4 ms·
The Curious Case of QUEENCREEK
- apitman 2y agoWould be interested to know the etymology of the program name. There's a large suburb of Phoenix called Queen Creek.
- joshchaney 2y agoIntel's Ocotillo campus in Chandler, AZ is right off Queen Creek Rd. Pretty sure that's all it is.
- skunkworker 2y agoI could see this being the case, Queen Creek, AZ is about 15 minutes to the south by southeast from Chandler, AZ.
- staplers 2y agoFurthermore, it opens the door for malware to “join the party” Or is a placeholder for state-sanctioned backdoors. Clearly too sophisticated to apply Hanlon's Razor.
- perching_aix 2y agoi like the entirely not subtle irony of citing hanlon's razor in the same message you suggest a more elaborate and intentionally malicious alternative explanation
- staplers 2y agoRight, because I knew someone would come along and spout it since most haven't read the edward snowden leaks or don't understand how modern intelligence agencies work.
- perching_aix 2y agoclearly i just don't understand it dude. you're the center of the universe too.
- deleted 2y ago[deleted]
- mrandish 2y agoI really hate it when major PC vendors name autorun tasks (or really any background task) with cryptic names that don't clearly identify the vendor and application. Yes, I realize we can't trust the name is legit without further verification. But when it is legit, knowing the vendor and app identity right in the name saves time. It would be nice if ALL applications did this but I can forgive a small open source project not doing so. However, when a Fortune 500 tech company with millions of users does it, it's unforgivable. It costs nothing to make your user's lives just a little bit easier. Also, for fuck's sake please populate the standard Window's file metadata for all your EXEs and DLLs when you're releasing products. I shouldn't have to run your app to find out the version number, vendor name, app name, release date, etc.
- Joker_vD 2y ago> the standard Window's file metadata for all your EXEs and DLLs when you're releasing products It has just occured to me that I don't know what are the ELF's counterparts of those fields... does ELF even have their counterparts?
- JoshTriplett 2y agoELF doesn't have standard fields for describing where an executable came from. Linux systems haven't historically needed this, because every executable on the system (outside of the user's home directory or sometimes /usr/local) should belong to a package or shouldn't be there at all. So the typical Linux equivalent would be `dpkg -S /usr/bin/executablename`, or a similar incantation on RPM or pacman or ... Even proprietary software should be using a packaging system, whether that's the distribution packaging system, or some proprietary software containment system like flatpak/snap/etc. Such metadata would be more important on a system that regularly installs not just proprietary software but unpackaged proprietary software.
- Joker_vD 2y ago> every executable on the system (outside of the user's home directory) should belong to a package or shouldn't be there at all. Is there any write-up about how this view came to be accepted in the most popular Linux distributions? Or, more generally, on the history of software packaging in the Linux world?
- londons_explore 2y ago> A vbs script to call a bat script to call an exe. Who let that ship? Who did the code review?
- deleted 2y ago[deleted]
- Tanoc 2y agoSomebody who expected to be able to hook more into it, or intentionally left that many steps to allow someone else to hook into it. I've seen things like this where the intended result is that you can modify one parent launcher so others can call child launchers without modifying them, only adding more of them. Planning too broadly or too far ahead can amusingly be it's own form of incompetence.
- londons_explore 2y agoThing is, that's very "sysadmin-y". A developer would typically just want their exe file be called directly, and if they need to hook more things into the startup process, they'll write more code into the start of int main()
- jiggawatts 2y agoThe QUEENCREEK components may as well be malware, not just "appearing" to be malware. These services are insanely invasive and resource hungry, to the point that I regularly have to scrub them out of my system. If I don't, my CPU fans will spin up and make turbine noises while this monstrosity collects every piece of metadata it possibly can to be sent back to big brother at Intel. To expand on the comments in the original article, this is the description text file of one of these services: Inte(R) System Usage Report Service SystemUsageReportSvc_QUEENCREEK monitors the computer system usage and helps to improve system's performance." Intel is misspelled. That's insane for a Fortune 500 company. At most such organisations, you'd be raked over hot coals if you did something like this. Let us also ignore the missing 'the' or 'your' in "helps to improve system's performance." -- either way this is a flat lie. It doesn't improve performance in any way. It's spyware sending telemetry, that's all it does. The industry-wide problem is that there are zero consequences to this type of shoddy code deployed to a billion devices globally. It's just waiting to be next global Crowdstrike-style outage or remote code execution exploit. PS: Right next to this spyware in the list of services is the "Intel® Dynamic Application Loader". I won't describe it here, read for yourself what this does "for you", and for state actors that might want to hide malware that even the operating system can't access: https://www.intel.com/content/www/us/en/developer/tools/dal/overview.html https://www.intel.com/content/www/us/en/developer/tools/dal/...
- lxgr 2y agoThis shows how much of a false sense of security code signing can create when done inconsistently like this: Highlighting unsigned binaries as dangerous, yet displaying an entry `python.exe malware.py` as trustworthy is… not great. Relatedly, I really wish runtimes and interpreters would rename their process to the name of the file they are running by default. Finding out which `java` or `python` out of dozen identical processes I need to kill isn’t fun.
- layer8 2y agoYou can use this: WMIC path win32_process get Caption,Processid,Commandline
- lxgr 2y agoYes, and on Linux I can also use the appropriate flags to `ps`, but I wish I wouldn't have to look at (potentially very cluttered) full command lines or command invocations. It makes everything run as <interpreter> <script> just feel less "native" when dealing with processes than binary executables (or things run via binfmt_misc, which is unfortunately not very common for Java applications at least, and it seems like a mix for Python as well).
- layer8 2y agoThere is no API for a process to change its name. More precisely, there is no concept of a “process name”, there is only the name of the executable file (image) that was loaded.
- lxgr 2y agoAt least on Linux, it's definitely possible with prctl(2): PR_SET_NAME Set the name of the calling thread, using the value in the location pointed to by name. The name can be up to 16 bytes long, including the terminating null byte. If the length of the string, including the terminating null byte, exceeds 16 bytes, the string is silently truncated.
- ashleyn 2y agoCrazy for intel to name it something that sounds exactly like a CIA tailored operations codeword.
- hakfoo 2y agoI was thinking that it was named for the town in Arizona; it's within commuter range of Intel's large presence there. Perhaps the developer was browsing home listings at the time.