Mac ransomware

  • Thread starter Thread starter Deleted User
  • Start date Start date
  • Views Views 3,206
  • Replies Replies 33
I don't know anything about the Windows terminology so I can't compare. But I'll define them. 'Time Capsule' is the hardware. It's essentially a plug-and-play NAS which can also operate as a wireless router. 'Time Machine' is the software component which runs on the Mac. It performs hourly incremental backups, manages the maintenance of the backup history, and provides the user interface for accessing the backed up files.

I'm assuming that the trojan encrypts Time Machine backups in the same way as other volumes. The /Volumes directory in the Mac filesystem is like /mnt in Linux - it contains the mount points for all external storage devices (and, in fact, the boot device as well). It would be pretty stupid to have your Time Capsule mounted permanently (thus with a mount point folder constantly in /Volumes). The Time Machine software automatically finds the Time Capsule on the network, mounts it, performs the backup and then unmounts it. Presumably the trojan could carry out the encryption while the backup is in progress, however. I've actually got a spare Time Capsule I've been meaning to set up, so I might connect it up and do a full backup onto it to keep offline and just update it periodically.

Thank you for the helpful explanation!
 
I'm not installing Transmission any time soon, then: I'm going to keep with qBittorrent.
Could this be possible to infect on a Unix-based system, since Mac is either based on BSD or Linux.
 
This is why I love my Time Capsule. Restore the file in seconds, then kindly tell the ransomers to fuck off.
the devs behind the ransomeware were even planning on encrypting your time machine backups... :) but yes in the released stuff it is not there
 
Now we need a MAC antivirus. haha
I say you don't with Linux, but Linux actually has several anti-viruses built into the kernel. Linux actually can get viruses, they just can't get kernel access unless you give them kernel access. Otherwise infected programs won't run.
 

Site & Scene News

Popular threads in this forum