61–70 of 94 posts
I'm intrigued and curious about why they download your 1Password databases… I wonder if that's speculative - or if offline bruteforcing them works often enough for it to be worthwhile for the malware authors?
The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.
Introduce some scary red extra button with a key or locker symbol on it which can't be intercepted by applications or by root applications. When the OS needs authorisation, the user is prompted to hit that button, then a truly modal authentication prompt appears which is only dismissed by a second hit of that button or turning off the system.
This system could use different ways of authentication than by passwords.
Additionally users should be trained in only using this way of authentication and no others. The OS offers a secure API to invoke authentication, so that browsers also can use this for web apps. The prompt will look different and display additional information like «Application X wants to do Z», etc.
Edit: some more thoughts and clarification.
I'm intrigued and curious about why they download your 1Password databases… I wonder if that's speculative - or if offline bruteforcing them works often enough for it to be worthwhile for the malware authors?
"Dialog boxes asking for passwords are a very popular social engineering tactic designed to trick users into giving attackers their passwords" Apple is extremely guilty of normalizing the frequent entry of passwords. I recently reinstalled a Mac and an iPad, and for each device I must've entered my Apple ID password seven or eight times. in the normal course of getting things done I then enter either this, or my loca…
You people are doing something seriously wrong. About the only time I need to enter iCloud credentials is when I reboot my system, which is maybe once a month, or buy something. Complaining about credential entry on a new device install in this context is also kind of irrelevant, this malware doesn't strike during a new OS update.
Earlier quoted context omitted.
On Windows NT you had to press Ctrl-Alt-Delete at the login prompt because that was a key combination that no other application could intercept. Nowadays you work as a non-privileged user but then you have to enter your admin password in various dialog boxes with no way of knowing if its legit (sometimes ubuntu shows you an ugly-looking (i.e. wrong styled) gtk input dialog during updates. But only sometimes. Thats ve…
"Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions. But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the…
Earlier quoted context omitted.
On Windows NT you had to press Ctrl-Alt-Delete at the login prompt because that was a key combination that no other application could intercept. Nowadays you work as a non-privileged user but then you have to enter your admin password in various dialog boxes with no way of knowing if its legit (sometimes ubuntu shows you an ugly-looking (i.e. wrong styled) gtk input dialog during updates. But only sometimes. Thats ve…
"Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions. But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the…
I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website: HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums The Affected Download mirror (download.handbrake.fr) has been…
It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.
So i ran the following in terminal
COMMAND : `cd /Applications shasum -a 1 HandBrake-* && shasum -a 256 HandBrake-`
and got this response which seems to be blank.. any ideas wether this is saying that i have an infected file or if ive just run the initial terminal command wrong ?
RESPONSE : `shasum: HandBrake-: Sams-MacBook-Pro:Applications Sam$ `
Earlier quoted context omitted.
"Full" UAC, also known as actual UAC, moves you to a secure desktop without any other windows (which also prevents a few forms of keylogging). You can't alt-tab into any of your previous applications, either, until the prompt has been dealt with. Faking this requires kernel-mode permissions. But then again, users will STILL enter the password, giving the app root permission anyway. The warning here would be that the…
That's what I always wondered — why it's hard to fake UAC? Surely I can create a full-screen application which won't give away focus with alt-tab (that's very frequent behaviour with bad games).
So I would say that it's certainly possible, although I haven't tried specifically to do that to emulate UAC.
Edit: Infact I had a bug at one stage where if I closed the main window, the invisible window would remain running, with no entry in the start bar.
Now I'm becoming a little more concerned, as I could also listen for hotkeys, (such as Ctrl alt delete) and display my own 'secure login' page. Shit
Earlier quoted context omitted.
It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.
Browsers could show a checksum when hovering on a downloaded file.