XCSSET Mac Malware infects Xcode projects, performs UXSS attack on browsers

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by pritambarhate on Monday August 17, 2020 @02:17AM (#24184491)

Does anyone know a good command line malware/antivirus checker for Mac? (Paid is fine.) I do not want the antivirus to run in the background continuously (which affects performance) yet want to have ability to run nightly scans to ensure that the machine is not infected.

Almost all traditional antivirus products want to deeply integrate with the system and affect the performance a lot. Also some of these companies are know to make questionable decisions like trying to intercept HTTPS communication, etc.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by mindfulhack on Monday August 17, 2020 @02:47AM (#24184645)

I use Objective-See's free and open-source BlockBlock:

https://objective-see.com/products/blockblock.html

It picks up background daemon tasks that suddenly are created and allows you to block them immediately. That's certainly one major way to pick up and block hidden malware on your computer.

All of the tools by this guy are incredible, they are also recommended, e.g. tools to pick up and allow you to block access to microphone or camera.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by cgufus on Monday August 17, 2020 @03:37AM (#24184910)

... and definitely read objective-see's blog post from time to time if you are into security topics. The malware take-apart documentation is extremely enlightening.

(Intereseting fact: A lot of malware quits immediately if Little Snitch is installed. So running Little Snitch alone prevents some malware from infecting your system)

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by derefr on Monday August 17, 2020 @02:52AM (#24184676)

I would bet that whatever the answer is, you'd find it best by looking into what kind of antivirus software is used by ISP/business mail servers to malware-scan attachments during send/receive.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by yjftsjthsd-h on Monday August 17, 2020 @10:25AM (#24187540)

I would expect most of those to run on GNU/Linux, not Darwin?

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by jmnicolas on Monday August 17, 2020 @02:42AM (#24184617)

I don't know if it would work for a Mac, but on my personal Windows machine every month I boot on a "Kaspersky Rescue Disk" and do an offline scan of all my drives.

KRD is just a live Linux distro with Kaspersky's tools on it.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by ac29 on Monday August 17, 2020 @02:35AM (#24184583)

ClamAV?

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by mariopt on Monday August 17, 2020 @07:20AM (#24186134)

Used to be free, now it's a paid product.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by hoistbypetard on Monday August 17, 2020 @08:44AM (#24186670)

It still looks free:

https://github.com/Cisco-Talos/clamav-devel

That's licensed under GPLv2, available for download without any kind of key/password, and includes build instructions. The poster on mac could even use homebrew to install it with one command.

And they even include instructions for mirroring the signatures here:

https://github.com/Cisco-Talos/clamav-faq/blob/master/additi...

What part of it requires payment?

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by gmac on Monday August 17, 2020 @09:13AM (#24186887)

https://www.clamxav.com/ was free and is now paid — perhaps the poster was thinking of that.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by hoistbypetard on Monday August 17, 2020 @09:23AM (#24186960)

That seems likely. I forgot about ClamXAV.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by hjuutilainen on Monday August 17, 2020 @09:55AM (#24187221)

Already replied to another comment with this but you could try https://sqwarq.com/detectx/ which has command line usage included. (Not affiliated with them)

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by na85 on Monday August 17, 2020 @02:27AM (#24184542)

The only command-line malware scanner I'm aware of is rkhunter, which according to a 30 second Google search installs on mac.

I make no representations as to whether or not rkhunter actually does anything of benefit.

[ Parent | on HN ]

Re:XCSSET Mac Malware infects Xcode projects, performs UXSS ... by randomanon on Monday August 17, 2020 @05:59AM (#24185679)

If you don't mind online scanners (drag & drop), then perhaps: virustotal.com virusscan.jotti.org

[ Parent | on HN ]