News for hackers. Stuff that matters.

A comment on Apple Mac computers targeted by ransomware and spyware. Parent comment

Re:Apple Mac computers targeted by ransomware and spyware by Razengan on Tuesday June 13, 2017 @01:52PM (#14546907)
> What more can I do to be safe?

• Work from an standard (non-admin) user account.

• Review the settings in System Preferences » Security & Privacy and pick a reasonable ground between convenience and security.

• At the very least, "Require an administrator password to access system-wide preferences" (found under the "Advanced..." button.)

• Be wary of any third-party app that asks for an administrator password, and try to see if it runs after denying the prompt. Dropbox, for example, seems to work fine even if I cancel its second (after installation) admin prompt. (There were news about it faking the prompt and storing your macOS password [2] for automatic updates...)

• You may want to tighten the firewall settings, and/or consider Little Snitch [3].

• If you have to install something from a .pkg file, which can autorun scripts, try to review the .pkg and its scripts with Pacifist [0] first. It may be possible to just extract the payload with Pacifist and run the app just fine without "installing" the .pkg.

• Make regular backups. Automatic (e.g. Time Machine) AND manual (of your most important stuff at least.)

• Don’t use the same passwords for different things.

• Enable multi-factor authentication on as many services as you can.

• Visit dodgy websites in private browsing mode, or a secondary, locked-down browser like Tor [1].

• If you can't help downloading pirated/"cracked" apps or games, try to run them from a different user account.

• If concerned about outright theft of your Mac, enable FileVault full disk encryption, and set a firmware password. [4]

• Whenever you're bored or something is acting janky, check the usual places where third-party processes can install themselves and hook into your system:

- System Preferences » Security & Privacy » Privacy » Accessibility

- System Preferences » Users & Groups » Login Items

- /System/Library/LaunchAgents, /System/Library/LaunchDaemons, /System/Library/StartupItems

- /Library/LaunchAgents, /Library/LaunchDaemons, /Library/StartupItems, /Library/Internet Plug-Ins

- Check for 3rd-party kernel extensions:

  kextstat -kl | awk ' !/apple/ { print $6 $7 } '
• Oh and before you paste any command/script (like the above) from the internet into your terminal, see the man page for each command and its arguments first. :)

----

I've used Macs without an antivirus since 2012 and I haven't been hit by malware yet... I think. :)

[0] http://www.charlessoft.com

[1] https://www.torproject.org/projects/torbrowser.html.en

[2] https://news.ycombinator.com/item?id=12463338 (How Dropbox Hacks Your Mac)

[3] https://www.obdev.at/products/littlesnitch/index.html

[4] https://support.apple.com/en-us/HT204455

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by acqq on Tuesday June 13, 2017 @02:41PM (#14547411)
> There were news about [Dropbox] faking the prompt and storing your password

Wow, I've missed that. An example of the article:

http://applehelpwriter.com/2016/07/28/revealing-dropboxs-dir...

"note the ‘Type your password…’ sentence is both misaligned and is spaced into a separate paragraph, unlike genuine authentication requests from OS X. The phrasing of the first sentence “your computer password” is also very “un-OS X”."

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by anon1253 on Tuesday June 13, 2017 @03:16PM (#14547718)
Additionally if you're really paranoid

- Use LittleSnitch or similar to block traffic per process

- Use ad blockers in your browser and make sure Flash, Java and Silverlight are off by default

- Do update regularly

If you care about security in case your device gets stolen

- Use full disk encryption

- Do /not/ forget to also set a firmware password

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by trey-jones on Tuesday June 13, 2017 @03:44PM (#14547950)
> Check for 3rd-party kernel extensions:

Let me add one:

- Not paste commands from the internet into your terminal.

This one's fine! I'm also nitpicking.

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by xythobuz on Tuesday June 13, 2017 @03:03PM (#14547595)
Just a little nit-pick: checking for kernel extensions that don't have Apple in their name is definitely not the same as checking for 3rd-party extensions... :P
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by Razengan on Tuesday June 13, 2017 @03:11PM (#14547674)
Ah of course. Just a less cluttered starting point, I suppose :P
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by rocky1138 on Tuesday June 13, 2017 @02:08PM (#14547096)
> At the very least, turn the firewall on

It's amazing how many Mac owners have this turned off. Why?

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by Razengan on Tuesday June 13, 2017 @02:11PM (#14547131)
It’s off by default..
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by rocky1138 on Tuesday June 13, 2017 @02:56PM (#14547529)
Why?
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by anfedorov on Tuesday June 13, 2017 @03:02PM (#14547585)
Because it's annoying and it doesn't help — most people don't care for managing a firewall, nor should they. If an attacker has run an executable on your laptop, whether you block it from phoning home or not is hardly your main concern.
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by flukus on Tuesday June 13, 2017 @08:47PM (#14549965)
You don't run a firewall to prevent a compromised system from dialing out, you run it to prevent other compromised systems on the network from dialing in. Everyone on the same wifi network is an attack vector.
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by anfedorov on Monday June 19, 2017 @04:20PM (#14590112)
Good point. Most importantly, that's the far less annoying use-case: one can imagine a simple UX with a list of applications bound to LISTEN on an external interface for you to whitelist for an hour, a day, or indefinitely. I think browser exploits are still a slightly more common attack vector, but that's certainly an option.
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by lloeki on Tuesday June 13, 2017 @03:05PM (#14547615)
Because it's an ingress firewall and by default netstat -an returns zilch, so a firewall would have zero work to do.
[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by Razengan on Tuesday June 13, 2017 @02:59PM (#14547550)
┐(°—°)┌

I'm not sure, but maybe simply turning the firewall on in macOS doesn't provide any benefit if everything else is fine, and you have to lock it down and disallow all requests by default to actually get added security through it.

Edited the recommendation after reading the sibling comments.

[ Parent | on HN ]
Re:Apple Mac computers targeted by ransomware and spyware by dkonofalski on Tuesday June 13, 2017 @06:29PM (#14549213)
Because a hardware firewall is infinitely more effective. If your router has a firewall, that should be turned on first. If it doesn't, that's when you should look at turning on the Mac firewall.
[ Parent | on HN ]