Ransomware on MacOS

I thought about it for some time. Frist I try to take some (lazy) precautions steps.

  • Never run a Mac OS in Admin mode.
  • Always update system
  • I save the most important files peridically on offline drives ( i have two different one so if by change the ransomedware is already active as I backup files the other disc is not affected and I loose only recent files)
  • Chose the apps I install with cousion,
  • Try not to use software the is integrating deep in the system as this might open another attack vector.

I guess as Iā€™m not a target if high value this should be sufficient

1 Like

I wouldnā€™t worry about its age. Patrick will certainly update it at some point, but until then, running it under Rosetta is not going to be a resource drain.

Patrick is extremely bright (ā€œbrilliantā€ might be a better word) and I never noticed a difference in system performance running it on an Intel Mac. The Apple Silicon Macs are so much faster and more efficient that Iā€™d be surprised if there was any noticeable difference at all in running the Intel version.

Back to the code itself: my understanding is that the app looks for types of behavior which indicate that code is being obfuscated/encrypted. While this can sometimes cause false positives (I believe that I ran into a few instances where using the compression tool xz made the app warn me), it is simple enough to respond to an alert and say ā€œNo, that process is OK, allow it.ā€

As such, there probably isnā€™t much need for the code to be updated because it is searching for heuristics (I believe thatā€™s the correct word) which are far less likely to change over time.

Thatā€™s my opinion, which I offer for free and with no guarantees. Iā€™d certainly prefer to run RansomWhere than not, even with its imperfections.

2 Likes