OS X/Hydromac: New Mac adware, leaked from a flashcards app

#1

Post by iscmt » Sun, Jun 06, 2021, 2:16 AM UTC

OS X/Hydromac: New Mac adware, leaked from a flashcards app
objective-see.com

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#2

Post by kevingadd » Sun, Jun 06, 2021, 5:37 AM UTC

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique.

Anyway, very interesting research. I'm very curious why anyone would even see fit to make flashcards about this sort of thing, what makes it worth memorizing?

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#3

Post by [deleted] » Sun, Jun 06, 2021, 6:24 AM UTC

kevingadd wrote: post #2

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique. Anyway, very inter…

[deleted]

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#4

Post by jrowley » Sun, Jun 06, 2021, 6:41 AM UTC

kevingadd wrote: post #2

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique. Anyway, very inter…

They were probably developing the app themself and forgot they included the information in a test card or something?

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#5

Post by tempodox » Sun, Jun 06, 2021, 7:19 AM UTC

Many of the screenshots in the posted article are too small and blurry to be of any use. In the original article [1] they can be zoomed and are actually readable.

[1] https://blog.confiant.com/osx-hydromac-a-new-macos-malware-l...

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#6

Post by 55555 » Sun, Jun 06, 2021, 7:19 AM UTC

kevingadd wrote: post #2

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique. Anyway, very inter…

Yeah, that was easy to find. San Diego is also a hotspot for shady online advertising.

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#7

Post by fouc » Sun, Jun 06, 2021, 9:52 AM UTC

> US soldiers stationed on European bases that host nuclear weapons have exposed a multitude of sensitive security details -- including where weapons are stored & secret duress words -- by using flashcard learning apps that appear publicly in online searches

I'm wondering what's the name(s) of these flashcard apps ?

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#8

Post by rahidz » Sun, Jun 06, 2021, 10:24 AM UTC

fouc wrote: post #7

> US soldiers stationed on European bases that host nuclear weapons have exposed a multitude of sensitive security details -- including where weapons are stored & secret duress words -- by using flashcard learning apps that appear publicly in online searches I'm wondering what's the name(s) of these flashcard apps ?

>Simply searching for “PAS”, “WS3” and “vault” on Google together with the names of air bases in Europe quickly led to free flashcard platforms such as Chegg, Quizlet, and Cram.

https://www.bellingcat.com/news/2021/05/28/us-soldiers-expos...

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#9

Post by siilats » Sun, Jun 06, 2021, 12:45 PM UTC

kevingadd wrote: post #2

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique. Anyway, very inter…

Also has a LinkedIn page with the Ad inc employer https://www.linkedin.com/in/jasonwaynetaylor he was the project manager most likely.

Re: OS X/Hydromac: New Mac adware, leaked from a flashcards app

#10

Post by siilats » Sun, Jun 06, 2021, 12:48 PM UTC

siilats wrote: post #9

kevingadd wrote: post #2

If you're going to censor someone's github profile, actually censor it. It took exactly 5 seconds to find the github profile in question, so you might as well either out them at this point or black out ALL the identifying information (there is exactly one google search result). I would have expected his user pic to be a stock photo used by a burner account or something, but it appears to be unique. Anyway, very inter…

Also has a LinkedIn page with the Ad inc employer https://www.linkedin.com/in/jasonwaynetaylor he was the project manager most likely.

Sterkly Languages: c, c++, c#, JavaScript, obc++ Frameworks: .net, .net core, Entity Framework Platform experience: Windows, Windows Server, macOS Software experience: Windows services, MacOS launch agents, Mac apps, Windows installers, Mac installers, Server Rest APIs, operational portals, sql, MongoDB, Aerospike(nosql), Unity(personal projects), AWS(s3, kinesis, redshift, athena)