4 ms·

Seems like a pirated .iso would be a great place to deliver malicious code to Ring 0, hiding itself from the kernel and becoming essentially impossible to detec

Seems like a pirated .iso would be a great place to deliver malicious code to Ring 0, hiding itself from the kernel and becoming essentially impossible to detect from the infected OS itself. I'm sure botnet creators are already well aware of this.

deleted 15y ago
[deleted]
- rictic 15y ago
  Against what? Keep in mind these ISOs are already modified to get around the built-in copy protection in the stock version.
  - uxp 15y ago
    Not always. The most common and reliable piracy channel for Windows 7 right now is by updating your BIOS with a SLIC signature, and then installing Windows as a valid OEM copy. The installation ISOs can be SHA1 and MD5 hash checked against the same versions given out on Microsoft's TechNet site, because it's the same disk required to install any version of Windows 7. Granted, flashing your BIOS with random binaries floating around the internets is just as bad, if not worse, than installing random pirated binaries, but it's a lot easier* to check whether or not a 512KB dump is exactly the same as the version given out by the manufacturer's site with the exception of a section of non-executable address space than it is to check to see if the only modifications to a 4.2GB ISO are on activation-related components. For tomorrows readers: http://en.wikipedia.org/wiki/BIOS#SLIC http://en.wikipedia.org/wiki/BIOS#SLIC * Easier, for people who know how to diff hexdumps and BIOS firmware...
- waffle_ss 15y ago
  Wouldn't that only work for the Enterprise editions, which typically are quickly blocked from activation and updates by Microsoft after being leaked?
- steve-howard 15y ago
  A pirated .iso already modifies the data from the official release because it has to break the activation code somehow. Thus, you can't check it against any official hash. From there, the best you can hope for is to find a "canonical" hacked version and check against that, but since most people aren't really capable of breaking protections, they'll trust whatever shows up on the pirate bay.
  - danudey 15y ago
    Most pirated ISOs I've seen aren't activation-cracked. I've had to download a few legitimately for systems that only came with a 'recovery partition', and whose hard drive failed or needed upgrading. I try to only download 'legit' ISOs (OEM or regular), or at least ISOs that look legit. It would be nice if I had some way of verifying them against each other to see if they've been modified.
    - lvillani 15y ago
      You can compare SHA1 hashes using this TechNet page for reference: http://technet.microsoft.com/subscriptions/downloads/default.aspx?pv=36:350#searchTerm=&ProductFamilyId=350&Languages=en&PageSize=10&PageIndex=0&FileId=0 http://technet.microsoft.com/subscriptions/downloads/default... (click "Details" to reveal the SHA1 hash).
  - xtracto 15y ago
    Actually, you can download the Windows (Vista and 7) ISOs legally provided by Microsoft ( see http://forum.notebookreview.com/windows-os-software/428068-legal-windows-7-download-links-just-like-vista-before.html http://forum.notebookreview.com/windows-os-software/428068-l... ). Then it is your decision whether to buy a license or download an activator (which you can download after installing all the antivirus programs in the world)
huggyface 15y ago
This is what I marvel at when I read such (poorly justified) piracy screeds. Are people insane? I might not have ultimate faith in Microsoft, but comparatively I have zero faith (and a lot of suspicion) of what are essentially bands of thieves among piracy groups. I engaged in casual piracy when I was a teen out of necessity, though I never felt the need to invent justifications. In my adult life, though...pirating executables is the domain of the naive or the ridiculously trustworthy.
- Cushman 15y ago
  Eh. If anything, the scene is demonstration that a completely open, self-regulated market can function in at least some sense. Maybe one group doesn't have any strong disincentive to posting a corrupted release, but other groups have a strong incentive to discredit them, and reputation is valuable (as much as anything can be in a free economy). There is a fairly effective web of trust. You can't be sure, of course, but then I can't be sure that my "legal" software won't install a rootkit behind my back either-- or if I am, it's because I'm going on the word of criminals who are trying to redistribute it.
- Karunamon 15y ago
  I've got a lot more faith in a torrent uploaded by a person with lots of other torrents (who has no motive but reputation and altruism), with lots of seeders than I do in a corporation who has a clear and present motive to make me miserable. And somehow, I've never been infected by this. It's my conclusion that, much like the *AA groups nonsense comparisons of piracy to theft, the security threats are overstated by companies in an attempt to scare people straight.
  - Game_Ender 15y ago
    If it's a really good root kit, how would you know you have been infected?
    - Karunamon 15y ago
      Probably because I'd find the appropriated information used somewhere. It's been at least 5 years with not a hint of fraudulent use of my ID or payment info. I have, however, been victimized multiple times by corporations being negligent with my data in the same time period. Sony and whatnot. Kind of interesting that it's safer to download random untrusted OS code from the internet than to give my information to a "safe" corporation... In any case, it's an interesting thought experiment but it gets absurd quickly when realized. How do you know you're not infected right now by a "really good rootkit"? Unless you wrote the compiler by hand, compiled every bit of the OS by yourself, wrote the firmware for your hardware using the same compiler, etc etc etc, you can't be 100% sure. You can be reasonably sure, of course. 99% with a few juicy trailing 9's for good measure, but not 100%. It's the same way you can't objectively prove you're not dreaming right now.
StavrosK 15y ago
So, basically, "pirated isos might have rootkits"?
marvin 15y ago
This is ingenious, or else I am just really dense; I had never thought of this. I'm assuming that it wouldn't be trivial to write such a hack, but if you were able to, it would be a self-distributing botnet hack. You wouldn't be able to get the same reach the botnets that use exploits do, but you would remain pretty much indetectable. Thanks for sharing.
toyg 15y ago
An original .iso would be a great place to deliver keylogging software and backdoors for law enforcement and international espionage purposes. I'm sure law enforcement agencies are already well aware of this. Not trolling: incentives and processes are basically the same for any entity distributing precompiled binaries, from MS to Symantec to Skype to Apple to Canonical. They don't do it because of the potential for huge reputation hits... exactly like most people in "the scene".

