EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 19·5 min read
Packing Malware in Rosetta 2
TL;DR
Rosetta 2, Apple's translation layer for running x86_64 binaries on Apple Silicon, can be exploited to load unsigned binaries, enabling malware packing. This capability allows for sophisticated evasion techniques against security measures.
✦ Why It Matters
Evaluate your applications for potential vulnerabilities related to Rosetta 2's handling of unsigned binaries.
Key Takeaways
- Understand how Rosetta 2 translates x86_64 to ARM64 binaries.
- Implement stricter code signing requirements for macOS applications.
- Monitor for unauthorized use of unsigned binaries in your environment.
- Explore security tools that can detect malware leveraging Rosetta 2.
How It Works
Rosetta 2 translates x86_64 binaries to ARM64 using AOT and JIT compilation, caching translated code for efficiency. It allows unsigned binaries to run by bypassing standard code signing checks, which can be exploited to execute malware.