Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton.B: What this Mac malware does

cybereason.com

Post reply on HN
Print view View original

81–90 of 94 posts

Re: Proton.B: What this Mac malware does

#81

Post by Someone »

vbezhenar wrote: post #65
freeone3000 wrote: post #45

Earlier quoted context omitted.

"Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions. But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the…

That's what I always wondered — why it's hard to fake UAC? Surely I can create a full-screen application which won't give away focus with alt-tab (that's very frequent behaviour with bad games).

(Sorry, can't test, as I don't have a Windows machine ready)

AFAIK, whenever you get a dialog that asks for your admin password, hit Control-Alt-Delete. If the dialog is a real one, focus stays with that window. If it is fake, a real one pops up on top of the fake one.

Re: Proton.B: What this Mac malware does

#82

Post by onmobiletemp »

microtonal wrote: post #59
onmobiletemp wrote: post #52

Why were they going after 1password filevaults? I assume 1password is like keypass, where all your passwords are in an encrypted file? How could they decrypt all those files? Or do they assume people use weak passwords?

According to the article this malware also does keylogging. So, presumably, they'll have the vault password as well.

Derp

Re: Proton.B: What this Mac malware does

#83

Post by hackerboos »

vels wrote: post #68

Ive got handbrake saved in my users application folder So i ran the following in terminal COMMAND : `cd /Applications shasum -a 1 HandBrake-* && shasum -a 256 HandBrake- ` and got this response which seems to be blank.. any ideas wether this is saying that i have an infected file or if ive just run the initial terminal command wrong ? RESPONSE : `shasum: HandBrake- : Sams-MacBook-Pro:Applications Sam$ `

You run it against the DMG not the app.

Re: Proton.B: What this Mac malware does

#84

Post by fulafel »

fulafel wrote: post #73
nerdponx wrote: post #13

Earlier quoted context omitted.

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so:

Correcting myself: looks like the SRI spec hasn't included the element in the list of supported elements, though it has a mention that it might be supported in a future version :(

Re: Proton.B: What this Mac malware does

#85

Post by MohammadLee »

marak830 wrote: post #69
vbezhenar wrote: post #65

Earlier quoted context omitted.

That's what I always wondered — why it's hard to fake UAC? Surely I can create a full-screen application which won't give away focus with alt-tab (that's very frequent behaviour with bad games).

One software I was/am still working on has an onscreen display(clear always top window ) so I can draw icons and text over a game, it's a pain to alt-tab out of(due to me setting it to constantly check to see if it's ontop, and if not, to set it). So I would say that it's certainly possible, although I haven't tried specifically to do that to emulate UAC. Edit: Infact I had a bug at one stage where if I closed the ma…

Listening for these hotkeys is kind of pointless. The whole idea of pressing Ctrl + Alt + Del is that, while you can detect the keys being pressed, you cannot prevent Windows to display its interface on top of yours. See https://en.wikipedia.org/wiki/Secure_attention_key That's actually a good mechanism that should be brought back to all modern OS. I wish Android had something similar (well, available physical input keys are limited, but you get the idea)

Re: Proton.B: What this Mac malware does

#86

Post by MohammadLee »

AckSyn wrote: post #31
eriknstr wrote: post #26

Earlier quoted context omitted.

Not sure if you're being sarcastic about how users feel or about that kind of configuration for UAC, but personally it's one of the many things I dislike when I'm on a Windows computer. For power users it's annoying and disruptive. For users that might benefit the most from it they quickly learn to press ok always whenever they are prompted for something, no matter what it's asking. In my opinion, an ideal OS would h…

> For power users it's annoying and disruptive Let me stop you right there. As a sysadmin, UAC is both effective as it is necessary. I absolutely don't want any application a user can launch with a mere YES/NO prompt but proper secondary credentials, interactively or by some nefarious app spawning other processes, to have the ability to gain an administrative level of access over the local machine. Unless it's absolu…

I totally agree with you, except that asking users multiple times for their password will increase password fatigue. It may be argued that we could prefer the users to mindlessly click on Yes when a popup arises, instead of mindlessly inputting their password. Another option can be timers on the Yes button (like Firefox does), it blocks a few user interface hijacking attacks and gives the user an opportunity to think before they click.

Re: Proton.B: What this Mac malware does

#87

Post by MohammadLee »

nerdponx wrote: post #70
acangiano wrote: post #67

Earlier quoted context omitted.

Browsers could show a checksum when hovering on a downloaded file.

This is a brilliant idea! Does Firefox accept feature proposals if they're fleshed out? My friend is an aspiring UX designer looking to build a portfolio, and I can write crude sample code.

Not so sure that's a good idea. This would prevent users to programmatically compare hashes, and it would be hard to display one next to the other to facilitate comparison. Keep in mind that it is relatively easy to create a file that matches the first and/or last N chars of a hash. And who checks the center of the hash? No, we have to have the browser compare the full hash and give a simple green light to the user. I don't have a proposition in terms of UX but it should be studied (should have been 15 years ago actually)

Re: Proton.B: What this Mac malware does

#88

Post by nerdponx »

MohammadLee wrote: post #87
nerdponx wrote: post #70

Earlier quoted context omitted.

This is a brilliant idea! Does Firefox accept feature proposals if they're fleshed out? My friend is an aspiring UX designer looking to build a portfolio, and I can write crude sample code.

Not so sure that's a good idea. This would prevent users to programmatically compare hashes, and it would be hard to display one next to the other to facilitate comparison. Keep in mind that it is relatively easy to create a file that matches the first and/or last N chars of a hash. And who checks the center of the hash? No, we have to have the browser compare the full hash and give a simple green light to the user.…

I was thinking the same thing, actually. I made a UX mockup this morning that I feel good about and was able to explain to my parents over brunch. I'll see if my friend wants to work on it.

Re: Proton.B: What this Mac malware does

#89

Post by bobbington »

simonhamp wrote: post #11

The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.

I think windows user account control where you just have to click the button to allow admin privileges is much smarter.

Re: Proton.B: What this Mac malware does

#90

Post by marak830 »

MohammadLee wrote: post #85
marak830 wrote: post #69

Earlier quoted context omitted.

One software I was/am still working on has an onscreen display(clear always top window ) so I can draw icons and text over a game, it's a pain to alt-tab out of(due to me setting it to constantly check to see if it's ontop, and if not, to set it). So I would say that it's certainly possible, although I haven't tried specifically to do that to emulate UAC. Edit: Infact I had a bug at one stage where if I closed the ma…

Listening for these hotkeys is kind of pointless. The whole idea of pressing Ctrl + Alt + Del is that, while you can detect the keys being pressed, you cannot prevent Windows to display its interface on top of yours . See https://en.wikipedia.org/wiki/Secure_attention_key That's actually a good mechanism that should be brought back to all modern OS. I wish Android had something similar (well, available physical input…

I would like to hope so, I haven't tried intercepting something like that(I just listen for certain keys), I do wonder if someone more experienced than me could listen for Ctrl and alt, then intercept the delivery, and display their own. (I would 'assume' the system gets first dibs on any keypress, but what if you listened for Ctrl and alt then used a sendkey to upkey the Ctrl and alt, and detect a del key press and then display a fake).
Post reply on HN