8 ms·

Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate https://en.m.wikipedia.org/wiki/Extende

by fh973 6y ago

Not that simple to just pay. You need an EV certificate (https://en.m.wikipedia.org/wiki/Extended_Validation_Certificate https://en.m.wikipedia.org/wiki/Extended_Validation_Certific...), which in turn needs a verified business address. Not a good plan to distribute malware without going through the effort of faking a legitimate business aswell.

ebg13 6y ago
Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.
- lima 6y ago
  What usually happens is that legitimate certificates are stolen.
  - marcosdumay 6y ago
    What usually happens is that "legitimate" software distributors aren't. Just read the GP again. Second to that, it's that people set the information up so that they'll mislead your verification processes just enough to pass. Certificates stolen are way down from that.
- haolez 6y ago
  This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)
  - jiggawatts 6y ago
    I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation. My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time. Huawei isn't doing anything different. The western governments just don't like it that they're copying them.
- andrewxdiamond 6y ago
  If you need a business address, it's pretty simple to get. The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange. https://www.microsoft.com/en-us/microsoft-365/business-insights-ideas/resources/how-to-get-a-business-mailing-address https://www.microsoft.com/en-us/microsoft-365/business-insig...
- close04 6y ago
  > malware outfits bringing in millions of dollars a year With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability. You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack. You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.
  - ebg13 6y ago
    > With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place Exactly. That's why this should just stop. Because it hurts without helping.
    - close04 6y ago
      > That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. > it hurts without helping It helps me verify that the software I use comes from the developer I expected. It may not be a catch-all but I find value in this. Don't forget, your door lock can be opened in seconds and the person it inconveniences is mostly you, especially if you lock your keys inside. Your argument would be far more convincing if you took no precautions whatsoever because someone with millions to spend can bypass them.
      - ebg13 6y ago
        > It helps me verify that the software I use comes from the developer I expected. Nobody needs to charge money for me to be able to sign my executables with something like PGP. > The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.
deleted 6y ago
[deleted]
driverdan 6y ago
As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.
- bastardoperator 6y ago
  Locks only keep honest people out
  - blackflame7000 6y ago
    They also keep people honest by diminishing the temptation
- notyourday 6y ago
  I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.
  - Nextgrid 6y ago
    You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you. A similar approach is successfully used by scammers to recruit money mules.
    - notyourday 6y ago
      You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.
      - 6y ago
SXX 6y ago
Registering offshore company with a fake passport will take whole $300 out of malware distributor pocket. Or might be $500 if they need random homeless guy to pass interview for them.
fny 6y ago
You can buy a verified business address pretty easily. See physicaladdress.com as an example.

by fh973 6y ago

ebg13 6y ago

Oh, yes, so we're supposed to believe that malware outfits bringing in millions of dollars a year in illicit profit can't afford to set up front organizations. And it doesn't even have to be fake! You could be Zoom! Or Avast! Or Trend Micro! Or Sony! Or Lenovo! The only person in this story who doesn't have a business address is me.

lima 6y ago
What usually happens is that legitimate certificates are stolen.
- marcosdumay 6y ago
  What usually happens is that "legitimate" software distributors aren't. Just read the GP again. Second to that, it's that people set the information up so that they'll mislead your verification processes just enough to pass. Certificates stolen are way down from that.
haolez 6y ago
This is in line with my experience. I've worked with cybersecurity in the past and the "attackers" used to be huge black hat companies that had much more money and power than all white hat companies combined. We joked that only the bad guys went to work using suits, since they are very powerful and well organized :)
- jiggawatts 6y ago
  I know there's a smiley in your comment, but this is a now a very genuine issue, and working in cybersecurity I feel helpless to do anything about the situation. My biggest worry is the endless "telemetry", "customer experience feedback", "licensing", "opt-out", "tracing", "quality improvement programs", etc. On and on. There are now a thousand hooks into every data centre by just about every vendor involved. Every one of them is exfiltrating information. Every one of them is a data leak waiting to happen. Every one of them could take control at any time. Huawei isn't doing anything different. The western governments just don't like it that they're copying them.
andrewxdiamond 6y ago
If you need a business address, it's pretty simple to get. The main purpose is a paper trail leading the software back to you. If you aren't malicious, it's a few hours task to arrange. https://www.microsoft.com/en-us/microsoft-365/business-insights-ideas/resources/how-to-get-a-business-mailing-address https://www.microsoft.com/en-us/microsoft-365/business-insig...
close04 6y ago
> malware outfits bringing in millions of dollars a year With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place without completely sacrificing usability. You should see most security measures as the lock on your door. It doesn't take an expert to crack but still stops most from even attempting it. No security measure is 100% effective but it still raises the bar for a successful attack. You seem to have a bone to pick with MS's choice so I'm genuinely curious in which direction would you go. And keep in mind you have a billion users and a truck load of baggage to work with.
- ebg13 6y ago
  > With that kind of money they can pretty much bypass any measure an OS manufacturer could reasonably put in place Exactly. That's why this should just stop. Because it hurts without helping.
  - close04 6y ago
    > That's why this should just stop So they should stop (discontinue) every measure that can be bypassed by an outfit with this kind of money? That doesn't leave many measures, if any. And it lowers the bar for a successful attack to someone with a couple of hours to spare. SmartScreen prompts are just like any HTTP error in a browser. The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. > it hurts without helping It helps me verify that the software I use comes from the developer I expected. It may not be a catch-all but I find value in this. Don't forget, your door lock can be opened in seconds and the person it inconveniences is mostly you, especially if you lock your keys inside. Your argument would be far more convincing if you took no precautions whatsoever because someone with millions to spend can bypass them.
    - ebg13 6y ago
      > It helps me verify that the software I use comes from the developer I expected. Nobody needs to charge money for me to be able to sign my executables with something like PGP. > The cert certifies an identity, that's it. It doesn't magically clean any malware inside, that you know the identity, or that you have to trust it. And yet the message is very clearly "THIS IS UNSAFE" because "WE don't know the guy". It isn't "Don't run"/"Run anyway thanks." It's "DON'T RUN" in BOLD in an eye-catching bright box in a prominent location where buttons go and "(more info)" in body text somewhere else.

deleted 6y ago

[deleted]

driverdan 6y ago

As someone who used to make fake IDs it would be very easy to pass EV checks. It's like putting a padlock on a gate. Anyone who wants to get past it can easily do so.

bastardoperator 6y ago
Locks only keep honest people out
- blackflame7000 6y ago
  They also keep people honest by diminishing the temptation
notyourday 6y ago
I have a hard time believing this. Based on my experience, a part of the EV check was checking of the business entity with the state and sending snail mail to the address of record. Since our registered address was a law firm, I had to go through all kinds of hoops to get that letter as it contained the string needed to proceed to the next step in the EV verification.
- Nextgrid 6y ago
  You can recruit a clueless person to be a “virtual assistant” or similar, give them some random admin tasks (to make it feel legitimate) before sending the letter to their address and asking them to read/scan the contents for you. A similar approach is successfully used by scammers to recruit money mules.
  - notyourday 6y ago
    You have to be first registered with the state and the feds (IRS) as a business which creates all kinds of legal obligations and paperwork.
    - 6y ago

SXX 6y ago

Registering offshore company with a fake passport will take whole $300 out of malware distributor pocket. Or might be $500 if they need random homeless guy to pass interview for them.

fny 6y ago

You can buy a verified business address pretty easily. See physicaladdress.com as an example.