Proton.B: What this Mac malware does

Re:Proton.B: What this Mac malware does by Cole_Jontrane on Saturday May 13, 2017 @06:25PM (#14333321)

Does the Mac have any ability to warn when someone attempts to install malicious software, other than the usual warnings about unsigned software? Windows 10, for example, will scan every attachment before opening it, catching a lot of stuff before it can do any harm.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by aeontech on Saturday May 13, 2017 @07:19PM (#14333482)

There is XProtect that warns people about known malware - https://www.howtogeek.com/217043/xprotect-explained-how-your...

There's Gatekeeper, that warns people about unsigned software from untrusted sources, and prevents it from running by default (you have to know to ctrl-click the app to force it to open, which really cuts down on accidental installs and saves most technically illiterate users from themselves).

There's also SIP, which makes sure that even if malware is installed, it can't mess with a large number of system-owned files, so the amount of damage it can do is somewhat curtailed.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by hRrrm1 on Saturday May 13, 2017 @07:17PM (#14333472)

"scan everything before opening" is not always desirable as it exposes a large attack surface:

https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by AlexCoventry on Sunday May 14, 2017 @12:25AM (#14334214)

"Avoid running your scan with elevated privileges" could have greatly mitigated this failure.

> NScript is the component of mpengine that evaluates any filesystem or network activity that looks like JavaScript. To be clear, this is an unsandboxed and highly privileged JavaScript interpreter that is used to evaluate untrusted code, by default on all modern Windows systems. This is as surprising as it sounds.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by js2 on Saturday May 13, 2017 @07:14PM (#14333467)

Which is its own attack vector:

https://news.ycombinator.com/item?id=14296959

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by ecma_horse on Saturday May 13, 2017 @09:15PM (#14333764)

The problem here is that the file is being scanned without the user even attempting to run it. A similar vector would be file previews (thumbnails) or indexing.

If the user is about to execute a malicious file anyway, then scanning it before only adds protection.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by danieldk on Sunday May 14, 2017 @02:18AM (#14334501)

The problem is more that the standard model for applications is 'can access the whole filesystem, can write to the user's home directory'. The default model should change to sandboxing an application without any permissions.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by pfranz on Saturday May 13, 2017 @07:23PM (#14333502)

Mac OS X Snow Leopard and malware detection https://support.apple.com/en-us/HT202234

Surprised I hadn't heard if this kicked in for Handbrake, but Apple maintains a list of malware (I assume by file hash?). I remember when this went into the OS because there were concerns about legit software being blacklisted.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by kalleboo on Sunday May 14, 2017 @02:31AM (#14334535)

Yes Apple has blacklisted the new malware in XProtect.

[ Parent | on HN ]