Mac upgrade opened sshd to brute force password attacks

rachelbythebay.com

46 points·parsecs··5 comments

> For a good number of years, I've been (foolishly, as it turns out) using the included Apache httpd to run small localhost-only stuff on my Mac laptop. In recent times, I found that every upgrade of the OS would revert my httpd.conf and it would need to be put back.

I did this too until very recently as well. Finally got around to just setting up a docker image serving data from ~/Sites. I think it was the switch to an unexpected php version which convinced me.

I've just taken a look through /etc/ for anything else I may have configured which got lost. Doesn't seem much I touched myself, but seeing lots of files like /etc/shells~orig and /etc/syslog.conf~previous which are odd.

Does anyone have an example in the wild of a news site that injects something in to the clipboard on copy?

The Financial Times adds this when you copy some text from a story: "Please use the sharing tools found via the share button at the top or side of articles. Copying articles to share with others is a breach of FT.com T&Cs and Copyright Policy. Email licensing@ft.com to buy additional rights. Subscribers may share up to 10 or 20 articles per month using the gift article service. More information can be found at https://www.ft.com/tour. https://www.ft.com/content/3b5bc5cc-ce88-44c5-91c9-20d1034e1..."

I haven't seen it happen in a long time, but I've also blocked most of the offenders in my hosts file.

How would Apple feel if I sent them a trojan that disabled their ssh security config?

Would I be posting from jail?

Also, Apple has shipped 3 emergency OS updates (3GB each) in one month now. This is bad news.

Reply on news.ycombinator.com