News for hackers. Stuff that matters.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @03:20AM (#23710763)
> It's a good reminder to get your software from trustworthy sources, like developers whose code is "signed" by Apple to prove its legitimacy, or from Apple's App Store itself.

Just because an application is signed with a developer ID is little guarantee that it’s trustworthy. And stuff from the App Store won’t hold your Mac up for ransom, but fairly concerning software has slipped past review.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by ubermonkey on Thursday July 02, 2020 @09:12AM (#23712750)
Your computer might also be struck by a meteor, but it's pretty unlikely.

People are poor at evaluating risk, especially outside their areas of expertise. Getting software only from reputable sources is an EXCELLENT way to avoid malware. I'm not sure what your comment adds here.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by benologist on Thursday July 02, 2020 @09:15AM (#23712769)
Your computer might be struck by a meteor, but Apple has removed malicious apps from the Mac app store, and thousands from the iOS app store, despite registering the developers and reviewing the apps.

https://www.hackread.com/apple-removes-anti-malware-apps-for...

Re:New Mac Ransomware Is Even More Sinister Than It Appears by jonfw on Thursday July 02, 2020 @10:48AM (#23713782)
Obviously it doesn't eliminate all the risk, but it does eliminate quite a lot. It doesn't need to be perfect to be effective
Re:New Mac Ransomware Is Even More Sinister Than It Appears by 14 on Thursday July 02, 2020 @11:05AM (#23713999)
If Apple detected a piece of malware in the App Store and realized it had been downloaded thousands of times surely they can do something to help out those who have downloaded it? Like an update to the app to remove it possibly?

Personally I have to agree with your thoughts and I stopped torrenting years ago out of fear of a ransomware and only buy legitimate software. Younger me was not able to afford that and my security suffered as a result.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by benologist on Thursday July 02, 2020 @11:18AM (#23714189)
When Apple identifies malware they can update macOS to block or remove it. This doesn't require the Mac app store to fix, and piracy doesn't have to be the cause, for instance Mac Defender was distributed through its own websites. Ironically it was suggested this fake anti-malware software could be avoided by using the Mac app store, but malicious anti-malware software has also been spread by and removed from the Mac app store. It's the same for users either way, Apple addresses the problem.

https://en.wikipedia.org/wiki/Mac_Defender

https://www.macstories.net/news/apple-promises-os-x-update-t...

Re:New Mac Ransomware Is Even More Sinister Than It Appears by panpanna on Thursday July 02, 2020 @01:32PM (#23715747)
> downloaded thousands of times

You wish, the Xcode ghost infected apps had 500m installs in total.

They were silently removed.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by based2 on Saturday July 04, 2020 @05:24AM (#23731184)
Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @11:37AM (#23714441)
The point that just because software is signed does not make it reputable. A lot of malware is signed these days.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by gshulegaard on Thursday July 02, 2020 @11:44AM (#23714534)
True, but the quote was "signed by Apple" so the real question is how much malware is signed by Apple? I have no idea what the actual figure is, so I am mildly curious, but my hunch is not much (if any).
Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @11:48AM (#23714578)
None, Apple obviously only signs their software. I am assuming that they really meant “signed with a valid developer ID”.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by sudhirj on Thursday July 02, 2020 @04:37AM (#23711190)
And if it slips past review and you report it, it will get pulled. And might be remotely deactivated on all installs if it's concerning enough (Zoom's server). And if the developer is malicious Apple has their payment methods and verified address / identification proofs on file and will inform law enforcement.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by cptskippy on Thursday July 02, 2020 @09:17AM (#23712777)
> And if the developer is malicious Apple has their payment methods and verified address / identification proofs on file and will inform law enforcement.

A malicious developer is unlikely to provide valid credentials.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by easterncalculus on Thursday July 02, 2020 @12:15PM (#23714852)
A malicious developer might reveal details about themselves during the transaction process despite using bogus credentials. They might reuse those credentials for other things, or provide other revealing details in what they upload. So at the very least the adversary is revealing how they would obfuscate their identity, which can be connected to past or future criminal activity.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by sudhirj on Thursday July 02, 2020 @10:52AM (#23713845)
Maybe not, but there a card that was used to pay the fees, IP address logs for the uploads, whatever forged documents used for identity verification, the fake DUNS number if it was a company, bank account details if there were paid apps, etc. There’s also the hardware identifiers of any Apple hardware associated with that account, which would have been necessary for testing. There’s lots of things to subpoena.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by molszanski on Thursday July 02, 2020 @01:28PM (#23715709)
Much better than nothing.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by karatinversion on Thursday July 02, 2020 @10:14AM (#23713304)
They have to have some validity to pay the $99/y developer fee
Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @11:38AM (#23714462)
Yeah, the ability to pay $99/year. Not much else.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by s_dev on Thursday July 02, 2020 @07:42AM (#23712111)
>Just because an application is signed with a developer ID is little guarantee that it’s trustworthy.