deleted 15y ago

[deleted]

rictic 15y ago
Against what? Keep in mind these ISOs are already modified to get around the built-in copy protection in the stock version.
- uxp 15y ago
  Not always. The most common and reliable piracy channel for Windows 7 right now is by updating your BIOS with a SLIC signature, and then installing Windows as a valid OEM copy. The installation ISOs can be SHA1 and MD5 hash checked against the same versions given out on Microsoft's TechNet site, because it's the same disk required to install any version of Windows 7. Granted, flashing your BIOS with random binaries floating around the internets is just as bad, if not worse, than installing random pirated binaries, but it's a lot easier* to check whether or not a 512KB dump is exactly the same as the version given out by the manufacturer's site with the exception of a section of non-executable address space than it is to check to see if the only modifications to a 4.2GB ISO are on activation-related components. For tomorrows readers: http://en.wikipedia.org/wiki/BIOS#SLIC http://en.wikipedia.org/wiki/BIOS#SLIC * Easier, for people who know how to diff hexdumps and BIOS firmware...
waffle_ss 15y ago
Wouldn't that only work for the Enterprise editions, which typically are quickly blocked from activation and updates by Microsoft after being leaked?
steve-howard 15y ago
A pirated .iso already modifies the data from the official release because it has to break the activation code somehow. Thus, you can't check it against any official hash. From there, the best you can hope for is to find a "canonical" hacked version and check against that, but since most people aren't really capable of breaking protections, they'll trust whatever shows up on the pirate bay.
- danudey 15y ago
  Most pirated ISOs I've seen aren't activation-cracked. I've had to download a few legitimately for systems that only came with a 'recovery partition', and whose hard drive failed or needed upgrading. I try to only download 'legit' ISOs (OEM or regular), or at least ISOs that look legit. It would be nice if I had some way of verifying them against each other to see if they've been modified.
  - lvillani 15y ago
    You can compare SHA1 hashes using this TechNet page for reference: http://technet.microsoft.com/subscriptions/downloads/default.aspx?pv=36:350#searchTerm=&ProductFamilyId=350&Languages=en&PageSize=10&PageIndex=0&FileId=0 http://technet.microsoft.com/subscriptions/downloads/default... (click "Details" to reveal the SHA1 hash).
- xtracto 15y ago
  Actually, you can download the Windows (Vista and 7) ISOs legally provided by Microsoft ( see http://forum.notebookreview.com/windows-os-software/428068-legal-windows-7-download-links-just-like-vista-before.html http://forum.notebookreview.com/windows-os-software/428068-l... ). Then it is your decision whether to buy a license or download an activator (which you can download after installing all the antivirus programs in the world)

