from Hacker News

Handbrake malware analysis

by zalmoxes on 5/7/17, 12:19 AM with 28 comments

• by untangle on 5/7/17, 4:40 AM

  For those Mac users who are unfamiliar with objective-see... Their free security tools for MacOS are a boon to the community. I think that they are right up there with "little snitch" and the like, especially since they spare the user the typical IDS data overload.

• by AsyncAwait on 5/7/17, 8:34 AM

  I think hosting the Handbrake, (and Transmission) binaries on the GitHub releases page of the repo would be harder to compromise than their own servers.

• by coldcode on 5/7/17, 1:07 PM

  If you look at the XProtect files, the syntax is pretty funny.

      condition:
          Macho and filesize < 600000 and filesize > 10000 and all of them

• by awinter-py on 5/7/17, 5:06 PM

  Article talks about a fake authentication popup.

  Has anyone used a platform that had an unspoofable one of these?

• by differentials on 5/8/17, 3:36 AM

  If you used brew install handbreak between May 2nd and 5th, you downloaded the malicious version; - https://github.com/caskroom/homebrew-cask/commit/461af7672fa... The pull request has comments as well, and a snarky dev ;D - https://github.com/caskroom/homebrew-cask/pull/33354

• by atmosx on 5/7/17, 7:50 AM

  The only actual counter-measure would be to take the extra step and calculate the SHASUM of the binary.

  The shasum need to be digitally signed with a valid signature otherwise it can be manipulated as well.

  ps. Ofc tools like littlesnitch and blockblock help, but keeping track of all the applications that try to access the internet is kinda hard these days, especially on a user machine.

• by merb on 5/7/17, 11:04 PM

  that's the reason why i install most mac programs that come from a website into user programs. this only works for programs that don't add stuff to the system of course.