7 ms·

Zacinlo adware affecting Windows 10 Users

50 points by vezycash 8y ago

jen729w 8y ago
"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark),"... Err. Can we blame Windows if a user installs software?!
- detaro 8y ago
  Is it "blaming" if the article factually reports that there's now malware that manages to resist newer security features?
  - shittyadmin 8y ago
    To be fair, they're security features that were guaranteed to be bypassable given that they weren't implemented in hardware, nothing really surprising here. Commercial game cheat developers have been bypassing patchguard since it was introduced just to beat anticheat systems in an easier way than emulating them fully.
- adrianN 8y ago
  If installing a rootkit looks the same as installing normal everyday software, I'd say there is at least some blame to be put on the OS.
  - megaman22 8y ago
    We really need to educate people if they think installing an untrusted exe from a sketchy "free" VPN service is acceptable behavior.
    - Rjevski 8y ago
      I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).
      - flyinghamster 8y ago
        That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
        ourmandave 8y ago
        Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
      - adrianN 8y ago
        I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
      - isostatic 8y ago
        > all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
    - zaarn 8y ago
      It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.
      - hutzlibu 8y ago
        "Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)
- talltimtom 8y ago
  True, users actually installing software on their computers is extremely rare and well outside the scope of intended use for windows. It’s surprising even that Microsoft made it possible at all to do such a poweruser task on a regular computer.
  - chii 8y ago
    If you invited a stranger into your home, is it any surprise that they might steal and burgle? The user has to have some level of technical knowledge and personal responsibility in keeping their machines clean. Downloading random VPN software that is free seems like such a dangerous thing to do. If the user doesn't understand this, they haven't really learnt how to computer properly.
    - lakechfoma 8y ago
      When large populations can't figure out really basic UI navigation do you expect everyone to understand security? Our operating systems should protect us more from this kind of stuff.
      - JeanMarcS 8y ago
        At least warn the user explicitly
        mrguyorama 8y ago
        When's the last time you used a computer? Windows since at least Vista explicitly pops up "This program from the internet could very well damage your computer, are you sure?" dialogs, as well as a dialog for permission escalation if required and another dialog for some internet connections (via Windows Firewall). That's not even getting into things like smartscreen in newer versions of Windows. Meanwhile Mac will go so far as to completely deny you the right to run code it can't identify the developer of, until you go into the settings and temporarily grant yourself the permission to do so. It is fundamentally impossible to prevent a user from doing bad things to their systems unless you are willing to 100% prevent the running of code that you can't identify with 100% certainty.
- greggman 8y ago
  IMO Yes. iOS doesn't have this problem. I believe Android finally doesn't have this problem. Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes should be redesigned to make it nearly impossible to install a rootkit. Sure there will be bugs in the OS but those bugs will be fixed but the goal should be that apps can't own your entire computer anytime you install one and asking for admin should have big giant warnings and be shunned and shamed from any software that asks for it.
  - isostatic 8y ago
    I want a computer, not a walled garden.
    - freehunter 8y ago
