4 ms·

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, no

by emidln 7y ago

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, not an exploit itself.

Crinus 7y ago
If someone can force download and install an application through browser/email then the issue isn't with the application being downloaded and installed but whatever allowed the application to be forcefully downloaded and installed (that is, your browser/email client).
- woodrowbarlow 7y ago
  you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario. many gnome-based distros (fedora, for example) ship with firefox and the "gnome extensions" plugin for firefox pre-installed. this extension allows you to install extensions directly into your shell from extensions.gnome.org just by clicking "install". suppose an exploit was found that allows sources other than extensions.gnome.org to trigger the firefox plugin to install a shell extension. seems much more likely now, doesn't it?
  - Crinus 7y ago
    I'm not sure how much of a possibility this is because i do not know exactly how GNOME extensions work - the linked malware is not a real GNOME extension, it just pretends to be one by placing itself in the directory where GNOME extensions are placed, but it really is a shell script. But assuming that this is the case, as i said above the issue would be with Firefox and/or the Firefox extension, not with GNOME being extensible or the user being able to download and run shell scripts (the two things that enable this to work) in their computer (and really the "GNOME being extensible" part is minor, the only reason the malware uses that is to hide itself, it isn't even a real GNOME extension). The main reason i am dismissive is because if you think this is a real threat then you'd have to also think anything you can run on your computer to be a real threat - which, IMO, is absurd and at that point you might as well turn off and throw your computer out of the window.

by emidln 7y ago

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, not an exploit itself.

Crinus 7y ago

If someone can force download and install an application through browser/email then the issue isn't with the application being downloaded and installed but whatever allowed the application to be forcefully downloaded and installed (that is, your browser/email client).

woodrowbarlow 7y ago
you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario. many gnome-based distros (fedora, for example) ship with firefox and the "gnome extensions" plugin for firefox pre-installed. this extension allows you to install extensions directly into your shell from extensions.gnome.org just by clicking "install". suppose an exploit was found that allows sources other than extensions.gnome.org to trigger the firefox plugin to install a shell extension. seems much more likely now, doesn't it?
- Crinus 7y ago
  I'm not sure how much of a possibility this is because i do not know exactly how GNOME extensions work - the linked malware is not a real GNOME extension, it just pretends to be one by placing itself in the directory where GNOME extensions are placed, but it really is a shell script. But assuming that this is the case, as i said above the issue would be with Firefox and/or the Firefox extension, not with GNOME being extensible or the user being able to download and run shell scripts (the two things that enable this to work) in their computer (and really the "GNOME being extensible" part is minor, the only reason the malware uses that is to hide itself, it isn't even a real GNOME extension). The main reason i am dismissive is because if you think this is a real threat then you'd have to also think anything you can run on your computer to be a real threat - which, IMO, is absurd and at that point you might as well turn off and throw your computer out of the window.