News for hackers. Stuff that matters.

A comment on OS X/Linker: New Mac malware attempts zero-day Gatekeeper bypass.

Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper... by saagarjha on Friday June 28, 2019 @12:27AM (#20301472)
> However, because the .app inside the disk images is dynamically linked, it could change on the server side at any time—without the disk image needing to be modified at all.

Wait, what? This makes no sense: dynamic linking means that it would pull in different libraries on the user’s machine…

[ Parent | on HN ]
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper... by isomorphic on Friday June 28, 2019 @12:47AM (#20301548)
The article author means filesystem links, not libraries. Earlier in the article:

> [...] creating a symbolic link (or "symlink"—similar to an alias) to an app hosted on an attacker-controlled Network File System (NFS) server, and then creating a .zip archive containing that symlink [...]

[ Parent | on HN ]
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper... by bodi on Friday June 28, 2019 @12:47AM (#20301547)
It's dynamic in the context of a symlink, not meaning dynamic libraries.
[ Parent | on HN ]
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper... by saagarjha on Friday June 28, 2019 @01:01AM (#20301611)
Oh, that makes more sense. That sentence would be much improved by switching those words around, because I’m too conditioned to apps being dynamically linked in the library/framework :)
[ Parent | on HN ]