Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

intego.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#11

Post by jonnycomputer »

kekebo wrote: post #10
obituary_latte wrote: post #9

Earlier quoted context omitted.

What does that do?

From the article: For home users, unfortunately there isn't a simple solution for preventing this type of attack, until or unless Apple releases a macOS security update to mitigate the vulnerability. Cavallarin describes a possible temporary mitigation (opening /etc/auto_master in a text editor and adding # to the beginning of the line that starts with /net).

what are the implications of making this change to auto_master, beyond risk mitigation (i.e. to everyday use)?

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#12

Post by wool_gather »

jonnycomputer wrote: post #11
kekebo wrote: post #10

Earlier quoted context omitted.

From the article: For home users, unfortunately there isn't a simple solution for preventing this type of attack, until or unless Apple releases a macOS security update to mitigate the vulnerability. Cavallarin describes a possible temporary mitigation (opening /etc/auto_master in a text editor and adding # to the beginning of the line that starts with /net).

what are the implications of making this change to auto_master, beyond risk mitigation (i.e. to everyday use)?

I am wondering this too. I see that `man auto_master` describes the purpose and format of the file, but I'm still trying to grok it.

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#13

Post by donarb »

> The disk images are disguised as Adobe Flash Player installers, which is one of the most common ways malware creators trick Mac users into installing malware.

Most Mac users know that Flash is a piece of malware itself and would never be fooled into installing it.

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#14

Post by fortran77 »

donarb wrote: post #13

> The disk images are disguised as Adobe Flash Player installers, which is one of the most common ways malware creators trick Mac users into installing malware. Most Mac users know that Flash is a piece of malware itself and would never be fooled into installing it.

What was the purpose of this statement?

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#15

Post by kekebo »

jonnycomputer wrote: post #11
kekebo wrote: post #10

Earlier quoted context omitted.

From the article: For home users, unfortunately there isn't a simple solution for preventing this type of attack, until or unless Apple releases a macOS security update to mitigate the vulnerability. Cavallarin describes a possible temporary mitigation (opening /etc/auto_master in a text editor and adding # to the beginning of the line that starts with /net).

what are the implications of making this change to auto_master, beyond risk mitigation (i.e. to everyday use)?

Cavallarin explains it in a bit more detail on his blog[1]:

The first legit feature is automount (aka autofs) that allows a user to automatically mount a network share just by accessing a "special" path, in this case, any path beginning with "/net/". [..]

[1] https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypas...

Assumably commenting out the line quoted by gp disables automount for network shares which start with "/net" in their path.

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#16

Post by adim86 »

fortran77 wrote: post #14
donarb wrote: post #13

> The disk images are disguised as Adobe Flash Player installers, which is one of the most common ways malware creators trick Mac users into installing malware. Most Mac users know that Flash is a piece of malware itself and would never be fooled into installing it.

What was the purpose of this statement?

It made me laugh... if that was the purpose... the guy made it. LOL

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#17

Post by donarb »

fortran77 wrote: post #14
donarb wrote: post #13

> The disk images are disguised as Adobe Flash Player installers, which is one of the most common ways malware creators trick Mac users into installing malware. Most Mac users know that Flash is a piece of malware itself and would never be fooled into installing it.

What was the purpose of this statement?

It was a tongue in cheek statement about the fact that Mac users have long ago sworn off using Flash on their systems. It's a bloated CPU-intensive piece of crapware.

Re: OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass

#18

Post by ladberg »

donarb wrote: post #13

> The disk images are disguised as Adobe Flash Player installers, which is one of the most common ways malware creators trick Mac users into installing malware. Most Mac users know that Flash is a piece of malware itself and would never be fooled into installing it.

That's intentional. The most successful fishing emails, sketchy ads, etc are obviously bad to anyone savvy. They design it so that only computer illiterate people end up falling for it, as they have no chance of fixing the problem themselves.
Post reply on HN