I made this tool for macOS systems that helps detect when a package accesses something it shouldn't. It's a tiny go binary (less than 2k LOC) with no dependencies that will mount a webdav filesystem (no root) or NFS (root required) with fake secrets and send you a notification when anything accesses it. Very stupid simple. I've always really liked the canary/honeypot approach and this at least may give some folks a chance to detect (similar to like LittleSnitch) when something strange is going on!

When to use which mode? Use WebDAV for low-friction canaries you can spin up anywhere. Use NFS for canaries that need to survive an attacker who has your user shell and is looking around.

Comments URL: https://news.ycombinator.com/item?id=47548938

Points: 2

# Comments: 0

that's a really good point and could be an interesting thing to play with as an extension. Since we potentially know which process is doing the "read" we could ask the user if it's ok to kill it. obviously the big issue is that we don't know how much has already been shipped off the system at that point but at least we have some alert to make some tough decisions.

I was thinking for the license I'd do GPLv3. Would that work for you?

I made this tool for macos systems that helps detect when a package accesses something it shouldn't. it's a tiny go binary (less than 2k LOC) with no dependencies that will mount a webdav filesystem (no root) or NFS (root required) with fake secrets and send you a notification when anything accesses it. Very stupid simple. I've always really liked the canary/honeypot approach and this at least may give some folks a chance to detect (similar to like LittleSnitch) when something strange is going on!

Next time the attack may not have an obvious performance issue!

Apple will offer a grace period for developers to become familiar with the forthcoming privacy requirements.

Beginning in fall 2023, Apple will email developers via when an app uses a privacy-impacting SDK without providing a privacy manifest or taps a required reason API without specifying a valid explanation in the privacy manifest. Starting in spring 2024, the privacy manifest will become mandatory and Apple will begin enforcing that requirement as part of the app review process.

Comments URL: https://news.ycombinator.com/item?id=38278865

Points: 1

# Comments: 1

Currently available in beta, the NowSecure Observer developer tool simplifies mobile privacy and security during the coding stage. It provides real-time visibility into how sensitive data is being used, stored and transmitted by first- and third-party code. It also enables developers to quickly resolve security and privacy issues and avoid App Store surprises and rejections.

Once developers add it to their iOS project, the NowSecure Observer SDK collects telemetry as the developer codes and at runtime during pre-prod testing. The SDK feeds information to the NowSecure Observer web app so you can see data flows, observe dependencies that have been introduced over time and generate Apple privacy manifests and mobile Software Bill of Materials (SBOM) reports. In addition, line of code-level detail and backtrace context ease remediation so developers understand what issues are critical to address and how. Developers can also receive guidance through the app store submission process in the form of a customized publication checklist to avoid rejections, and secure code training from NowSecure Academy.

Comments URL: https://news.ycombinator.com/item?id=38278778

Points: 1

# Comments: 0