Is there a good virus scanner for OSX?
There are no good virus scanners – that is a general issue, not a Mac OS-related one.
Proton.B: What this Mac malware does
41–50 of 94 posts
Re: Proton.B: What this Mac malware does
#42Is there a good virus scanner for OSX?
[deleted]
Re: Proton.B: What this Mac malware does
#43"Dialog boxes asking for passwords are a very popular social engineering tactic designed to trick users into giving attackers their passwords" Apple is extremely guilty of normalizing the frequent entry of passwords. I recently reinstalled a Mac and an iPad, and for each device I must've entered my Apple ID password seven or eight times. in the normal course of getting things done I then enter either this, or my loca…
Yup. My Apple password is one of the very few remaining ones that isn't a random string generated by 1Password because Apple makes me enter it all the time. :(
FWIW I use 1pw's diceware generator for any password I might have to enter on iOS, Roku, PS4, etc.
Much easier to remember when looking from screen to screen and fewer keyboard shifts.
Re: Proton.B: What this Mac malware does
#44I have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing.
$ brew cask install handbrake
==> Satisfying dependencies
complete
==> Downloading
https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg
Already downloaded:
/Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg
==> Verifying checksum for Cask handbrake
==> Installing Cask handbrake
==> Moving App 'HandBrake.app' to '/Applications/HandBrake.app'.
handbrake was successfully installed!Re: Proton.B: What this Mac malware does
#45The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
On Windows NT you had to press Ctrl-Alt-Delete at the login prompt because that was a key combination that no other application could intercept. Nowadays you work as a non-privileged user but then you have to enter your admin password in various dialog boxes with no way of knowing if its legit (sometimes ubuntu shows you an ugly-looking (i.e. wrong styled) gtk input dialog during updates. But only sometimes. Thats ve…
"Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions.
But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the "fake" Handbrake would not have been signed, and blocked by SmartScreen. (They could get a signing cert, and use that, and aware users would have to know it differs...)
I still think the safest way is Windows XP style. Applications do not get root. You cannot give them root. Things that require an administrative password have to be done under the administrative account.
Re: Proton.B: What this Mac malware does
#46I have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing. $ brew cask install handbrake ==> Satisfying dependencies complete ==> Downloading https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg Already downloaded: /Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg ==> Verifying checksum for Cask handbrake ==> Installing Cask handbra…
Homebrew updated their hash to the infected one (differing from the Handbrake download page!), so people who installed using Homebrew got infected too. Do NOT trust homebrew.
Re: Proton.B: What this Mac malware does
#47I have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing. $ brew cask install handbrake ==> Satisfying dependencies complete ==> Downloading https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg Already downloaded: /Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg ==> Verifying checksum for Cask handbrake ==> Installing Cask handbra…
Homebrew Cask distributed the infected Handbrake:
https://github.com/caskroom/homebrew-cask/commit/461af7672fa...
Note that hash 013623e5e50[...] is the infected Handbrake. Even worse, they changed the correct SHA-256 hash to the hash of the malwared Handbrake.
Re: Proton.B: What this Mac malware does
#48This Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website. Doesn't fix the root cause, but could have caught it much sooner.
Or you know, just sign the application bundle. macOS has bundle signing for a reason. To make it even better, enable sandboxing for the application as well.
Re: Proton.B: What this Mac malware does
#49Earlier quoted context omitted.
Which is its own attack vector: https://news.ycombinator.com/item?id=14296959
The problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing. If the user is about to execute a malicious file anyway, then scanning it before only adds protection.
The problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.
Re: Proton.B: What this Mac malware does
#50Earlier quoted context omitted.
In KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.
We need a right click > verify, then user pastes in the hash. It could also be added to the browser.
A hash property on the tag would be spiffy