macOS Ransomware in One Tweet

Yes, if you deliberately run commands as administrator to create an encrypted volume, then move all your files to that encrypted volume, I suppose you've gotten yourself into a quandary.

This isn't a vulnerability, as suggested by the "Apple was notified one month ago" comment. It's neat that all those commands fit into one tweet, but ransomware it is not.

It may be considered a best practice to avoid creating new encrypted volumes with unrecorded passwords, moving all of your data onto same, then sending the passwords off to some C&C server.

Loved @mklovenotcyber's optimization down thread[1] making the one-liner's password generation routine even less verbose, from the original:

head -n 1024 /dev/urandom | strings| grep -o "[[:alnum:]]" | head -n 64| tr -d "\n"

to the terse:

head -c 47 /dev/urandom | base64

[1] https://twitter.com/mklovenotcyber/status/131466157218331443...

“rm -rf when ran under sudo deletes everything”

Oh no, how do I report this!?

No ransomware is complete without the customary ASCII art of a skull.