New Mac ransomware spreading through piracy

Apple puts so much pressure on security, shouldn&#x27;t it be possible to block ransomware somehow on the OS level, possibly on all platforms?<p>I mean not many apps need to modify millions of files on all drives including network drives and dongles... It should be fairly easy to spot, something like:<p>1. If xxx wants to modify more than 50 files in 24 hours go to 2.<p>2. If some of the files were modified more than a week ago or if the files are in directories across multiple drives go to 3.<p>3. If some of the files are images&#x2F;documents it&#x27;s a no go, prompt user to accept and list the affected files.<p>I&#x27;d love something like this for my Synology, it&#x27;s connected to my Macbook as a network drive and I store my backups there, if anything modifies these files without my knowledge I&#x27;m doomed. I need to access some of my backups on daily basis so it&#x27;s kinda hard to disconnect te drive all the time :&#x2F;

Has anyone tested whether this can be detected with RansomWhere? <a href="https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;ransomwhere.html" rel="nofollow">https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;ransomwhere.html</a><p>It&#x27;s a program that warns me whenever programs are locking files. In practice it&#x27;s a minor annoyance when using brew or pip. Similarly, Oversight tells me when my camera and mic are being used. <a href="https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;oversight.html" rel="nofollow">https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;oversight.html</a> It&#x27;s a minor annoyance whenever I have a video call and plug in a microphone. But it&#x27;s &quot;for my protection&quot;, and sometimes can be useful to know whether it&#x27;s really my sound settings that are the problem, or that my headphones are unplugged. These two also seem more trustworthy than anti-virus for Mac, because they don&#x27;t claim to keep me safe, just warn me when there&#x27;s a problem.

I don’t understand how people dare to run executables downloaded from a pirate site...

<i>Play stupid games, win stupid prizes.</i><p>If you cannot afford Little Snitch or don&#x27;t want to pay for it or just prefer open source, install LuLu. It&#x27;s a free and open source alternative to LS application firewall. [1] You can install it through Homebrew or download binaries manually [2].<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;objective-see&#x2F;LuLu" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;objective-see&#x2F;LuLu</a><p>[2] <a href="https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;lulu.html" rel="nofollow">https:&#x2F;&#x2F;objective-see.com&#x2F;products&#x2F;lulu.html</a>

I really appreciate you reporting this, and understand that it&#x27;s too late now but you should try to keep your source anonymous in a cases like this in case they get bad publicity where they live.

They only want $50 to decrypt the files?<p>I wonder if they actually decrypt the files for that amount or if they demand more. I keep backups, but if I somehow got hit by this, I think I&#x27;d pay the $50 to avoid losing the few days of work. (I&#x27;d have a bit of an ethical quandary about it, but I&#x27;d still probably do it if I&#x27;m being quite honest.)

Someone emailed me my password from two decades ago, and said they were going to ransomware my box, but that my porn habits were so uniquely interesting they just had to make a collage including screenshots and pics from my webcam (in the attached pdf, presumably). They’ll delete it for $1500 BTC, which is really a steal if you think about it.<p>Is there a chatbot I can point at this chucklehead?<p>&gt; <i>I really want to pay you BTC, but my computer says bit torrent was made by an unverified developer. I called my bank, and they said to ask what other ways you can accept payment. Do you know what a “Wire Transfer” is? We’re saving up for our first house, so I have the money and Ashley won’t miss it. Is $2000 OK? Please please please don’t out me!!!</i><p>And then I want it to send a dozen more of these until the scammer gives up or sends it bank account info.

Riddle me this:<p>I wonder what ROI would look like in comparison if the schemers targeted $49.98.

It sounds like whoever wrote this malware is just as crappy as a programmer as I am. Reassuring, I guess.

&gt; However, Chrome will see that the files have been modified, and will replace the modified files with clean copies as soon as it runs, so it’s unclear what the purpose here is.<p>The programs mentioned run in background almost continuously, right? If the malware modifies these, couldn&#x27;t they execute it themselves so they could have a non-suspicious looking process?

Admins should fix the link title. It should read &quot;New Mac ransomeware spreading through stupidity&quot;.<p>Installing pirated software you find &quot;on the internet&quot; in 2020 is the equivalent of spending a few hours in a confined space full of other people, none of them wearing masks. Don&#x27;t be surprised when you get sick.

Couldn&#x27;t you run the Mac equivalent of a Windows Sandbox to restrict access if you had concerns about an app?

It seems to me that the way to solve the encryption ransomware problem is to impose an immutable file system at the OS level + undo for X time and to ask for permission to write files outside a regular folder, just like microphone or screen share access.

&gt; Worse, the installer package was pointlessly distributed inside a disk image file.<p>Pirate torrent tracker forum rules often demand every single Mac app uploaded must be encapsulated in a DMG disk image file.

Thumbs up. Pay for your damn software.

You tend to get what you pay for.

just try

Why are these people trying to steal &quot;Little Snitch&quot; software? That&#x27;s not right, either. There are no clean hands here.

Viruses &amp; malware is the price of software piracy. If you don&#x27;t have money to pay for the soft, you need to be ready to be infected with all possible consequences. It was obvious decades ago when piracy become a business. I understood piracy 10-15 years ago when price of the soft was too high for Russia comparing to US. Right now most everything is subscription based and you pay only if you get enough from it, and usually regional prices are pretty sane.