Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by obituary_latte on Friday June 28, 2019 @07:42AM
(#20303316)
What does that do?
[ Parent
| on HN ]
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by kekebo on Friday June 28, 2019 @08:01AM
(#20303400)
From the article:
For home users, unfortunately there isn't a simple solution for preventing this type of attack, until or unless Apple releases a macOS security update to mitigate the vulnerability. Cavallarin describes a possible temporary mitigation (opening /etc/auto_master in a text editor and adding # to the beginning of the line that starts with /net).
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by jonnycomputer on Friday June 28, 2019 @10:04AM
(#20304373)
what are the implications of making this change to auto_master, beyond risk mitigation (i.e. to everyday use)?
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by kekebo on Friday June 28, 2019 @11:59AM
(#20305680)
Cavallarin explains it in a bit more detail on his blog[1]:
The first legit feature is automount (aka autofs) that allows a user to automatically mount a network share just by accessing a "special" path, in this case, any path beginning with "/net/". [..]
[1] https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypas...
Assumably commenting out the line quoted by gp disables automount for network shares which start with "/net" in their path.
Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by wool_gather on Friday June 28, 2019 @11:06AM
(#20305025)
I am wondering this too. I see that `man auto_master` describes the purpose and format of the file, but I'm still trying to grok it.