Thats exactly what code signing is though. A little splish splash of encryption and you're sure that the Dev is part of the Apple Dev program. However trustworthy could mean many things from code thats not buggy to code thats simply not malicious. However code signing absolutely introduces a layer of trust.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by imglorp on Thursday July 02, 2020 @07:01AM (#23711932)
Also there's a ton of real products that aren't in the app store for whatever reasons. Eg setting up a new developer machine, the whole homebrew scene is an absolute must. Then you get IntelliJ, Docker, Rustup, Go, etc etc.

Code signing is obviously going to be necessary at all steps, just not via Apple.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by reaperducer on Thursday July 02, 2020 @02:27PM (#23716385)
I learned today that not all Microsoft programs for the Macintosh are in the App Store. Outlook? Yep. Teams? Nope. I wonder why.

(I also note that Teams would only install for all users of the computer, not for the person currently logged in, which I thought was strange, but it's my company's computer, so I don't care that much.)

Re:New Mac Ransomware Is Even More Sinister Than It Appears by coldtea on Thursday July 02, 2020 @06:16AM (#23711719)
>Just because an application is signed with a developer ID is little guarantee that it’s trustworthy.

It's far better than random pirate-ware tho...

Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @08:27PM (#23719676)
A lot of actual malware is signed with a legitimate developer ID. Not Microsoft or Adobe's cert, of course, but one that Apple handed out and has not (yet) revoked.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by WraithM on Thursday July 02, 2020 @03:06PM (#23716791)
The signature can be revoked. Apple does ocsp to make sure that things are still valid. If the malware is bad enough for Apple to notice, then they'd revoke the signature. Sure, plenty of scummy stuff makes it under the radar, but if it were ransomware, hopefully Apple would respond quickly to that.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by reaperducer on Thursday July 02, 2020 @02:20PM (#23716318)
Just because an application is signed with a developer ID is little guarantee that it’s trustworthy

I think this is only true if you define "little" as "not a 100% gold-plated, certified FDIC-insured guarantee."

In most contexts, saying something is "little guarantee" means it's worthless. And, as frequently documented on HN and elsewhere, that's simply not true.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by saagarjha on Thursday July 02, 2020 @08:28PM (#23719680)
No, not really. There have been multiple instances of actual malware being distributed signed with a developer ID. This isn't theoretical; being signed is no assurance because these days it's hard to get such software to run at all on Macs if they weren't signed.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by hinkley on Thursday July 02, 2020 @01:59PM (#23716087)
The landscape keeps changing, but in general phishing-style attacks are generally going to be a bigger problem than malfeasance by the actual company I'm dealing with. I also have at least some recourse in that case.

Apple has ways of punishing a publisher who is up to no good (and as we've seen, some publishers who aren't), so I can always run and tell mommy.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by sschueller on Thursday July 02, 2020 @05:30AM (#23711471)
Why is this a problem today and it wasn't one 10-20 years ago?

We didn't have walled gardens and we were fine. We had nasty viruses back then too, even some that would cause physical damage to your hardware.

Where is the personal responsibility to make sure you have backups and not install every crapware found on the web?

Are we going to require warning labels on your computers that can't be removed like airbag labels on cars soon?

I don't want a large corporation deciding what I can install and what not.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by mr_mitm on Thursday July 02, 2020 @05:43AM (#23711532)
> Why is this a problem today and it wasn't one 10-20 years ago?

Our entire lives are now handled online, which makes cyber crime much more rewarding. Businesses rely much more on the internet. On top of that, cryptocurrency makes it way easier to monetize compromised systems, either via ransomware or via crypto miners. Malware has simply become much more lucrative to criminals.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by oefrha on Thursday July 02, 2020 @06:01AM (#23711638)
> We didn't have walled gardens and we were fine.

I was about to say your memory of 20 years ago is very different from mine, until I saw

> We had nasty viruses back then too, even some that would cause physical damage to your hardware.

If that’s your idea of “fine” I’m not sure what to say.

Re:New Mac Ransomware Is Even More Sinister Than It Appears by dbt00 on Thursday July 02, 2020 @07:42AM (#23712110)
Honestly, the biggest difference is that bitcoin & friends make ransomware payments practical for the recipient/hostage-taker.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by renewiltord on Thursday July 02, 2020 @06:37AM (#23711821)
Why is the panenka common now and it wasn't before 1970? Reality changed, man. People are evolving new attack techniques. You can't go back to that. The computer is not what you thought it was.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by gruez on Thursday July 02, 2020 @09:43AM (#23712982)
>Why is this a problem today and it wasn't one 10-20 years ago?

You don't remember the drive-by downloads on windows xp? Or are we only talking about macs?

Re:New Mac Ransomware Is Even More Sinister Than It Appears by user5994461 on Thursday July 02, 2020 @05:40AM (#23711517)
20 years ago there was no broadband. You'd have to buy software on a CD and wait 3 weeks for it to arrive.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by boomboomsubban on Thursday July 02, 2020 @05:47AM (#23711556)
20 years ago was 2000, broadband was around and someone you knew had a CD burner you could use.
Re:New Mac Ransomware Is Even More Sinister Than It Appears by lvturner on Thursday July 02, 2020 @05:50AM (#23711579)
That entirely depended on your geographic location and socioeconomic status.

While the same is /still/ true it is less so now.