4 ms·

So people just download .exe files that they see in those forum posts and run them on their machines? New world indeed...

by p-e-w 3y ago

userbinator 3y ago
[flagged]
- piecerough 3y ago
  Tell us more about "I don't aee anything suspicious". How exactly do you know it's not a binary that hashes all your files using a key and asks for btc to revert?
  - peddling-brink 3y ago
    There are libraries that would be useful for cryptography that you wouldn’t likely need in an audio codec. If the binary imports those libraries, it may be visible with a bit of prodding.
    - p-e-w 3y ago
      Unless they are statically linked. Or the binary uses executable compression. Or obfuscated dynamic loading. Or about a million other techniques that can thwart dependency analysis, and which have been well-known for decades.
      - TylerE 3y ago
        And precense of those things is basically the first thing any malware heuristic looks at. Why are you so emphatically stating them as if they are news?
        0xDEADFED5 3y ago
        i think they were just examples of how simply looking at imports isn't good enough, and it's true. on the plus side, by hitting HN there are more eyes on it and hopefully more consensus on how safe/interesting this is
  - userbinator 3y ago
    Open in hex/text editor, scroll through and look for anything suspicious like network, crypto, obfuscated sections (major red flag), strange strings, etc. The #1 most reliable sign of malware is if it's unusually large and packed/obfuscated, but this isn't. The guy even has his full name and contact info in there. This is harmless. If you don't trust me you could upload to an online malware multiscanner (which tends to invite false positives, but better than nothing).
    - p-e-w 3y ago
      It's not about whether this particular announcement, with these particular executables, is trustworthy or not. It's about the whole process of regularly downloading and running executables uploaded by individuals to a BBS-type forum being unimaginable in most other parts of the software world, and violating every security "best practice" written about in the past 30 years. I know that this is how things were once done everywhere. But that was a long time ago.
      - Dalewyn 3y ago
        Are we even in the same universe? The vast majority of the world still downloads and runs executables uploaded by individuals, albeit perhaps not on a bulletin board or forum (most of those have been killed and replaced by social media).
        wokwokwok 3y ago
        This argument comes up reasonably regularly. No, the majority of the world does not download and run binaries from non-reputable sources. The distinction between reputable and non-reputable varies, but broadly easily spoofable user uploaded content falls into the non-reputable. Most people download software from trust worthy websites like the official chrome website. Indeed, the fact that people are continually scammed by this sort of attack is why Apple now refuses to run unsigned binaries by default. To pretend nothing is wrong here is like pretending JavaScript supply chain attacks don’t exist because you don’t want them to exist. …and yet. They do exist; wanting it not to be true does not make it so. Likewise, downloading and running arbitrary binaries from a forum is naive. You simply want nothing bad to happen. That does not mean nothing bad will actually happen. Even if you trust the authors of the posts, how reputable is the forum itself? Are the binary hashes posted? (No, they aren’t). > I'm new in this forum ^ does not inspire confidence.
- p-e-w 3y ago
  Yeah, I too was using the web in the late 90s. I remember countless programming and "hacking" forums where .exes were shared, and I downloaded and ran anything and everything that had a download link. It was a fun time, and I do harbor some nostalgia for it. But I can't imagine going back.
  - 0xDEADFED5 3y ago
    it was okay back then though, because the cracked copy of NOD32 on your system would totally protect you =)
- mxmilkiib 3y ago
  Corporate? That's not a sound way to describe the totality of the world of programmers that lean towards free/open and beyond. Sure, closed-source communities exist and have for a long age, but many folk have grown beyond the ethos or tradition of closed releases for reasons like, IDK, competitive individualism for clout or potential code quality shame that AFAICT drive such corners of the software world, especially at the level of freeware, not just for business. It's certainly a new world for younger people who skipped the era when that was more prevalent. If people don't like corporate, there are newer source available licence options that folk to the left of free/open have been advocating more recently.
- dang 3y ago
  Hey, could you please edit out swipes and/or name-calling from your HN posts? This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Your comment would be just fine without the (first clause of the) second sentence.
lifthrasiir 3y ago
You can always use a sandbox if that's the most concern. A bigger issue is that, as like other established forums, enough many people don't know much about data compression and contribute to the noise.
HakanAbbas 3y ago
My goal is to try to do something practical just on data compression. I have neither knowledge nor experience about malicious software mentioned. You may be comfortable about this. https://www.linkedin.com/in/hakan-abbas-178b5852/ https://www.linkedin.com/in/hakan-abbas-178b5852/
- p-e-w 3y ago
  I was referring to the practice of downloading executables from such forums in general, not to your post specifically. I have no reason to suspect that this particular post contains any malware. But in most parts of the software world, Open Source has been the standard for experimental publications for a long, long time, and seeing a forum depart so strongly from that standard is certainly surprising, and does of course have security implications when this practice is used at scale.
npteljes 3y ago
That's an old world, for me. It's how the Windows software ecosystem worked and works to this day.
matheusmoreira 3y ago
There are open source developers out there who literally write installation instructions like these in their READMEs: curl http://example.com/script.sh | bash

