7 ms·

"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark),"... Err. Can we blame Windows if

"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark),"... Err. Can we blame Windows if a user installs software?!

detaro 8y ago
Is it "blaming" if the article factually reports that there's now malware that manages to resist newer security features?
- shittyadmin 8y ago
  To be fair, they're security features that were guaranteed to be bypassable given that they weren't implemented in hardware, nothing really surprising here. Commercial game cheat developers have been bypassing patchguard since it was introduced just to beat anticheat systems in an easier way than emulating them fully.
adrianN 8y ago
If installing a rootkit looks the same as installing normal everyday software, I'd say there is at least some blame to be put on the OS.
- megaman22 8y ago
  We really need to educate people if they think installing an untrusted exe from a sketchy "free" VPN service is acceptable behavior.
  - Rjevski 8y ago
    I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).
    - flyinghamster 8y ago
      That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
      - ourmandave 8y ago
        Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
    - adrianN 8y ago
      I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
    - isostatic 8y ago
      > all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
    - freehunter 8y ago
      As much as I'd like computer security to become a solved problem, this outlook is ignoring the banks role in the transaction. In my opinion banks don't go far enough to verify identity or to verify a transaction is legitimate. The fact that someone who has never met me can walk into a bank with some pieces of information they got on the Internet and open a new bank account or credit card is scary. That's why it's so easy to refund this fraud, because banks don't want people to realize that their security is just a bunch of meaningless paperwork. I also don't think people losing their life savings will change anything. Ponzi schemes are still a big thing, MLM is still a big thing, Nigerian princes are still a big thing, and people lose it all through those scams constantly. The state of bank security is so bad that every time I write a check, I'm giving the recipient my bank's name, my account number, my home address, and my signature. That's a lot of sensitive information that a phisher could do some real damage with. Ultimately, if a fraudulent transaction clears the bank, it is the bank's fault. It's their job to verify transactions and verify identity before clearing the transaction. In a perfect world, financial malware would cease to exist because bank security was locked down so tight that fraudulent transactions would never clear.
  - zaarn 8y ago
    It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.
    - hutzlibu 8y ago
      "Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)
talltimtom 8y ago
True, users actually installing software on their computers is extremely rare and well outside the scope of intended use for windows. It’s surprising even that Microsoft made it possible at all to do such a poweruser task on a regular computer.
- chii 8y ago
  If you invited a stranger into your home, is it any surprise that they might steal and burgle? The user has to have some level of technical knowledge and personal responsibility in keeping their machines clean. Downloading random VPN software that is free seems like such a dangerous thing to do. If the user doesn't understand this, they haven't really learnt how to computer properly.
  - lakechfoma 8y ago
    When large populations can't figure out really basic UI navigation do you expect everyone to understand security? Our operating systems should protect us more from this kind of stuff.
    - JeanMarcS 8y ago
      At least warn the user explicitly
      - mrguyorama 8y ago
        When's the last time you used a computer? Windows since at least Vista explicitly pops up "This program from the internet could very well damage your computer, are you sure?" dialogs, as well as a dialog for permission escalation if required and another dialog for some internet connections (via Windows Firewall). That's not even getting into things like smartscreen in newer versions of Windows. Meanwhile Mac will go so far as to completely deny you the right to run code it can't identify the developer of, until you go into the settings and temporarily grant yourself the permission to do so. It is fundamentally impossible to prevent a user from doing bad things to their systems unless you are willing to 100% prevent the running of code that you can't identify with 100% certainty.
greggman 8y ago
IMO Yes. iOS doesn't have this problem. I believe Android finally doesn't have this problem. Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes should be redesigned to make it nearly impossible to install a rootkit. Sure there will be bugs in the OS but those bugs will be fixed but the goal should be that apps can't own your entire computer anytime you install one and asking for admin should have big giant warnings and be shunned and shamed from any software that asks for it.
- isostatic 8y ago
  I want a computer, not a walled garden.
  - freehunter 8y ago
    It's not an either/or situation.
    - vetinari 8y ago
      It is. It is being called 'dancing pig problem'.
      - freehunter 8y ago
        That's not exactly what I meant. I work in information security and I can't name a single colleague who would argue that a normal user should have full admin access to any machine right out of the box, but people like you and me who are responsible and educated enough not to make uninformed decisions should be able to have admin access. There are tons of ways that both can be accomplished at the same time. Linux, for example, does it out of the box. Most Linux systems don't give you root access, and some even disable logins to the root account altogether. You have to specifically escalate your privileges. If the user account isn't in the sudoers group, tough luck. Windows has UAC for this, too. I find it very lacking, but it's better than nothing. macOS has a similar permissions system. Application whitelisting is another great option. Let users install trusted and signed programs, while admins have the ability to install anything they want. And also look for iOS versus Android. Almost no one using iOS is able to install random applications from the Internet, and it still has huge marketshare because most people don't care. Android is an option for those who do care. It's not either/or. Options exist for both use cases. What responsible tech people need to do is use the option they're most comfortable with, while steering normal end users towards the safest option possible. It's even as simple as installing Windows, giving the user a normal (unprivileged) account, and just not giving them the admin password. The dancing pig problem has been solved.
phobosdeimos 8y ago
Always blame Microsoft. The funny thing is that win10 already treats the user as an idiot. Much to public dismay, but apparently people ARE idiots.

