3 ms·

The article leaves it open whether the user needs to double-click the malicious file or whether it is executed without user interaction through some exploit. "

The article leaves it open whether the user needs to double-click the malicious file or whether it is executed without user interaction through some exploit. "drive-by download" _usually_ refers to the latter, but the rest of the article not being more explicit and the use of legit-sounding file names makes me think that this may be just another attempt to make non-news appear interesting.

sohkamyung 6y ago
Not really the article's fault. As they state near the end, Microsoft themselves didn't provide this info. > Thursday’s [Microsoft] post doesn’t explicitly say what, if any, user interaction is required for infections to occur. It’s also not clear what effect defenses like User Account Control have. Microsoft makes no mention of the attack hitting browsers running macOS or Linux, so it's likely this campaign affects only Windows users. Microsoft representatives didn’t respond to an email asking for details.
- upofadown 6y ago
  It is still the articles fault for existing at all. The behaviour of the payload is not very interesting or helpful and you have to read almost the entire article to discover that you have wasted your time.
  - throwanem 6y ago
    That's fairly typical of a Dan Goodin article. The best you can really hope to do is pick out some search terms that'll find something actually useful, like the source material in this case: https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/ https://www.microsoft.com/security/blog/2020/12/10/widesprea...
- gruez 6y ago
  >It’s also not clear what effect defenses like User Account Control have Obligatory: UAC is not a security feature: https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94... And considering that UAC only protects against admin (aka root) access, this xkcd applies https://xkcd.com/1200/ https://xkcd.com/1200/
GoblinSlayer 6y ago
Update installations are dropping so ms tries to reinvigorate interest in them. Well, Edge proposes to open the file after download.
sys_64738 6y ago
It's the line about dropping installer exe files into a directory which is where I stopped reading. This sounds like it needs user execution so isn't really anything new.
grishka 6y ago
It's like those "oh my god new Android malware is eating the world" articles that just casually say "after the user installs the apk and gives it device admin permissions" as if it's not a barrier at all. Coincidently, these articles are usually written by anti-virus companies.
afrcnc 6y ago
it's social engineering 100%, automatic drive-by installs have been blocked in browsers for years the reporter should have known this

sohkamyung 6y ago

Not really the article's fault. As they state near the end, Microsoft themselves didn't provide this info. > Thursday’s [Microsoft] post doesn’t explicitly say what, if any, user interaction is required for infections to occur. It’s also not clear what effect defenses like User Account Control have. Microsoft makes no mention of the attack hitting browsers running macOS or Linux, so it's likely this campaign affects only Windows users. Microsoft representatives didn’t respond to an email asking for details.

upofadown 6y ago
It is still the articles fault for existing at all. The behaviour of the payload is not very interesting or helpful and you have to read almost the entire article to discover that you have wasted your time.
- throwanem 6y ago
  That's fairly typical of a Dan Goodin article. The best you can really hope to do is pick out some search terms that'll find something actually useful, like the source material in this case: https://www.microsoft.com/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/ https://www.microsoft.com/security/blog/2020/12/10/widesprea...
gruez 6y ago
>It’s also not clear what effect defenses like User Account Control have Obligatory: UAC is not a security feature: https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94... And considering that UAC only protects against admin (aka root) access, this xkcd applies https://xkcd.com/1200/ https://xkcd.com/1200/

GoblinSlayer 6y ago

Update installations are dropping so ms tries to reinvigorate interest in them. Well, Edge proposes to open the file after download.

sys_64738 6y ago

It's the line about dropping installer exe files into a directory which is where I stopped reading. This sounds like it needs user execution so isn't really anything new.

grishka 6y ago

It's like those "oh my god new Android malware is eating the world" articles that just casually say "after the user installs the apk and gives it device admin permissions" as if it's not a barrier at all. Coincidently, these articles are usually written by anti-virus companies.

afrcnc 6y ago

it's social engineering 100%, automatic drive-by installs have been blocked in browsers for years the reporter should have known this