Hackers are installing malware on Macbooks — and there’s nothing you can do to stop them

Business Insider ^ | 08/04/2015 | Alastair Stevenson

[TomGuy]

Macbook malware.

{snicker}

[proxy_user]

Yeah, I mistyped ‘ls’ when I meant ‘ps’. If I did that on a command line, I would soon see my mistake when I get a list of my files instead of my processes. Ooops!

But this is true on all Unix machines the ‘ps’ command must be SUID root, or you could only ever see your own processes.

[Darth Reardon]

But this is true on all Unix machines the ‘ps’ command must be SUID root, or you could only ever see your own processes.

Nope. ps is NOT suid on RHEL, and doesn't have any reason to be. Access to process info is regulated by file permissions on the appropriate files in /proc.

hawk$ ls -l /bin/ps
-rwxr-xr-x. 1 root root 89480 Oct 14 2014 /bin/ps
hawk$ ps aux | grep 1441
root 1441 0.0 0.0 0 0 ? S Feb05 0:00 [ib_cm/3]
hawk$ id -u
1324

[NonLinear]

Can’t be true. There ARE no Apple/Mac viruses or exploits. I read it here all the time.

[zek157]

Not as many.

[BereanBrain]

In other news, Windows 10 IS MALWARE, no need to install anything!

[dennisw]

Apple has been in a death spiral every since Saint Steve left this earthly plane

[rlmorel]

There are some people who believe everything they read, even on FR.

[Swordmaker]

Can’t be true. There ARE no Apple/Mac viruses or exploits. I read it here all the time.

Try quoting what we've actually said, not what you want us to have said, Norm.

[IncPen]

Oh, dennis.

You poor dear.

All of us on the Mac threads are worried about your health

Get well soon!

[dayglored]

Looks like ps on my Mavericks MacMini is suid.

% dir -l /bin/ps
-rwsr-xr-x 1 root wheel 46784 Oct 31 17:18:04 2013 /bin/ps

Hmmmm...

[Swordmaker]

IMPORTANT 3rd PARTY SECURITY PATCH for OS X.10 Yosemite users ONLY!

A patch that protects OS X.10 installs from this vulnerability has been prepared by Stefan Esser, the Security Researcher who discovered the vulnerability and the exploits in the wild. This patch is merely a stopgap until Apple sends out an official fix at some future time. This patch will prevent the exploit from working.

SUID Guard Patch Software DMG

Download this (it is signed with an official Certificate so it will be safe) and extract the DMG, and click on the installer package. A restart will be required for it to protect your at risk files.

This patch is ONLY for OS X.10 Yosemite! Do not run it on earlier versions of OS X.

SUPPLEMENTAL APPLE OS X.10
SECURITY PING!

I have installed this patch and so far found no problems. — Swordmaker

If you want on or off the Mac Ping List, Freepmail me.

[palmer]

Looks like it is signed by “Developer ID Installer: SektionEins GmbH” (cert issued by Apple). I installed, now about to restart and test...

[palmer]

I reran the test from my post #19 and my system is no longer vulnerable.

Thanks for the update and ping.

[palmer]

Same here:

$ ls -l /bin/ps
-rwsr-xr-x 1 root wheel 46688 Sep 9 2014 /bin/ps

That's probably because it needs root access to get full process info.

[mad_as_he$$]

It’s on the net it must be true!!!1 /s

[Mark17]

Bump

[Mark17]

bfl