"The adware components are silently installed by a downloader that is presented as a free and anonymous VPN service (s5Mark),"... Err. Can we blame Windows if a user installs software?!

detaro 8y ago

Is it "blaming" if the article factually reports that there's now malware that manages to resist newer security features?

shittyadmin 8y ago
To be fair, they're security features that were guaranteed to be bypassable given that they weren't implemented in hardware, nothing really surprising here. Commercial game cheat developers have been bypassing patchguard since it was introduced just to beat anticheat systems in an easier way than emulating them fully.

adrianN 8y ago

If installing a rootkit looks the same as installing normal everyday software, I'd say there is at least some blame to be put on the OS.

megaman22 8y ago
We really need to educate people if they think installing an untrusted exe from a sketchy "free" VPN service is acceptable behavior.
- Rjevski 8y ago
  I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).
  - flyinghamster 8y ago
    That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
    - ourmandave 8y ago
      Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
  - adrianN 8y ago
    I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
  - isostatic 8y ago
    > all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
  - freehunter 8y ago
    As much as I'd like computer security to become a solved problem, this outlook is ignoring the banks role in the transaction. In my opinion banks don't go far enough to verify identity or to verify a transaction is legitimate. The fact that someone who has never met me can walk into a bank with some pieces of information they got on the Internet and open a new bank account or credit card is scary. That's why it's so easy to refund this fraud, because banks don't want people to realize that their security is just a bunch of meaningless paperwork. I also don't think people losing their life savings will change anything. Ponzi schemes are still a big thing, MLM is still a big thing, Nigerian princes are still a big thing, and people lose it all through those scams constantly. The state of bank security is so bad that every time I write a check, I'm giving the recipient my bank's name, my account number, my home address, and my signature. That's a lot of sensitive information that a phisher could do some real damage with. Ultimately, if a fraudulent transaction clears the bank, it is the bank's fault. It's their job to verify transactions and verify identity before clearing the transaction. In a perfect world, financial malware would cease to exist because bank security was locked down so tight that fraudulent transactions would never clear.
- zaarn 8y ago
  It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.
  - hutzlibu 8y ago
    "Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)

talltimtom 8y ago

True, users actually installing software on their computers is extremely rare and well outside the scope of intended use for windows. It’s surprising even that Microsoft made it possible at all to do such a poweruser task on a regular computer.

chii 8y ago
If you invited a stranger into your home, is it any surprise that they might steal and burgle? The user has to have some level of technical knowledge and personal responsibility in keeping their machines clean. Downloading random VPN software that is free seems like such a dangerous thing to do. If the user doesn't understand this, they haven't really learnt how to computer properly.
- lakechfoma 8y ago
  When large populations can't figure out really basic UI navigation do you expect everyone to understand security? Our operating systems should protect us more from this kind of stuff.
  - JeanMarcS 8y ago
    At least warn the user explicitly
    - mrguyorama 8y ago
      When's the last time you used a computer? Windows since at least Vista explicitly pops up "This program from the internet could very well damage your computer, are you sure?" dialogs, as well as a dialog for permission escalation if required and another dialog for some internet connections (via Windows Firewall). That's not even getting into things like smartscreen in newer versions of Windows. Meanwhile Mac will go so far as to completely deny you the right to run code it can't identify the developer of, until you go into the settings and temporarily grant yourself the permission to do so. It is fundamentally impossible to prevent a user from doing bad things to their systems unless you are willing to 100% prevent the running of code that you can't identify with 100% certainty.

greggman 8y ago

IMO Yes. iOS doesn't have this problem. I believe Android finally doesn't have this problem. Windows, Linux, and MacOS all have this problem because they don't run sandboxes by default. OSes should be redesigned to make it nearly impossible to install a rootkit. Sure there will be bugs in the OS but those bugs will be fixed but the goal should be that apps can't own your entire computer anytime you install one and asking for admin should have big giant warnings and be shunned and shamed from any software that asks for it.

isostatic 8y ago
I want a computer, not a walled garden.
- freehunter 8y ago
  It's not an either/or situation.
  - vetinari 8y ago
    It is. It is being called 'dancing pig problem'.
    - freehunter 8y ago
      That's not exactly what I meant. I work in information security and I can't name a single colleague who would argue that a normal user should have full admin access to any machine right out of the box, but people like you and me who are responsible and educated enough not to make uninformed decisions should be able to have admin access. There are tons of ways that both can be accomplished at the same time. Linux, for example, does it out of the box. Most Linux systems don't give you root access, and some even disable logins to the root account altogether. You have to specifically escalate your privileges. If the user account isn't in the sudoers group, tough luck. Windows has UAC for this, too. I find it very lacking, but it's better than nothing. macOS has a similar permissions system. Application whitelisting is another great option. Let users install trusted and signed programs, while admins have the ability to install anything they want. And also look for iOS versus Android. Almost no one using iOS is able to install random applications from the Internet, and it still has huge marketshare because most people don't care. Android is an option for those who do care. It's not either/or. Options exist for both use cases. What responsible tech people need to do is use the option they're most comfortable with, while steering normal end users towards the safest option possible. It's even as simple as installing Windows, giving the user a normal (unprivileged) account, and just not giving them the admin password. The dancing pig problem has been solved.

phobosdeimos 8y ago

Always blame Microsoft. The funny thing is that win10 already treats the user as an idiot. Much to public dismay, but apparently people ARE idiots.