21–30 of 123 posts
Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
What kind of malware did you run into?
Fixed in 10.13.2 - but wow, was High Sierra ever a sloppy release.
Sloppy and marketed as a stability build. There were hardly any new features in it.
Hardly any new features...
Earlier quoted context omitted.
After doing a quick sweep of the network and processes, I didn't find anything overtly malicious (unless you count 6 MB pages for a blog, 150k lines for squarespace's JS, and 3000 rules over 400KB).
When I last examined it, the malware was loading from a domain called eventsbysteph. If the page still pulls js from there then the malware's still around (doesn't activate on 100% of loads)
Earlier quoted context omitted.
Sloppy and marketed as a stability build. There were hardly any new features in it.
Yeah, they just deployed a whole new FS to 100s of millions of users, in record time, with almost zero incidents. Hardly any new features...
Earlier quoted context omitted.
Exactly. More to the point, even if it doesn't log it any more, I bet it's still on the command line itself.
The usual trick here is to pass it as an environment variable instead of cmdline, that can be done without much effort so they're probably doing that.
cat /proc//environ
Earlier quoted context omitted.
The usual trick here is to pass it as an environment variable instead of cmdline, that can be done without much effort so they're probably doing that.
Bad idea cat /proc/ /environ
Other users' processes can't see /proc/$pid/environ, unlike using cmdline.
Earlier quoted context omitted.
Bad idea cat /proc/ /environ
Wait, what's your threat model? Surely you're not imagining that you can pass data from one process to another without root being able to see it? (On Linux, since you're using /proc.) Other users' processes can't see /proc/$pid/environ, unlike using cmdline.
I think the better solution is to read it out of a wallet into stdin