#Homebrew docker desktop install#
#Homebrew docker desktop download#

If I were an attacker, just hypothetically, IвЂ™d love for my persistence method to be a legit feature, since it would blend in nicely, and be less likely than a bug to be removed in a future update. not by finding and exploiting a bug) because, well, itвЂ™s already a feature. I was hoping to find a way to use one of these apps in a legitimate way (i.e. There are many legit apps that want to do the task: вЂњrun a program, and keep it runningвЂќ. These apps have much less security review than macOS itself, and are developer tools, so even more likely to trade off security for more powerful features.

Why, they often install, at a minimum, things like Homebrew, Docker, iTerm2 etc.

#Homebrew docker desktop install#

They install all this extra stuff to get work done, especially if they're software developers. But, people's computers don't actually run plain, fresh macOS, like they're straight out of the Apple store. I realised everyone 's trying to persist on macOS, so it's hard to find something that nobody has tried yet. The current state of the art is to use a LaunchAgent (the macOS equivalent of a cronjob/recurring task) to automatically run your malware whenever the computer starts up. The ways of persisting (keeping your malware running, even if the computer restarts/updates/etc.) on macOS that I knew about were pretty basic. Hmmm, where should I look for a new technique? It's hard to find something if you don't know what it looks like. So, I realised my best shot was to try and find a new way of hiding, that nobody's seen before. check in all the common hiding places? Those kind of rare events become much more likely if they have a whole year to happen. What if, during that year, someone decided to just. I was thinking we probably weren't going to get away with using a technique for hiding that anyone could just Google. We'd need to make sure that the malware didn't obviously stand out, make sure it didn't crash the user's computer, and make sure it didn't get removed when the computer was rebooted, or had a system update. a long time to hide on someone else's computer, by my standards.

#Homebrew docker desktop download#

This is what attackers want because they can download secret files, turn things on and off, and generally do anything you can do with your computer.ДЄ year is. By 'malware', I mean 'remote access software': You can control their computer from your computer. The goal was to install malware, and keep it there. One day, my teammate asked me what I thought it would take to hack a computer, and then keep it hacked for a long time, like a year.

Playing hide-and-seek on someoneвЂ™s computer for a long time The time has now come for a gratuitous and ultimately superfluous flashback to how it all started. IвЂ™m writing this because I realised the techniques for how we do research are sometimes just as valuable as the research itself.Д«ut thatвЂ™s me saying this now, on the other side of my mad scientist moment. This post is the high-level story of how this technique was found, in which the story makes the thrilling transition to first- person.ДЇirst things first: If youвЂ™re reading this, we somehow got away with calling it вЂњ Icarus LabsвЂќ. If you'd rather skip straight to the technical details, here's the blog post explaining how it all works.