Jul. 13th, 2016

leo_sosnine: (Default)
Из малваребытес:

https://blog.malwarebytes.com/cybercrime/2016/07/mac-malware-osx-keydnap-steals-keychain/

The Keydnap malware installs via a new twist on an old theme. The “dropper” (the program that installs the malware) comes in the form of a harmless document. Many different forms have been discovered, masquerading as Microsoft Word files, JPEG images and plain text files.

There have been a number of different ways that malware does this, but Keydnap uses a new trick: it puts a space after the extension in the file name. So, for example, what looks like an image file named “logo.jpg” is actually named “logo.jpg “, with a space at the end.

Turns out that space is important. It prevents Mac OS X from seeing the “.jpg” as a file extension, so it doesn’t think the file is actually a JPEG. Since the file is really a Mach-O executable file, double-clicking it will run it in the Terminal, rather than opening a JPEG file as the user would expect.

Once executed, the dropper will install a launch agent to keep a malicious process called icloudsyncd running at all times. It will also download and open a decoy document of some kind, designed to match what the dropper file is pretending to be. Finally, it will quit the Terminal to cover up that it was ever open.


Ыхыхыхыхыхыыхых

Единственный резон почему на макоси мало вирусни заключается в том, что её почти никто не юзает, сл-но низкий return on investment. Представляю, что бы там было, если бы макось занимала большую часть рынка персонального компутенга.
Page generated Jul. 19th, 2025 08:43 am
Powered by Dreamwidth Studios