5 ms·
Do tech people execute such exe files? Doesn't seem like a novelty method, does it?
by zerr 3y ago
Do tech people execute such exe files? Doesn't seem like a novelty method, does it?
- nubinetwork 3y agoSee Linus Tech Tips getting his YouTube accounts "hacked".
- Dylan16807 3y agoScare quotes make sense for social engineering, but if there's a trojan installed and used to increase access I would say that's enough to qualify as hacking.
- nubinetwork 3y agoRunning an exe that steals your session cookies isn't really hacking, hence the air quotes.
- Dylan16807 3y agoSo do you not think trojans count at all?
- nubinetwork 3y agoTricking someone into running a program isn't hacking... it's malware and social engineering.
- seanhunter 3y agoThat’s a distinction without a difference.
- Dylan16807 3y agoSetting aside the trick itself, using malware to gain additional privileges is usually considered hacking.
- hnlmorg 3y ago99% of the time, no. But you only need one person to be absent minded (perhaps tired, maybe stressed and multitasking, maybe receiving constant interruptions from kids or work colleagues, etc). There was some story I read years ago about how terrorists (I think it was) could have their plot foiled 99% of the time but they only needed to be successful once. Whereas their targets need to be successful 100% of the time. (I wish I could remember where I heard that)…anyways, this applies to IT security too.
- Eisenstein 3y ago> (I wish I could remember where I heard that) You probably heard it from multiple sources since it is a cliche used in all types of security fields. Kind of like how 'if you are getting something of value for free you are the product not the client' is for web-services people.
- hnlmorg 3y agoTrue. I’ve definitely heard it a few times. But there is one particular occasion that really stuck out at me. The way it was phrased, the specific domain, it was really poignant. I think because it was about terrorists and people losing lives, it brought a more tangible, human, cost to the equation.
- NegativeK 3y ago> this applies to IT security too. This is true, but an IT security team also has a huge number of opportunities to detect an intruder. If the defender has just one security vulnerability, the intruder can get in -- and the defender typically won't know about the security vulnerability ahead of time. If the intruder is noisy just once, the defender can catch them -- and the intruder typically won't know what's being listened to or even what systems/credentials are real.
- hnlmorg 3y agoDetection is important but by that point damage has already been done. Detection will just allow you to scope out the scale of the damage. It’s also worth noting that we are talking about contractors laptops here. So they wouldn’t be subject to management by IT security teams. At best, they’re entirely disconnected from the IT systems that contractor is hired to work on. It at worse, they’re used as a BYOD. And the worst case is surprisingly often the norm.
- thih9 3y ago> Do tech people execute such exe files? It depends. Is this an .exe file in an email attachment? Then usually no. Is this a github project which asks you to “curl totallysafe.com | sh”? Then often yes.
- spacemanspiff01 3y agoNo way would I ever run a random exe. I only run random bash scripts from the internet with sudo permissions
- DesiLurker 3y agoI was thinking about this, if I have already done sudo in a shell & its authentication is active for a bit then any shell script I run (source) can potentially do a sudo and elevate status.
- archi42 3y ago`sudo -k` is your friend ;-) But for an attacker that convinced you to run some malicious shell commands (e.g. `curl ...| sh` or copy/pasting more than you bargained for) that's only a minor inconvenience; next time you sudo, they're root anyway. //Edit Also, an attacker aiming for root is a red herring. One compromised account can already be bad enough - why would they need root on your private computer when they already stole your password database, keylogged your master password and created an off-site backup of your home dir?
- DesiLurker 3y agoits been a few days but thanks for response. My concern was not a random attacker but the stuff I run after git clone from github, without much thought, I might add. it is possible for hacker to hide malicious code in a innocent looking git repo for some hot new project. wait for some people to give root access inside their home or better yet office lan & add a cronjob to steal stuff nightly with a LLMs help? In any case safest route is to always do a new shell (or a docker vm) for fun activities.
- jstarfish 3y agoIt's 2023, and Windows still hides file extensions by default. Easy mistake to make.