New Mac ransomware spreading through piracy

Re:New Mac ransomware spreading through piracy by Polylactic_acid on Tuesday June 30, 2020 @07:31PM (#23696036)

I'm on several private torrent sites and I still wont run software out of a VM. The problem is the users are trusted but unless they packaged the crack themselves they don't even know if there is malware bundled in. Its easy to verify that audio or a book is high quality but verifying software is next to impossible.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by austhrow743 on Tuesday June 30, 2020 @08:40PM (#23696478)

Software on private torrent sites comes straight from the scene, who treat their hobby pretty seriously.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by Cyph0n on Tuesday June 30, 2020 @08:45PM (#23696522)

Exactly. Scene groups are tight knit and very professional.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by techntoke on Wednesday July 01, 2020 @03:26AM (#23698759)

Unless you piss them off and become their target

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by dewey on Wednesday July 01, 2020 @07:19AM (#23700225)

If it's not a 0day tracker they usually unpack the scene files and repackage them so you don't have the split archive files. It wouldn't be hard to slip something in in this process.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by philliphaydon on Tuesday June 30, 2020 @09:35PM (#23696794)

One of the things I miss in Windows 10 I don't have on Ubuntu is 'Windows Sandbox'. It's great for testing software out. It loads pretty much instantly.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by heavyset_go on Tuesday June 30, 2020 @11:22PM (#23697429)

Look into Firejail.

https://firejail.wordpress.com/

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by aj3 on Wednesday July 01, 2020 @07:22AM (#23700237)

There are so many ways to escape Firejail, that no one should seriously rely (solely) on it for security. Please, just use proper virtualization for trying shady software/suspected malware.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by panpanna on Wednesday July 01, 2020 @05:18AM (#23699517)

If you are going that route you are better of with LXC or Docker. IIRC LXC is part of the 20.04 install.

Or use Vagrant if you want better security.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by philliphaydon on Wednesday July 01, 2020 @12:34AM (#23697774)

Thanks!

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by wsc981 on Wednesday July 01, 2020 @01:58AM (#23698217)

Is there such software for macOS?

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by aj3 on Wednesday July 01, 2020 @07:20AM (#23700230)

Sure: https://www.virtualbox.org/wiki/Downloads

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by saagarjha on Wednesday July 01, 2020 @04:25AM (#23699193)

I don’t think anyone has packaged this up, although the tools are there.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by leoh on Wednesday July 01, 2020 @02:44AM (#23698483)

This is 100%. I'm not sure, however, that I even trust PDFs these days. Somewhat paranoid there are zero days on libgen, etc.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by cpach on Wednesday July 01, 2020 @05:27AM (#23699580)

Sure, PDF is a bit hairy. But you also can choose to not use Acrobat Reader. If you use e.g. Preview (macOS) or Evince (Linux) then I would wager that it’s not exactly trivial to get remote code execution. (Most probably possible though, but it would probably take some work.)

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by leoh on Monday July 06, 2020 @05:20PM (#23752882)

I think all clients are a bit questionable since it's such a complex format and because most clients are not written in safe languages. Although they're rarer, even Mac OS X's Preview.app has had CVEs.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by aj3 on Wednesday July 01, 2020 @07:28AM (#23700284)

Here's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous snapshot after viewing the file) or install Qubes where this is default behaviour.

[ Parent | on HN ]

Re:New Mac ransomware spreading through piracy by wolfgke on Wednesday July 01, 2020 @04:54AM (#23699369)

> Somewhat paranoid there are zero days on libgen, etc.

Do you have an alternative to trusting them?

[ Parent | on HN ]