Apple Details Terminal Anti-Scam Warning in macOS

[mlayer]

Got that warning when I cut and pasted the command to get off the Siri AI waitlist last week. Well, it worked in terms of the efficacy of the warning and my ignoring it to complete the task.

 

[dimon2242]

I hate it...

 

[Black_Mage]

Just an idea. If you're thinking about pasting a command into the Terminal, paste it in A.I. chat and ask what the command will do. Same thing for Linux.

 

[MilaM]

Just an idea. If you're thinking about pasting a command into the Terminal, paste it in A.I. chat and ask what the command will do. Same thing for Linux.

Many commands will download a payload using curl and then pipe it into bash. It might not be enough to just understand what the command does. The AI would need to download the script and analyze the content.

 

[MacBH928]

how about showing the warning in the terminal and explaining whats going to happen exactly if you run the command then get Y/N prompt instead of this ugly pop up

 

[MacBH928]

Just an idea. If you're thinking about pasting a command into the Terminal, paste it in A.I. chat and ask what the command will do. Same thing for Linux.

thats what Siri that lives in your terminal is for 😛

 

[shamino]

If a scammer said go to a cliff and jump they would do it…

Yep. And there's history. Years ago, there was the Beagle/Bagel virus which infected a lot of computers. In order to avoid detection by antivirus scanning software, some variants would transmit itself as an e-mail with the payload in an encrypted Zip file. The body of the e-mail directed users to save the attachment, unpack the zip file (with the password provided in the mail), and then execute the contents.

Far too many people obeyed and got infected. So yes, some people will do anything they're told to do, without giving it a single thought. But everybody makes occasional mistakes, and a feature like this will give them a chance to reconsider.

People and their (perhaps less tech-savvy) relatives should be aware of the "pastejacking" scam which is becoming more common. You come across a website (could be one mostly legit but with pages now hacked), asking you for a "verification".

I came upon one recently. It throws up an "I am not a robot" button to click, while at the same time dumping some text into your clipboard via javascript (which is actually a shell script command obscured from casual inspection by being encoded as base64). Underneath the "I am not a robot" button there are further instructions that ask you to, basically, open the Terminal app and "press certain keys".

And this is exactly what this new feature is designed to protect against. It can be especially nasty, because the text copied to the clipboard doesn't come close to resembling the text on the web page, which the user (presumably) thinks he's copying.

The only thing Apple should change here, is the warning dialog should have a button to show what would be pasted, so you can see it before deciding what to do. So if I'm copying instructions from a web page (e.g., a tip from a user in a forum), I want the warning, but I also want to make sure I'm pasting what I think I'm pasting.

 

[mw360]

Looks like hackers have taken over Gizmodo today. This fake Captcha scam is blocking entry to the site and putting malware on the clipboard.

 

[Nermal]

Scammers often encourage pasting text into Terminal to try and harm your Mac

Shouldn't it be "try to harm"? Otherwise it reads like "they'll try, and they'll harm it", at which point why even have the "try" there?

I know that people say "try and" in casual speech, but this is an OS warning, not a casual chat.

 

[mw360]

Looks like hackers have taken over Gizmodo today. This fake Captcha scam is blocking entry to the site and putting malware on the clipboard.

View attachment 2639620

Gizmodo is down for maintenance today. I wonder how many visitors there managed to find the Terminal key on their Mac keyboards.

I must admit, since Captchas have been getting more elaborate recently I fell for this for a second. It’s very well put together yet utterly stupid. I guess this is what we get now the scammers have AI to help outwit us.