      It's not an either/or situation.
      - vetinari 8y ago
        It is. It is being called 'dancing pig problem'.
        freehunter 8y ago
        That's not exactly what I meant. I work in information security and I can't name a single colleague who would argue that a normal user should have full admin access to any machine right out of the box, but people like you and me who are responsible and educated enough not to make uninformed decisions should be able to have admin access. There are tons of ways that both can be accomplished at the same time. Linux, for example, does it out of the box. Most Linux systems don't give you root access, and some even disable logins to the root account altogether. You have to specifically escalate your privileges. If the user account isn't in the sudoers group, tough luck. Windows has UAC for this, too. I find it very lacking, but it's better than nothing. macOS has a similar permissions system. Application whitelisting is another great option. Let users install trusted and signed programs, while admins have the ability to install anything they want. And also look for iOS versus Android. Almost no one using iOS is able to install random applications from the Internet, and it still has huge marketshare because most people don't care. Android is an option for those who do care. It's not either/or. Options exist for both use cases. What responsible tech people need to do is use the option they're most comfortable with, while steering normal end users towards the safest option possible. It's even as simple as installing Windows, giving the user a normal (unprivileged) account, and just not giving them the admin password. The dancing pig problem has been solved.
- phobosdeimos 8y ago
  Always blame Microsoft. The funny thing is that win10 already treats the user as an idiot. Much to public dismay, but apparently people ARE idiots.
Maarten88 8y ago
"... persistence across OS reinstalls [...] even effective against Windows 10 installations..." Since Windows 8 I have always enabled safeboot in the UEFI settings before installing the OS. Machines with pre-installled Windows usually come with this setting enabled by default. I would expect this type of malware would not run on machines with safeboot, or cause a BSOD on the next startup. The article doesn't say anything about this, does it require an unlocked bootloader, does it silently fallback when it detects safeboot, or does it have a by-pass?
- rocqua 8y ago
  I really found this part of the article lacking. How deep does the rootkit go to persist across OS reinstalls? Does it simply hijack windows's restore functionality? Or does it write itself to firmware to essentially become baked into the hardware.
  - nisa 8y ago
    This seems to be source for the article: https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the-complex-zacinlo-ad-fraud-operation/ https://labs.bitdefender.com/2018/06/six-years-and-counting-... (there is a PDF linked), no mention of surviving a format or clean reinstall.
- vetinari 8y ago
  UEFI safeboot usually works fine with laptops, but it can be a can of worms on desktops. For example, in the past I've seen a board where the combination of booting from NVMe drive, setting up Intel RAID on SATA HDDs and Secure Boot simply didn't work together. You had to give up one of these to continue.
orliesaurus 8y ago
I am not sure why they didn't point out what was this "free VPN" software that came loaded with the rootkit? Let's assume I did download a free VPN in the past (full disclosure: I DIDNT) how would I know if I am affected? EDIT: They did - never mind the above, I totally missed it I need to upgrade my glasses - thanks for pointing it out!
- prophesi 8y ago
  Erm, they did? >"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark)," Bitdefender experts wrote in a 104-page report detailing Zacinlo's modus operandi and all of its modules released today.
  - orliesaurus 8y ago
    Thank you, I totally missed it!

