Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Aren't the keychain passwords crypto-graphed?

What's the point of finger auth and typing a password if a stealer can steal the file with all the passwords????

The app asks the user for permission in a sneaky way, calling itself "MacOS" (note the capital "M" instead of lowercase "m"). Once granted permission, yes, it can read anything — because the user gave it that access.
 
So is I have used Little Snitch to alert me anytime anything wants to communicate w the web, I got it made, right?
This, or Lulu (https://objective-see.org/products/lulu.html) will definitely help alerting you of new outgoing connection attempts (for example if some new app wants to connect out) - providing they are configured in a way to block and prompt by default.

I actually block all by default (including Apple apps) - it is interesting to see which things connect to places (but this will result in lots of prompting just after you enable the outgoing firewall).
 
Does this app require one to authenticate in order to install it?

If so, duh.
 
Without reading, my guess is:
Once a user downloads, executes and provides their password IT CAN DO STUFFS!

After reading:
A .dmg file is used to get the malware on a victim's machine, and once installed, it immediately begins accessing sensitive information and sending it to a remote server. A fake system prompt is presented to get access to the system password, and it asks for access to files in the documents and desktop folders.

Because this requires a user to click on a .dmg file to install, Mac users can avoid the malware by not installing any kind of untrusted software from an unverified source. Cyble Research recommends installing software from the Mac App Store, using strong passwords and multi-factor authentication, and using biometric authentication where possible.
Of COURSE this is how it works. :)
 
Last edited:
Is now a good time to talk about that hilarious thing that Apple calls macOS firewall?

If you are running macOS you should really be running Lulu or something similar.

(this matters because you will be prompted about outgoing connection attempt)
Yup Lulu prompts for everything.
 
This is the future for iOS once sideloading comes, and many iOS users will not be ready. Not taking a side about sideloading here. Just saying this will happen. Apple needs to step up even more on security for iOS.

And maybe provide much more education? Right now Apple itself provides also no education on proper user habits when it comes to protecting themselves.
 
Aren't the keychain passwords crypto-graphed?

What's the point of finger auth and typing a password if a stealer can steal the file with all the passwords????

Far superior to being a text file or written down in a notepad where a much less sophisticated thief can gain access to all passwords. If you want near-100% security, fully separate password storage from internet access. That means OFF the computer but still thoroughly encrypted for the other kind of thieves.
 
This, or Lulu (https://objective-see.org/products/lulu.html) will definitely help alerting you of new outgoing connection attempts (for example if some new app wants to connect out) - providing they are configured in a way to block and prompt by default.

I actually block all by default (including Apple apps) - it is interesting to see which things connect to places (but this will result in lots of prompting just after you enable the outgoing firewall).
Don't forget to chip in for objective see stuff
 
  • Like
Reactions: 3xBoom and diggy33
So is I have used Little Snitch to alert me anytime anything wants to communicate w the web, I got it made, right?
You’ve got it MORE made if you just don’t
download random .dmg files from the internet,
open those .dmg files,
execute the application IN those .dmg files and
then, when asked for a password, actually supply it.

Don’t do that (and don’t let anyone use your login) and you don’t have anything to be concerned about from this particular thing.
 
This is the future for iOS once sideloading comes, and many iOS users will not be ready.

No, how long have Macs been around? And how long have Mac users been able to get their apps from any source? And how devastating has that flexility been for the majority of Mac people?

Yes, there are cases but relatively few and far between. The App Store is not immune either- occasionally a nefarious app gets through and affects users who downloaded that app. Windows runs on far more computers and has far more viruses/trojans/malware (and far more bad guys trying their best to do this kind of thing there) and yet there are not really that many cases where someone's life is destroyed even in that Windows world due to this sort of thing.

We don't need "security" to scare the masses into embracing a monopoly scenario of buying from one and only one source. No consumer wins when all competition for their business is reduced down to a single seller. I cannot recall any situation in all of history where a single seller does not exploit their exclusive position... until competition shows up and drives down pricing for the same products or services.

Consumers simply need to be smart and make good decisions about who they trust. Will even the smart ones get that wrong sometimes? YES. Does even Apple let a bad app in the App store sometimes? YES.

But no need to cede competitive marketplaces to single sellers out of this type of fear. Anyone that afraid can already embrace getting their apps from the divine, one and only. Everyone else should prefer to hang on to the great power of consumer flexility to shop around and choose for themselves vs. trust one- and only one- seller. There is no consumer win in that scenario... only an illusion of one... much like the illusion that the whole world will be destroyed once people can choose to get apps for their iDevices from sources other than Apple. We've had periods where that has been possible too (jailbreaking) and there was never any story where all who dared buy elsewhere suffered devastation, fire & brimstone.

Again, anyone too afraid to shop from other stores, won't have to do so. They can maintain their illusion of security by continuing to buy from only Apple. However, others may prefer some genuine Capitalism competition, the concept of more of the money we pay potentially reaching those who create what we buy, AND the flexibility to have apps that Apple refuses to allow for any old reason (not always an actual good reason).

IMO: just as we are with Mac apps, we will be better off when there is more than one seller of iDevice apps. And just as we experience with our Macs, the odds in the impending doom & destruction spun by that potential seems farrrrrrrrr overblown. We already know this because our Macs are loaded with the same keychain, the same private information, etc. We simply pretend that it will be different with iDevices for some reason. Why? Mostly because Apple says so. Why? Because there is a LOT of easy revenue in Apple's cut of every single sale in the one and only iDevice store. No exclusive seller of anything EVER wants competition... and will say & do ANYTHING to try to maintain their lock on that easy money.
 
Last edited:
Except Apple allows crapware onto their Mac App store too
Too right! And the same kind of non-thinker that would download and execute random .dmg’s (AND provide their passwords) would very likely see stories and links ALL about ChatGPT, even links to the free sites where they can experience it, then ignore all that and specifically look for a SUBSCRIPTION service for ChatGPT.

It’s a concern but people have very many ingenious ways to get themselves into a predicament and then blame someone else :) No one will ever be able to stop stupid from being stupid, try though they might!
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.