Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton.B: What this Mac malware does

cybereason.com

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Proton.B: What this Mac malware does

#71

Post by gregmac »

eriknstr wrote: post #56
lultimouomo wrote: post #53

Earlier quoted context omitted.

There is no undo when you're giving access to information. This malware reads your passwords and sends them to a remote server. How would you block it?

Because since the only way that a program can have access to information is by explicitly handing that info to the program from another program the only place you enter a password is on your login screen.

Login password perhaps (at least plain text version of it), but account info (including cookies) in a browser for example would be accessible, as well as anything on disk.

Re: Proton.B: What this Mac malware does

#72

Post by inopinatus »

vbezhenar wrote: post #64
yborg wrote: post #39

Earlier quoted context omitted.

You people are doing something seriously wrong. About the only time I need to enter iCloud credentials is when I reboot my system, which is maybe once a month, or buy something. Complaining about credential entry on a new device install in this context is also kind of irrelevant, this malware doesn't strike during a new OS update.

I'm not sure why you've got downvoted, but I can confirm, that I'm using Macbook, iPhone, iPad and I very rarely have to enter iCloud password. I don't even remember last time I did it. I'm not reinstalling stuff or whatever, usually I'm working with programs I'm using and only password I'm constantly typing is password from locked computer or pincode for phone (and even those could be eliminated with modern touch bu…

Regarding the downvotes; I suspect it was the holier-than-thou tone delivering a blinkered refusal to accept someone else's reported experience, all prefaced by a cheap sneer.

I generally find that this forum has a higher than usual tolerance for unconventional perspectives, but takes a very dim view of poor manners. Unlike other places that seem to reward and even celebrate bad behaviour and low standards of discussion. This is a major reason I contribute here and basically nowhere else.

Re: Proton.B: What this Mac malware does

#73

Post by fulafel »

nerdponx wrote: post #13
ams6110 wrote: post #3

I've used handbrake some time ago but not recently, and hadn't heard about this. Summmary of the situation from the handbrake website: HandBrake-1.0.7.dmg was replaced by another unknown malicious file that DOES NOT match the SHA1 / SHA256 hashes on our website or on our Github Wiki which mirrors these: https://github.com/HandBrake/HandBrake/wiki/Checksums The Affected Download mirror (download.handbrake.fr) has been…

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so:

Re: Proton.B: What this Mac malware does

#74

Post by nerdponx »

fulafel wrote: post #73
nerdponx wrote: post #13

Earlier quoted context omitted.

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so:

How does the browser know what hash algo to use?

Re: Proton.B: What this Mac malware does

#75

Post by nerdponx »

kalleboo wrote: post #50
ReverseCold wrote: post #22

Earlier quoted context omitted.

We need a right click > verify, then user pastes in the hash. It could also be added to the browser.

A hash property on the tag would be spiffy

Apparently there is, sorta: https://news.ycombinator.com/item?id=14335840

Re: Proton.B: What this Mac malware does

#76

Post by polygot »

cpncrunch wrote: post #30
polygot wrote: post #24

This Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website. Doesn't fix the root cause, but could have caught it much sooner.

Does anyone actually do that? And what if you have a million files? And what happens within that 30 mins? I guess you could download and check your million files once ever 30 seconds...

Well, you would just check the final download dmg/iso file, and only do it for the first n-versions or so (since those will be the most popular.) The other ones can be checked too, but at a much lower frequency.

Re: Proton.B: What this Mac malware does

#77

Post by b6 »

simonhamp wrote: post #11

The standard macOS password prompt surely needs to change. It's become too familiar and I'm sure I've filled it in hastily before without wondering why or what for. It needs to be implemented in a way that is impossible for nefarious apps to replicate.

Maybe not a good idea, but I was thinking it could be cool if they turned on some lock LED in the bezel.

Re: Proton.B: What this Mac malware does

#78

Post by CharlesW »

nerdponx wrote: post #74
fulafel wrote: post #73

Earlier quoted context omitted.

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so:

How does the browser know what hash algo to use?

https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

"As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."

Re: Proton.B: What this Mac malware does

#79

Post by rco8786 »

polygot wrote: post #24

This Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website. Doesn't fix the root cause, but could have caught it much sooner.

So everyone's supposed to maintain heartbeat servers for all their downloadable files now?

Re: Proton.B: What this Mac malware does

#80

Post by behnamoh »

inopinatus wrote: post #32

"Dialog boxes asking for passwords are a very popular social engineering tactic designed to trick users into giving attackers their passwords" Apple is extremely guilty of normalizing the frequent entry of passwords. I recently reinstalled a Mac and an iPad, and for each device I must've entered my Apple ID password seven or eight times. in the normal course of getting things done I then enter either this, or my loca…

Yes. Actually, there was a malware in iOS that displayed "Please Enter Password of Your Email..." and many users were trapped in that ruse.

It must still be active on my iPad, because often times, I get that message to enter my email password while Email app is working well.

Post reply on HN