialog during updates. But only
sometimes. Thats very confusing.).
On the other hand, each desktop application should be able to request root access. And if you trust these applications (e.g. handbrake on macos) you wouldn't bother to press Ctrl-Alt-Delete or do whatever else it takes.
Any good solution for that?
Re: Proton.B: What this Mac malware does
#19>The malware obtains the time and date by creating a new environment variable called $hcresult that contains what’s being returned by sending an HTTP request to the Google hosted link by executing this command: >curl -sL https://script.google.com/macros/s/AKfycbyd5AcbAnWi2Yn0xhFRb... What the hell, Google? Your domain name is one of the most trusted on the internet and yet you're hosting random user submitted scripts…
Looks like its getting the current time from the json response. How dare Google distribute the current time ?
The point is that it's an arbitrary user submitted script. In this case it was just the time, but it could have easily been a botnet command and control message or some other malicious content.
It's standard security practice to serve user submitted content on a separate domain, so I'm a little surprised that Google isn't following it.