There’s a new file type on the rise that could have serious consequences for your Mac - and for your data. It’s called " ransomware." Ransomware is a type of malware that encrypts files on your computer, demanding money in order to free them. If you don’t pay up, the ransomware can lock you out of your computer and even delete any files you’ve worked on. If you’re not familiar with ransomware, it’s important to be aware of it because it’s a very dangerous file type that could take over your Mac if left untreated. So don’t let this dangerous file type take over your Mac - get help from an expert to protect yourself from this threat!
Don’t Open These Shortcut Files on Your Mac
Park Minchan, an independent security researcher, discovered a vulnerability in the operating system that lets threat actors control your device. Basically, shortcut files with the .inetloc extension can have commands embedded inside them, which can execute all sorts of things.
If someone sends you a file with the .inetloc extension and you open it on Big Sur or older versions of the OS, the file can execute commands with no other interaction on your part.
Ars Technica tested the vulnerability with a .inetloc file and Apple’s Mail app, and it was able to launch the calculator by simply opening the shortcut file on their Mac.
Minchan explained a little more about the issue, saying, “A vulnerability in the way macOS processes inetloc files causes it to run commands embedded inside, the commands it runs can be local to the macOS allowing the execution of arbitrary commands by the user without any warning/prompts. Originally, inetloc files are shortcuts to an Internet location, such as an RSS feed or a telnet location; and contain the server address and possibly a username and password for SSH and telnet connections; can be created by typing a URL in a text editor and dragging the text to the Desktop.”
Apple attempted to release a fix for the issue, but apparently, it’s easy to bypass. “Newer versions of macOS (from Big Sur) have blocked the file:// prefix (in the com.apple.generic-internet-location) however they did a case matching causing File:// or fIle:// to bypass the check,” explains Minchan.
That means simply changing the case of “F” in file is enough to get around Apple’s fix, which means it isn’t much of a fix at all.
What Should You Do?
If someone you don’t know sends you a .inetloc file via email, don’t open it. You shouldn’t open files of any type from people you don’t know, but because we know this is actively being exploited, it’s even more important to avoid them.
