Hacker News Reader

Comment by masto | Hacker News Reader

I'm a bit surprised at the "personalized attention" from the attacker: that a human on the other end takes time to poke around individual machines, recognize the developer, and tailor a source code theft + ransom campaign to them. I had assumed that these are bulk compromises of at least thousands of machines and they just blast out scripts to turn them into spam proxies or whatever.

Maybe given the limited scale of this one and the obvious interest the attacker has in producing trojaned versions of popular software, this is actually what they were hoping for in the first place.

View on HN

Even the Mac's malware authors are more hands-on, engaged, and approachable :)

It might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.

This makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement?

Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.

Alternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).

Good idea! Talk to this guy:

https://objective-see.com/products.html

It's called Little Flocker.

Essential OSX software.

Looks like F-Secure just bought it in the last month or two. :(

In this case the attacker actually guessed the names of the git repos based on knowlege that the owner of the attacked computer was a Panic employee. The attacker guessed the repo names was Panic software names. So it was a very manual process indeed

Yeh sure, but possibly (probably?) after an automated process shifted through all the victims looking for what's described above. Once you've got a shortlist of potentially more valuable targets you can invest manual efforts on those.

Standard practice in lead-generation these days :) You want to devote your efforts to the most potentially-rewarding opportunity.

Reply on news.ycombinator.com