7 ms·
I guess substituting the existing file served at that URL with a curl that when called by the particular malware in question (I guess you could detect this fair
by tyho 11y ago
I guess substituting the existing file served at that URL with a curl that when called by the particular malware in question (I guess you could detect this fairly easily) warns the user graphically of the infection would be considered going too far.
- syntheticnature 11y agoDetection would wind up being an arms race, I expect; if you were going to do this, better to replace it with an application that just does the warning, with a hint for valid users blindly downloading. Of course, then there's checking MD5s, etc.
- fsaintjacques 11y agoI would be more evil, I would make a custom version of curl package that randomly corrupt bytes only served to this malware. Let the malware developper have fun debugging this issue.
- werid 11y agoYou would not end up wasting any time of the malware developer, as the article states: "an updated version of the malware comes bundled with the curl library"
- fabulist 11y agoIt would be more like, "let the script kiddies using this tool shrug their shoulders when it stops working and switch to another (of which there are legion)."
- smcl 11y agoI'm not even sure you could reliably detect that - the article says they didn't have any special/identifying headers. But yeah you're right if they could detect then supplying an exe that warned the user would still feel sorta weird IMO, and how many users are likely to trust a random popup or notification seemingly from out of the blue?
- rplnt 11y agoThere are "indicators of compromise" listed at the end of the slides. So you could use that. But that's not curl's job... disabling some old versions by changing the url is more than enough in my opinion.
- tyho 11y agoDetect the malware in the binary served by the webserver when running on the infected machine, not on the webserver. i.e. always serve the `compromised` binary for that URL.
- annnnd 11y agoThey don't need to trust it - the fact it is there is a good enough indicator that the machine was compromised. :P
- qopp 11y agoHow could you even tell the user that. The average user doesn't know what curl is so all they'd see is: "!!!! Your computer is infected with MALWARE download this software now! !!!!"