That's why I'm always hesitant executing .pkg installers. Luckily, the .app in most .pkg files can simply be extracted on the command line using xar.
Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.
I trust Microsoft not to be literal malware, but I don't trust Microsoft to avoid doing stupid unnecessary crap to your Mac.
I’m not sure how relevant the difference is considering most valuable data is owned by the user, but also because MacOS has evolved the security model well beyond the UnIX standard.
Zoom used that hole to gain admin permissions and install itself before the user even completed the installation process if the user was admin[1] (and we know most people use admin accounts as their main ones). I'm sure plenty of other malware has done this as well.
If this was simply delivered as a trojan with one of those fake "Flash Player needs updating" type popups, it could have very well abused that.
If it's installing without user interaction the attack vector is a far more advanced 0day exploit chain.
I'll be very interested to find out.
I am also curious about how they can get away with using AWS and Akamai as C&C. Surely now this malware has been found, those providers will just shut down the accounts being used? They'll also have some kind of trail towards whoever's behind it, it's not like AWS takes payment in crypto.
Can you link me to an article or a piece of documentation that would explain it to a non-mac-developer?
Or for a GUI option: Pacifist from https://www.charlessoft.com/
I also chown + chmod LanchAgents and LauchDaemons in both libraries so that only root may write to it.