50 points by vezycash 8y ago

"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark),"... Err. Can we blame Windows if a user installs software?!

detaro 8y ago
Is it "blaming" if the article factually reports that there's now malware that manages to resist newer security features?
- shittyadmin 8y ago
  To be fair, they're security features that were guaranteed to be bypassable given that they weren't implemented in hardware, nothing really surprising here. Commercial game cheat developers have been bypassing patchguard since it was introduced just to beat anticheat systems in an easier way than emulating them fully.
adrianN 8y ago
If installing a rootkit looks the same as installing normal everyday software, I'd say there is at least some blame to be put on the OS.
- megaman22 8y ago
  We really need to educate people if they think installing an untrusted exe from a sketchy "free" VPN service is acceptable behavior.
  - Rjevski 8y ago
    I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).
    - flyinghamster 8y ago
      That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
      - ourmandave 8y ago
        Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
    - adrianN 8y ago
      I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
    - isostatic 8y ago
      > all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
  - zaarn 8y ago
    It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.
    - hutzlibu 8y ago
      "Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)
talltimtom 8y ago
True, users actually installing software on their computers is extremely rare and well outside the scope of intended use for windows. It’s surprising even that Microsoft made it possible at all to do such a poweruser task on a regular computer.
- chii 8y ago
  If you invited a stranger into your home, is it any surprise that they might steal and burgle? The user has to have some level of technical knowledge and personal responsibility in keeping their machines clean. Downloading random VPN software that is free seems like such a dangerous thing to do. If the user doesn't understand this, they haven't really learnt how to computer properly.
  - lakechfoma 8y ago
    When large populations can't figure out really basic UI navigation do you expect everyone to understand security? Our operating systems should protect us more from this kind of stuff.
    - JeanMarcS 8y ago
      At least warn the user explicitly
      - mrguyorama 8y ago
        When's the last time you used a computer? Windows since at least Vista explicitly pops up "This program from the internet could very well damage your computer, are you sure?" dialogs, as well as a dialog for permission escalation if required and another dialog for some internet connections (via Windows Firewall). That's not even getting into things like smartscreen in newer versions of Windows. Meanwhile Mac will go so far as to completely deny you the right to run code it can't identify the developer of, until you go into the settings and temporarily grant yourself the permission to do so. It is fundamentally impossible to prevent a user from doing bad things to their systems unless you are willing to 100% prevent the running of code that you can't identify with 100% certainty.
greggman 8y ago
IMO Yes. iOS doesn't have this problem. I believe Android finally doesn't have this problem. Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes should be redesigned to make it nearly impossible to install a rootkit. Sure there will be bugs in the OS but those bugs will be fixed but the goal should be that apps can't own your entire computer anytime you install one and asking for admin should have big giant warnings and be shunned and shamed from any software that asks for it.
- isostatic 8y ago
  I want a computer, not a walled garden.
  - freehunter 8y ago
    It's not an either/or situation.
    - vetinari 8y ago
      It is. It is being called 'dancing pig problem'.
      - freehunter 8y ago
        That's not exactly what I meant. I work in information security and I can't name a single colleague who would argue that a normal user should have full admin access to any machine right out of the box, but people like you and me who are responsible and educated enough not to make uninformed decisions should be able to have admin access. There are tons of ways that both can be accomplished at the same time. Linux, for example, does it out of the box. Most Linux systems don't give you root access, and some even disable logins to the root account altogether. You have to specifically escalate your privileges. If the user account isn't in the sudoers group, tough luck. Windows has UAC for this, too. I find it very lacking, but it's better than nothing. macOS has a similar permissions system. Application whitelisting is another great option. Let users install trusted and signed programs, while admins have the ability to install anything they want. And also look for iOS versus Android. Almost no one using iOS is able to install random applications from the Internet, and it still has huge marketshare because most people don't care. Android is an option for those who do care. It's not either/or. Options exist for both use cases. What responsible tech people need to do is use the option they're most comfortable with, while steering normal end users towards the safest option possible. It's even as simple as installing Windows, giving the user a normal (unprivileged) account, and just not giving them the admin password. The dancing pig problem has been solved.
phobosdeimos 8y ago
Always blame Microsoft. The funny thing is that win10 already treats the user as an idiot. Much to public dismay, but apparently people ARE idiots.

Maarten88 8y ago

"... persistence across OS reinstalls [...] even effective against Windows 10 installations..." Since Windows 8 I have always enabled safeboot in the UEFI settings before installing the OS. Machines with pre-installled Windows usually come with this setting enabled by default. I would expect this type of malware would not run on machines with safeboot, or cause a BSOD on the next startup. The article doesn't say anything about this, does it require an unlocked bootloader, does it silently fallback when it detects safeboot, or does it have a by-pass?

rocqua 8y ago
I really found this part of the article lacking. How deep does the rootkit go to persist across OS reinstalls? Does it simply hijack windows's restore functionality? Or does it write itself to firmware to essentially become baked into the hardware.
- nisa 8y ago
  This seems to be source for the article: https://labs.bitdefender.com/2018/06/six-years-and-counting-inside-the-complex-zacinlo-ad-fraud-operation/ https://labs.bitdefender.com/2018/06/six-years-and-counting-... (there is a PDF linked), no mention of surviving a format or clean reinstall.
vetinari 8y ago
UEFI safeboot usually works fine with laptops, but it can be a can of worms on desktops. For example, in the past I've seen a board where the combination of booting from NVMe drive, setting up Intel RAID on SATA HDDs and Secure Boot simply didn't work together. You had to give up one of these to continue.

orliesaurus 8y ago

I am not sure why they didn't point out what was this "free VPN" software that came loaded with the rootkit? Let's assume I did download a free VPN in the past (full disclosure: I DIDNT) how would I know if I am affected? EDIT: They did - never mind the above, I totally missed it I need to upgrade my glasses - thanks for pointing it out!

prophesi 8y ago
Erm, they did? >"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark)," Bitdefender experts wrote in a 104-page report detailing Zacinlo's modus operandi and all of its modules released today.
- orliesaurus 8y ago
  Thank you, I totally missed it!