Comment by dwedge
2 days ago
This is only tenuously related but every single Mac app I see advertised on X by verified accounts is malware. I reported one last week to them, they said it's not malware. I appealed it and said the install link is copy and paste obfuscated base64 into your terminal, and they said after review it doesn't break their terms.
So whatever else they do, they take money to knowingly promote malware.
It's not just Mac apps. A Twitter ad is a negative indicator, and makes me less interested in the product.
> the install link is copy and paste obfuscated base64
This doesn't make it malware, as likely as it is that malware would hide itself like that. base64 encoding avoids issues with quoting and escaping in the terminal, and is an easy way to include a bit of binary data that might be needed by a command (or even just written directly to disk somewhere). "Obfuscated base64" is only saying something if you decoded the base64 and still got an obfuscated result. Install-time code execution is more dangerous in the sense that you can't review between installation and program execution; but custom installers come from the same source as the program, so it's the same number of parties to trust.
For that matter, PyPA still maintains bootstrap.pypa.io so that Python users can get current versions of pip by downloading and running a Python script that loads a base85 string, decodes it and writes a wheel file based on that. (It even duplicates some of the standard library `ensurepip` logic.)
If you want a malware report to be taken seriously, in general, you should expect to roll up your sleeves and be able to provide an analysis of concrete malicious behaviour.
> If you want a malware report to be taken seriously, in general, you should expect to roll up your sleeves and be able to provide an analysis of concrete malicious behaviour.
I reported them all the Cloudflare and Cloudflare took them down. One moved away from Cloudflare, and Twitter kept them up.
I reported another to NiceNIC and they asked for: 1. Verifiable malicious download file or sample hash 2. Screenshot or screen recording with the full URL visible 3. Evidence of malicious scripts, obfuscated code, or download chain 4. HTTP response, redirect chain, headers, or packet capture data 5. Third-party security verdict tied to the specific URL or file
I just ignored them. I don't work for them and if they want to host illegal content then it's not my business decision.
This one in particular had the download in base64, piping into Javascript and running a binary as a fake Apple Updater script.
But I am sick of this attitude that it's my responsibility for a malware report to be taken seriously. If they introduce malware bounties then ok, but otherwise I'm doing them a favour by reporting it and if they want to continue to host it after reasonable being made aware of its existence, they should be legally responsible.
> But I am sick of this attitude that it's my responsibility for a malware report to be taken seriously.
It takes no effort to make the claim, and considerable effort to act upon it. Why should they believe you, a priori?