12

I visited a page to stream a TV show, and upon clicking the search result link got the following pop-up:

(initial pop-up)

I clicked OK, as nothing on Chrome was available, and when I did that, Chrome auto-downloaded a file called FlashPlayer.dmg.

Here is a picture of that file:

file download

I didn't open the .dmg file or click on it at all. Instead, I immediately went to my downloads folder, deleted the file, and then emptied my trash.

I then went to see my downloads on Chrome; the URL seems to be something like www.makeymcmacface.com/prod/... (which Google indicates belongs to the Mac.Trojan.Genieo.33 type of adware).

My question is this: If I download a malicious .dmg file, but don't click on it to install it, am I safe? Or is there a possibility that by simply visiting a website that auto-installs a .dmg file, I could have compromised my security?

5
+50

If I download a malicious .dmg file, but don't click on it to install it, am I safe?

You are safe. The .dmg (disk image) file is not the actual installer. The .dmg must be double-clicked to install it before it can run any code. Even if you double-click it (so long as you leave the security feature Gatekeeper on), you must approve both the downloaded from the web alert and the authentication prompt to actually permit the install to proceed.

Is there a possibility that by simply visiting a website that auto-installs a .dmg file, I could have compromised my security?

No, your security is not compromised unless you manually install the file. The reason for this is that a website can only offer a .dmg file for download. There is no "auto-install" for a .dmg app file. You may click on a link (or a button) to start the download, but disk images themselves are not "installed" by the download process—meaning they can't run any code on your Mac until you type in your password to install them (again, because of macOS's built-in security feature Gatekeeper). The disk image is merely saved to your designated folder (typically Downloads) then waits for you to take further action by double-clicking on it to mount it. For any code from that app to be run, you have to authenticate with your password.


Bonus tip: When a website tells you that your flash player is out of date by way of a pop-up like you've shown, that should be an automatic red flag! Outdated Flash Player alerts are almost never legitimate. Instead of clicking on that OK button on the notification like you did, you should force quit your browser: choose Force Quit from the Apple menu in the menubar ()—or just press Command+Option+Esc—then select Chrome/Safari and hit Force Quit. Hold down Shift while opening Safari to prevent the website from reloading.

  • 2
    Instead of force quitting, which would result in a loss of tabs (or if the option is selected, all the tabs to load up again during the next opening of Safari, thus rendering the force quitting redundant), I would simply suggest closing the tab. An website with an outdated flash alert is not worth being on, most of the time. Additionally on macOS you can close tabs regardless of whether you see a popup alert, as they've been made less intrusive. – Skeleton Bow Dec 12 '16 at 22:33
  • @SkeletonBow Instead of closing the tab, I would simply install an ad blocking extension before using any web browser. – 10 Replies Jan 8 '17 at 20:23
3

You are always safe when you don't open the DMG as the app is in a container and it can't execute itself.

Security tips regarding downloads:

  1. You always get a popup question of OS X if you want to open this file.
  2. OS X is standard secured to only open applications that are downloaded from the App Store. Even if you want to install a application that is not from the App Store you still need to disable the security (via Settings > Security and Privacy > press the lock in the bottom left corner, enter your passcode and set 'Anywhere'.)
  • Can you expand a little bit on "the app is in a container". I've got a bounty on this, looking for a canonical answer, and yours is close. – owlswipe Nov 30 '16 at 22:06
  • He means that the app you see in Finder is just a folder. Finder sees that this folder has a extension .app and draws the icon instead of a folder, and when you click it runs the executable which is inside this folder. Path to an example executable: Example.app/Contents/MacOS/Example. You can browse this for all apps; just Right Click>Show package contents. The executable file cannot execute (start) itself on it's own. You or something else would have to start it then only could it harm your PC. Even if it does run it probably won't be able to do much damage since apps run in a sandbox. – user14492 Nov 30 '16 at 23:13
  • Oh wait @rwzdoorn could also have meant something else i.e. the app was on a unmounted disk image so there is no way it could have run. Disk images are just Apple's take on ZIPs. Like you can't read a .zip until you uncompress it, you have to mount a disk image to get it's content. Sorry if I misunderstood. – user14492 Nov 30 '16 at 23:34
  • @user14492 Woah, learning a lot already. Could you post that + some of rwzdoorn's info as an answer? Bounty points at stake :) – owlswipe Dec 2 '16 at 3:45
  • Both points in this answer are incorrect. 1. “You always get a popup question of OS X if you want to open this file”. Only if downloaded by the apps that set the necessary flag. If you download the dmg via curl, for example, it will not be quarantined and you do not get a warning. In this particular case, it is fine. 2.1. “OS X is standard secured to only open applications that are downloaded from the App Store”. No. Since the introduction of Gatekeeper the default has always been to open apps from the MAS and identified developers. – user137369 Dec 4 '16 at 16:56
1

You are probably safe

As long as you don't open or install anything it is pretty hard to get a virus.

If you haven't disabled gate keeper (an internal system process that makes sure that software from unidentified developers does not open unless you type in an admin password to confirm that they are safe) you are 99.99% safe.

For future reference: A .dmg file is a disk image file. Even when you open a .dmg, it will only mount the disk. This means that it opens up a little folder on your desktop kinda like when you put a CD in your mac. You can't edit the folder, you can only eject it. To eject the mounted disk, just click the little eject button, or drag it to the trash can.

Here is a quote from wikipedia about disk images

An Apple disk image allows secure password protection as well as file compression, and hence serves both security and file distribution functions; such a disk image is most commonly used to distribute software over the Internet.

HOWEVER:

If your browser keeps opening up these malicious advertisements, you may have adware already in your computer (check through your chrome extensions). Any extension that installs a new search engine is likely adware.

Pro tip: Install Adblock. It is damn near impossible to get a virus with Adblock unless your are actively seeking out malicious websites. Adblock will prevent sites from opening up these annoying pop-ups and will remove ads from youtube and basically every other site on the internet. https://chrome.google.com/webstore/detail/adblock/gighmmpiobklfepjocnamgkkbiglidom?hl=en-US

1

I'm going to make this easier for you to understand.

  1. Am I safe, if a suspicious file was downloaded but never opened or installed in my Mac?

Yes you are safe.

  1. Am I safe, if I was redirected to an unknown website, when I clicked on a notification shown on another website?

No, not really. There are 99% chances, that you get infected by 0day exploits used by hackers, to turn your computer into their bot. In order to protect yourself from such hack attempts and attacks, always use popup & ad blockers, and avoid visiting sites, which redirect or opens popups.

0

All the answers here are great, but IMHO, all you need is to run some trusty anti-malware software like Malwarebytes.

  • The malware bytes product is solid and useful. +lots of votes in my book – bmike Nov 30 '16 at 23:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .