News for hackers. Stuff that matters.

A comment on Proton.B: What this Mac malware does.

Re:Proton.B: What this Mac malware does by diimdeep on Sunday May 14, 2017 @01:54AM (#14334442)
I have been using homebrew to install handbrake. What's nice is that homebrew checks SHA256 before installing.

  $ brew cask install handbrake
  ==> Satisfying dependencies
  complete
  ==> Downloading 
  https://download.handbrake.fr/handbrake/releases/1.0.7/HandBrake-1.0.7.dmg
  Already downloaded: 
  /Users/wolf/Library/Caches/Homebrew/Cask/handbrake--1.0.7.dmg
  ==> Verifying checksum for Cask handbrake
  ==> Installing Cask handbrake
  ==> Moving App 'HandBrake.app' to '/Applications/HandBrake.app'.
  handbrake was successfully installed!
[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by kalleboo on Sunday May 14, 2017 @02:10AM (#14334485)
Homebrew updated their hash to the infected one (differing from the Handbrake download page!), so people who installed using Homebrew got infected too. Do NOT trust homebrew.

https://news.ycombinator.com/item?id=14282116

[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by danieldk on Sunday May 14, 2017 @02:12AM (#14334491)
Homebrew Cask distributed the infected Handbrake:

https://github.com/caskroom/homebrew-cask/commit/461af7672fa...

Note that hash 013623e5e50[...] is the infected Handbrake. Even worse, they changed the correct SHA-256 hash to the hash of the malwared Handbrake.

[ Parent | on HN ]
Re:Proton.B: What this Mac malware does by diimdeep on Sunday May 14, 2017 @04:10AM (#14334756)
Homebrew added new policy https://github.com/caskroom/homebrew-cask/pull/33538/files

> When updating the `sha256` stanza of an existing Cask, the `version` also has to have changed. Otherwise, the new checksum has to be confirmed by the developer.

[ Parent | on HN ]