huggyface 15y ago

This is what I marvel at when I read such (poorly justified) piracy screeds. Are people insane? I might not have ultimate faith in Microsoft, but comparatively I have zero faith (and a lot of suspicion) of what are essentially bands of thieves among piracy groups. I engaged in casual piracy when I was a teen out of necessity, though I never felt the need to invent justifications. In my adult life, though...pirating executables is the domain of the naive or the ridiculously trustworthy.

Cushman 15y ago
Eh. If anything, the scene is demonstration that a completely open, self-regulated market can function in at least some sense. Maybe one group doesn't have any strong disincentive to posting a corrupted release, but other groups have a strong incentive to discredit them, and reputation is valuable (as much as anything can be in a free economy). There is a fairly effective web of trust. You can't be sure, of course, but then I can't be sure that my "legal" software won't install a rootkit behind my back either-- or if I am, it's because I'm going on the word of criminals who are trying to redistribute it.
Karunamon 15y ago
I've got a lot more faith in a torrent uploaded by a person with lots of other torrents (who has no motive but reputation and altruism), with lots of seeders than I do in a corporation who has a clear and present motive to make me miserable. And somehow, I've never been infected by this. It's my conclusion that, much like the *AA groups nonsense comparisons of piracy to theft, the security threats are overstated by companies in an attempt to scare people straight.
- Game_Ender 15y ago
  If it's a really good root kit, how would you know you have been infected?
  - Karunamon 15y ago
    Probably because I'd find the appropriated information used somewhere. It's been at least 5 years with not a hint of fraudulent use of my ID or payment info. I have, however, been victimized multiple times by corporations being negligent with my data in the same time period. Sony and whatnot. Kind of interesting that it's safer to download random untrusted OS code from the internet than to give my information to a "safe" corporation... In any case, it's an interesting thought experiment but it gets absurd quickly when realized. How do you know you're not infected right now by a "really good rootkit"? Unless you wrote the compiler by hand, compiled every bit of the OS by yourself, wrote the firmware for your hardware using the same compiler, etc etc etc, you can't be 100% sure. You can be reasonably sure, of course. 99% with a few juicy trailing 9's for good measure, but not 100%. It's the same way you can't objectively prove you're not dreaming right now.

StavrosK 15y ago

So, basically, "pirated isos might have rootkits"?

marvin 15y ago

This is ingenious, or else I am just really dense; I had never thought of this. I'm assuming that it wouldn't be trivial to write such a hack, but if you were able to, it would be a self-distributing botnet hack. You wouldn't be able to get the same reach the botnets that use exploits do, but you would remain pretty much indetectable. Thanks for sharing.

toyg 15y ago

An original .iso would be a great place to deliver keylogging software and backdoors for law enforcement and international espionage purposes. I'm sure law enforcement agencies are already well aware of this. Not trolling: incentives and processes are basically the same for any entity distributing precompiled binaries, from MS to Symantec to Skype to Apple to Canonical. They don't do it because of the potential for huge reputation hits... exactly like most people in "the scene".