121–130 of 146 posts
https://twitter.com/objective_see/status/771189100355264512
Also, their other (free, open source) tools are very good too, like KnockKnock and RansomWhere:
Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be very cautious when installing new versions.
Simple file check if you are infected: if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] || [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] || [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud…
Might it be better to replace the first two tests with something like `-f /[star][star]/Transmission.app/Contents/Resources/License.rtf`?
Earlier quoted context omitted.
Yeah, let's download and blindly run stuff directly from the internet (that may have changed since we last saw it) without saving and trying to read what it does first. If you can copy/paste the curl | bash, is it really more difficult to copy/paste the original snippet into a text editor[0], and from there, into bash? [0] https://thejh.net/misc/website-terminal-copy-paste
So you would run code by pasting it from the internet just fine, but doing so via a pastebin is a security risk?
EDIT: This comment was based on the assumption that my parent hadn't read carefully. My facile point ignores both the specific vulnerability pointed out by [czinck](https://news.ycombinator.com/item?id=12406080) below, and the general vulnerability that you just can't trust anything pulled in from an external source. I think that re-directing to a file, and viewing the file with something like `:set list` set in `vim`, will work, at least in the sense of showing you the code that will actually be executed (although nothing can save you from not understanding the code), as long as you can trust your own stack. However, it is a near-certainty that this edit will prompt someone to explain how to exploit that. (That may sound like whingeing, but it's just a (happy) acknowledgement of the hacker mentality; unexpected exploitations, as PsoC rather than attacks, are pretty neat, too!)
Earlier quoted context omitted.
Wow. I'm the author of keychaindump. Didn't expect to become a malware co-author.
Seemed pretty likely though don't you think?
> Am I at risk? Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.
Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc). False negatives are pretty bad in this case, better for users to check themselves.
It will all remain exactly as it is now, except for the case when they recognize a visitor that is likely to have downloaded the malware. In this case they should throw an extra warning.
Earlier quoted context omitted.
Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc). False negatives are pretty bad in this case, better for users to check themselves.
No, you are missing the point. It will all remain exactly as it is now, except for the case when they recognize a visitor that is likely to have downloaded the malware. In this case they should throw an extra warning.
But as soon as other people know or hear of it, they will go check the website to "see if they are affected". Even if the website has a huge disclaimer telling people that they could still be affected, the absence of the warning would still suggest that they are not affected, even when they could be.
Earlier quoted context omitted.
So you would run code by pasting it from the internet just fine, but doing so via a pastebin is a security risk?
If you C&P it, at least you see what's being C&P'd (although it's up to you to take the trouble to understand it). `| bash`ing it runs it automatically , without even giving you a chance to see it. EDIT: This comment was based on the assumption that my parent hadn't read carefully. My facile point ignores both the specific vulnerability pointed out by [czinck]( https://news.ycombinator.com/item?id=12406080 ) below, a…
Earlier quoted context omitted.
If you C&P it, at least you see what's being C&P'd (although it's up to you to take the trouble to understand it). `| bash`ing it runs it automatically , without even giving you a chance to see it. EDIT: This comment was based on the assumption that my parent hadn't read carefully. My facile point ignores both the specific vulnerability pointed out by [czinck]( https://news.ycombinator.com/item?id=12406080 ) below, a…
C&P is not really more secure than curl as with some javascript you can easily mislead users as to what they're copying. Check https://thejh.net/misc/website-terminal-copy-paste and similar PoCs.
Just set dom.event.clipboardevents.enabled = false.
Some shells also handle the paste and try to detect anything funny going on or at least let you review before you execute.