Hacker News Reader

Comment by wlesieutre | Hacker News Reader

It might be as simple as an automated "look for ssh keys" in the malware. If you find an SSH key, pretty good odds it's a developer. Scan for git repos, or check their email address to see where they work and go from there.

View on HN

This makes me wonder, is it easy enough to write a kernel extension such that whenever any process that tries to open(2) my ssh private key, or any hardlinks or symlinks pointing to it, it checks against a known whitelist, and if the process is not in the whitelist, a dialog pops up and asks me for my permission. Is this easy to implement?

Frankly I can only think of a small number of processes that need to automatically access the file: backupd, sshd, and Carbon Copy Cloner. Everything else should require my attention.

Alternatively, sidestep open(2) by implementing a SSH agent so that you can do creative things like https://krypt.co does, so the key is not laying right on your main filesystem in the first place (and possibly not even ever on the workstation).

Good idea! Talk to this guy:

https://objective-see.com/products.html

It's called Little Flocker.

Essential OSX software.

Looks like F-Secure just bought it in the last month or two. :(

In this case the attacker actually guessed the names of the git repos based on knowlege that the owner of the attacked computer was a Panic employee. The attacker guessed the repo names was Panic software names. So it was a very manual process indeed

Yeh sure, but possibly (probably?) after an automated process shifted through all the victims looking for what's described above. Once you've got a shortlist of potentially more valuable targets you can invest manual efforts on those.

Reply on news.ycombinator.com