Patrick Wardle, Objective-See (via Michael Tsai):
Once the target is visits our malicious website, we trigger the download of an archive (.zip) file that contains our malicious application. If the Mac user is using Safari, the achieve will be automatically unzipped, as Apple thinks it’s wise to automatically open “safe” files.
This is a pretty long read, but it all comes down to the way macOS Safari treats downloaded files, and one specific setting in Safari Preferences:
Preferences > General > Open “safe” files after downloading
Here’s a picture of that setting, a checkbox down at the bottom of the General tab. I’ve unchecked mine. You might want to take a look at yours.
Key to all this is the word archives at the end. That includes .zip files, which can contain, well, bad stuff.
Read the linked article. As I said, I’ve unchecked my setting, have not yet encountered a problem set that way. This as bad as it seems?
UPDATE: This issue has, apparently, been around since the dawn of time, but that the default is supposed to be unchecked. I just unboxed a new Mac, factory settings, no migration, and the setting was on/checked. Public version of High Sierra.
NOTHING should be opened automatically after downloading.
That it exists is bad. That it defaults to on is just insane.
Considering the steps Apple has taken recently (like adding quarantine to macOS), this setting existing at all is hard to justify. (It should be off.)
Edit: Also…
“And if you’re a Mac user concerned about security, use Google Chrome.”
No.
Seriously. Chrome for security? Pull the other one.
I’ve had that pref turned off for as long as I can remember. It’s a bad default.
Who says the default is supposed to be unchecked? Its been default “On” as long as I can remember and been flagged as a security issue since then. This has been a problem for years.
It’s unchecked on my beta of Mojave but that might have been a settings migrated from a prefs file that I’ve edited.
Sooooooo even if it’s unchecked, once a file is downloaded, how do you know if it’s “safe” to open? I’ve always assumed Safari did some kind of “pre-open” check on files before they were opened, to determine if they were safe. I could easily be wrong about this. But, again, with it OFF, you download a file you THINK is safe, and open it, and there is Pandora’s Box just waiting for you… I’m banking on Safari betting better than I am about determining which files are “safe”.
I’ve been installing fresh copies of Mac OS X for staff since its introduction. To my horror that setting has always been checked every time I set up a new user account. Apple got this one wrong.
Yeah, that was migrated. It still defaults to on. (I did a reformat.)
Yup. This and Finder’s “Show All File Extensions” (which defaults to off, and lets applications pretend to be documents) are on my hit list every time I reinstall.
Agreed. I was thinking of File Extensions as I was setting up 2 new users today. I have turning that on as part of my setup instructions. It was foolish for Apple to follow MS’ example in this regard.