Re:OS X/Linker: New Mac malware attempts zero-day Gatekeeper...
by kekebo on Friday June 28, 2019 @11:59AM
(#20305680)
Cavallarin explains it in a bit more detail on his blog[1]:
The first legit feature is automount (aka autofs) that allows a user to automatically mount a network share just by accessing a "special" path, in this case, any path beginning with "/net/". [..]
The first legit feature is automount (aka autofs) that allows a user to automatically mount a network share just by accessing a "special" path, in this case, any path beginning with "/net/". [..]
[1] https://www.fcvl.net/vulnerabilities/macosx-gatekeeper-bypas...
Assumably commenting out the line quoted by gp disables automount for network shares which start with "/net" in their path.