4 ms·

RIP to the greatest malware-writing language of all time... or at least until everyone adopts PowerShell

pjmlp 3y ago
Forgeting about JScript? Powershell can be configured to prevent those attack vectors. Also hardly any different from people doing "curl | sudo sh" to install random stuff.
- javchz 3y ago
  Hahaha totally. I love how a lot of Linux users go and make fun of windows security, but 90% of tutorials go around throwing sudos commands "because why not", with some of them even curling sh files from servers with weird domains. And the weirdest thing? 99.999% of the time there is not malware involved... but it totally could. It reminds me of those towns where people go to work without locking their doors. It's beautiful and sketchy at the same time.
  - Eggpants 3y ago
    Just do a curl | more and look over what the script actually does. Totally.
TheJoeMan 3y ago
One file I can send to a non-tech-savvy coworker and they can double click and run. A PowerShell script refuses to run because nanny Microsoft is smarter than you.
delfinom 3y ago
Powershell since Windows 10 defaults to require code signing. Developer mode lets you change that back to running local made scripts. Otherwise there are also settings that allow locally created files but block downloaded powershell files using NTFS alternate data stream tags.
hulitu 3y ago
We have web browsers now. Why bother with local programs ? /s
- bobim 3y ago
  Ah ah! We have governments, why bother with brains !?
mips_r4300i 3y ago
Saw Powershell used recently for a Redline Stealer bootstrap. Someone made a game repack with "Advanced Installer" which is legit, but added a plugin DLL which lets them run PS with the same privileges. The installer was digitally signed and requested admin, since it was an installer of course. The first thing the PS script did was to add Windows Defender exceptions to hide itself. And it worked beautifully. All the rest of the downloading, decrypting, and making the scheduled task to start Redline at user login succeeded. The only tipoff was seeing Powershell.exe in task manager with a base64 encoded command line argument. Any sufficiently advanced system administration tool is also powerful enough for a worm. The whole experience reminds me a lot of those early worms in the 2000s.

Forgeting about JScript? Powershell can be configured to prevent those attack vectors. Also hardly any different from people doing "curl | sudo sh" to install random stuff.

javchz 3y ago
Hahaha totally. I love how a lot of Linux users go and make fun of windows security, but 90% of tutorials go around throwing sudos commands "because why not", with some of them even curling sh files from servers with weird domains. And the weirdest thing? 99.999% of the time there is not malware involved... but it totally could. It reminds me of those towns where people go to work without locking their doors. It's beautiful and sketchy at the same time.
- Eggpants 3y ago
  Just do a curl | more and look over what the script actually does. Totally.

TheJoeMan 3y ago

One file I can send to a non-tech-savvy coworker and they can double click and run. A PowerShell script refuses to run because nanny Microsoft is smarter than you.

delfinom 3y ago

Powershell since Windows 10 defaults to require code signing. Developer mode lets you change that back to running local made scripts. Otherwise there are also settings that allow locally created files but block downloaded powershell files using NTFS alternate data stream tags.

hulitu 3y ago

We have web browsers now. Why bother with local programs ? /s

bobim 3y ago
Ah ah! We have governments, why bother with brains !?

mips_r4300i 3y ago

Saw Powershell used recently for a Redline Stealer bootstrap. Someone made a game repack with "Advanced Installer" which is legit, but added a plugin DLL which lets them run PS with the same privileges. The installer was digitally signed and requested admin, since it was an installer of course. The first thing the PS script did was to add Windows Defender exceptions to hide itself. And it worked beautifully. All the rest of the downloading, decrypting, and making the scheduled task to start Redline at user login succeeded. The only tipoff was seeing Powershell.exe in task manager with a base64 encoded command line argument. Any sufficiently advanced system administration tool is also powerful enough for a worm. The whole experience reminds me a lot of those early worms in the 2000s.