Proton.B: What this Mac malware does

Re:Proton.B: What this Mac malware does by polygot on Saturday May 13, 2017 @09:07PM (#14333744)

This Handbrake outbreak could have been easily avoided. For instance, Handbrake could create a separate server on say, Amazon EC2 and have it download the file from their website every 30min or so, and check the checksum. If it's not right, then it flips a kill switch on the website.

Doesn't fix the root cause, but could have caught it much sooner.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by cpncrunch on Saturday May 13, 2017 @09:59PM (#14333851)

Does anyone actually do that? And what if you have a million files? And what happens within that 30 mins? I guess you could download and check your million files once ever 30 seconds...

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by polygot on Sunday May 14, 2017 @11:12AM (#14335912)

Well, you would just check the final download dmg/iso file, and only do it for the first n-versions or so (since those will be the most popular.) The other ones can be checked too, but at a much lower frequency.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by danieldk on Sunday May 14, 2017 @02:15AM (#14334497)

Or you know, just sign the application bundle. macOS has bundle signing for a reason. To make it even better, enable sandboxing for the application as well.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by rco8786 on Sunday May 14, 2017 @11:31AM (#14335990)

So everyone's supposed to maintain heartbeat servers for all their downloadable files now?

[ Parent | on HN ]