TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

XCSSET Mac Malware infects Xcode projects, performs UXSS attack on browsers

175 pointsby wincentalmost 5 years ago

7 comments

pritambarhatealmost 5 years ago
Does anyone know a good command line malware&#x2F;antivirus checker for Mac? (Paid is fine.) I do not want the antivirus to run in the background continuously (which affects performance) yet want to have ability to run nightly scans to ensure that the machine is not infected.<p>Almost all traditional antivirus products want to deeply integrate with the system and affect the performance a lot. Also some of these companies are know to make questionable decisions like trying to intercept HTTPS communication, etc.
评论 #24184645 未加载
评论 #24184676 未加载
评论 #24184617 未加载
评论 #24184583 未加载
评论 #24187221 未加载
评论 #24184542 未加载
评论 #24184870 未加载
评论 #24185679 未加载
sam_goodyalmost 5 years ago
Is there a good on-demand antivirus for Mac?<p>The only two I know of is Malwarebytes and Kaspersky.<p>The former installs with root privileges, runs on boot and cannot be ever closed, despite the fact that it is only an on-demand scanner. I&#x27;ve written to them to request an explanation, and did not get any response.<p>Kaspersky has had a fair share of rumors against it, and I am not in a position to evaluate if they are trustworthy.
评论 #24187176 未加载
评论 #24188063 未加载
评论 #24203455 未加载
GuB-42almost 5 years ago
Reminds me of the &quot;Induc&quot; virus.<p>This virus infected Delphi installations, injecting its code and compiling it into a system library. All programs using the infected library contained the virus, including some popular ones.<p>Because they came straight from the developer, and the virus didn&#x27;t do anything unless you had Delphi installed they were often considered false positive when they weren&#x27;t. Originally, it had no malicious payload beside its replication mechanism.
btownalmost 5 years ago
&gt; Affected developers will unwittingly distribute the malicious trojan to their users in the form of the compromised Xcode projects, and methods to verify the distributed file (such as checking hashes) would not help as the developers would be unaware that they are distributing malicious files.<p>To understand why this happens, it&#x27;s important to know how massive a typical .pbxproj file looks:<p><a href="https:&#x2F;&#x2F;opensource.apple.com&#x2F;source&#x2F;CommonCrypto&#x2F;CommonCrypto-24911&#x2F;CommonCrypto.xcode&#x2F;project.pbxproj.auto.html" rel="nofollow">https:&#x2F;&#x2F;opensource.apple.com&#x2F;source&#x2F;CommonCrypto&#x2F;CommonCrypt...</a><p>Ostensibly it&#x27;s human-readable, but because it&#x27;s generated by Xcode and filled with inscrutable UUIDs, people treat it like a binary file, and they&#x27;re trained to do so:<p><a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;2004135&#x2F;how-to-merge-conflicts-file-project-pbxproj-in-xcode-use-svn&#x2F;2007358" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;2004135&#x2F;how-to-merge-con...</a><p>Even the React Native team apparently allowed the file to be treated as non-diffable for some time: <a href="https:&#x2F;&#x2F;github.com&#x2F;facebook&#x2F;react-native&#x2F;pull&#x2F;11047" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;facebook&#x2F;react-native&#x2F;pull&#x2F;11047</a><p>And note the large number of commits on all types of projects that essentially say &quot;whoops forgot to update pbxproj&quot; - there are likely far more. <a href="https:&#x2F;&#x2F;github.com&#x2F;search?q=update+pbxproj&amp;type=Commits" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;search?q=update+pbxproj&amp;type=Commits</a><p>So why does this matter? Because the brilliance of this attack is how it &quot;jumps the blood-brain barrier&quot; between a developer&#x27;s machine and their canonical codebase. Usually, code review and auditing of what goes into a commit prevents this kind of attack from leaping to VCS. But Apple makes the pbxproj so inscrutable, and does such a good job at hiding all its complexity behind (usually well-designed) wizards and dropdown menus, that people take it for granted. If code shows up there, people <i>believe Apple intended that to be the case</i> even if, say, your last commit was a small change in Interface Builder (or whatever they call it nowadays). Your code reviewer might just skip the file entirely, because they&#x27;ve been trained to expect the same.<p>And that&#x27;s scary.<p>At the end of the day, this is just another way of exploiting the lack of a mature and centralized CI ecosystem in the modern package distribution world. There&#x27;s no organization running a security-minded linter on pbxproj files as a general rule. But, then again, there doesn&#x27;t need to be a linter on package.json or project.clj or Makefiles because there was never a history of hiding complexity - if that file changes, you&#x27;d better darn well know what you&#x27;re doing. What we have here is a perfect storm of move-fast-break-things package management, a file designed to slip through code reviews, and a pretty creatively designed malware payload.<p>EDIT: Perhaps another way to look at it is that having one file responsible for both compilation <i>logic</i> and non-compilation-related IDE-specific <i>file status</i> can be problematic. It&#x27;s like your Makefile also needs to be your .gitignore-but-only-top-level-is-allowed-and-all-files-need-to-be-whitelisted. Of course, this is very much an Apple thing to do.
评论 #24184455 未加载
评论 #24186539 未加载
Thorrezalmost 5 years ago
Wow, the way it spreads is fascinating, reminiscent of Reflections on Trusting Trust.<p>I&#x27;m a bit confused about<p>&gt;two zero-day exploits: one is used to steal cookies via a flaw in the behavior of Data Vaults, another is used to abuse the development version of Safari.<p>Malware on the local machine can steal data from Safari on the local machine. Is that a surprise? Does Safari have a threat model that it intends to protect against locally running malware?
评论 #24183974 未加载
评论 #24184134 未加载
评论 #24183880 未加载
jayyhualmost 5 years ago
For those curious, the two Xcode projects they found infected on Github were:<p><pre><code> ragulSimpragma&#x2F;twitterTask yimao009&#x2F;MVC-MVP-MVVM </code></pre> Fortunately they look like personal projects so the spread seems minimal so far.
评论 #24184295 未加载
评论 #24183873 未加载
swileyalmost 5 years ago
Bummer there’s pretty much one set of tools for the mac.