So people just download .exe files that they see in those forum posts and run them on their machines? New world indeed...

by p-e-w 3y ago

So people just download .exe files that they see in those forum posts and run them on their machines? New world indeed...

userbinator 3y ago

[flagged]

piecerough 3y ago
Tell us more about "I don't aee anything suspicious". How exactly do you know it's not a binary that hashes all your files using a key and asks for btc to revert?
- peddling-brink 3y ago
  There are libraries that would be useful for cryptography that you wouldn’t likely need in an audio codec. If the binary imports those libraries, it may be visible with a bit of prodding.
  - p-e-w 3y ago
    Unless they are statically linked. Or the binary uses executable compression. Or obfuscated dynamic loading. Or about a million other techniques that can thwart dependency analysis, and which have been well-known for decades.
    - TylerE 3y ago
      And precense of those things is basically the first thing any malware heuristic looks at. Why are you so emphatically stating them as if they are news?
      - 0xDEADFED5 3y ago
        i think they were just examples of how simply looking at imports isn't good enough, and it's true. on the plus side, by hitting HN there are more eyes on it and hopefully more consensus on how safe/interesting this is
- userbinator 3y ago
  Open in hex/text editor, scroll through and look for anything suspicious like network, crypto, obfuscated sections (major red flag), strange strings, etc. The #1 most reliable sign of malware is if it's unusually large and packed/obfuscated, but this isn't. The guy even has his full name and contact info in there. This is harmless. If you don't trust me you could upload to an online malware multiscanner (which tends to invite false positives, but better than nothing).
  - p-e-w 3y ago
    It's not about whether this particular announcement, with these particular executables, is trustworthy or not. It's about the whole process of regularly downloading and running executables uploaded by individuals to a BBS-type forum being unimaginable in most other parts of the software world, and violating every security "best practice" written about in the past 30 years. I know that this is how things were once done everywhere. But that was a long time ago.
    - Dalewyn 3y ago
      Are we even in the same universe? The vast majority of the world still downloads and runs executables uploaded by individuals, albeit perhaps not on a bulletin board or forum (most of those have been killed and replaced by social media).
      - wokwokwok 3y ago
        This argument comes up reasonably regularly. No, the majority of the world does not download and run binaries from non-reputable sources. The distinction between reputable and non-reputable varies, but broadly easily spoofable user uploaded content falls into the non-reputable. Most people download software from trust worthy websites like the official chrome website. Indeed, the fact that people are continually scammed by this sort of attack is why Apple now refuses to run unsigned binaries by default. To pretend nothing is wrong here is like pretending JavaScript supply chain attacks don’t exist because you don’t want them to exist. …and yet. They do exist; wanting it not to be true does not make it so. Likewise, downloading and running arbitrary binaries from a forum is naive. You simply want nothing bad to happen. That does not mean nothing bad will actually happen. Even if you trust the authors of the posts, how reputable is the forum itself? Are the binary hashes posted? (No, they aren’t). > I'm new in this forum ^ does not inspire confidence.
p-e-w 3y ago
Yeah, I too was using the web in the late 90s. I remember countless programming and "hacking" forums where .exes were shared, and I downloaded and ran anything and everything that had a download link. It was a fun time, and I do harbor some nostalgia for it. But I can't imagine going back.
- 0xDEADFED5 3y ago
  it was okay back then though, because the cracked copy of NOD32 on your system would totally protect you =)
mxmilkiib 3y ago
Corporate? That's not a sound way to describe the totality of the world of programmers that lean towards free/open and beyond. Sure, closed-source communities exist and have for a long age, but many folk have grown beyond the ethos or tradition of closed releases for reasons like, IDK, competitive individualism for clout or potential code quality shame that AFAICT drive such corners of the software world, especially at the level of freeware, not just for business. It's certainly a new world for younger people who skipped the era when that was more prevalent. If people don't like corporate, there are newer source available licence options that folk to the left of free/open have been advocating more recently.
dang 3y ago
Hey, could you please edit out swipes and/or name-calling from your HN posts? This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html. Your comment would be just fine without the (first clause of the) second sentence.

lifthrasiir 3y ago

You can always use a sandbox if that's the most concern. A bigger issue is that, as like other established forums, enough many people don't know much about data compression and contribute to the noise.

HakanAbbas 3y ago

My goal is to try to do something practical just on data compression. I have neither knowledge nor experience about malicious software mentioned. You may be comfortable about this. https://www.linkedin.com/in/hakan-abbas-178b5852/ https://www.linkedin.com/in/hakan-abbas-178b5852/

p-e-w 3y ago
I was referring to the practice of downloading executables from such forums in general, not to your post specifically. I have no reason to suspect that this particular post contains any malware. But in most parts of the software world, Open Source has been the standard for experimental publications for a long, long time, and seeing a forum depart so strongly from that standard is certainly surprising, and does of course have security implications when this practice is used at scale.

npteljes 3y ago

That's an old world, for me. It's how the Windows software ecosystem worked and works to this day.

matheusmoreira 3y ago

There are open source developers out there who literally write installation instructions like these in their READMEs: curl http://example.com/script.sh | bash