4 ms·

Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I

Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I actually don't know a ton about the Windows permissions model. If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? (I guess installing a keylogger could cause it to be detected by antivirus software?) Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? What are reflective .net assembly loading & thread injection? That's quite a list of file extensions! It seems like Windows is astonishingly willing to execute unwanted code. Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS.

_8j50 3y ago
> If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords. all the passwords you saved to everything get exposed to the malware. Most services you use regularly these days don't require frequent logins on the same device either. For example, you may only login to your school/work at a different pc but you sync passwords on the same google account because you also check your personal email there. Now any malware at any of those devices gets your saved password and payment info. Not to mention session cookies! > I guess installing a keylogger could cause it to be detected by antivirus software? Maybe, maybe not but the av might clean it up before it gets any creds keylogged. Part of the secuity model for password managers too. > Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? Yes, and avoid allowing chrome and edge to sync stuff, it's very useful for attackers lol. > What are reflective .net assembly loading & thread injection? I am sure a google search would be better than me trying to explain those in depth here. Basically you can execute code in memory without having to store the code anywhere on disk, it helps with cheaper av that focus more on disk and registry than memory and api call hooking. > Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS. On windows by default .js is not javascript but jscript, a native script langauge similar to javascript used a lot before powershell was a thing. The windows script host (wscript.exe) will attempt to execute any .js files you double click on by default
- 0xDEAFBEAD 3y ago
  Thanks for the details!

_8j50 3y ago

> If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? Browsers sync passwords. all the passwords you saved to everything get exposed to the malware. Most services you use regularly these days don't require frequent logins on the same device either. For example, you may only login to your school/work at a different pc but you sync passwords on the same google account because you also check your personal email there. Now any malware at any of those devices gets your saved password and payment info. Not to mention session cookies! > I guess installing a keylogger could cause it to be detected by antivirus software? Maybe, maybe not but the av might clean it up before it gets any creds keylogged. Part of the secuity model for password managers too. > Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? Yes, and avoid allowing chrome and edge to sync stuff, it's very useful for attackers lol. > What are reflective .net assembly loading & thread injection? I am sure a google search would be better than me trying to explain those in depth here. Basically you can execute code in memory without having to store the code anywhere on disk, it helps with cheaper av that focus more on disk and registry than memory and api call hooking. > Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS. On windows by default .js is not javascript but jscript, a native script langauge similar to javascript used a lot before powershell was a thing. The windows script host (wscript.exe) will attempt to execute any .js files you double click on by default

0xDEAFBEAD 3y ago
Thanks for the details!