8 ms·
The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. You also need to create a se
by Melatonic 1y ago
The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account.
You also need to create a separate account (can just be a local account) that is a full administrator. Make sure you use a different password.
Anytime you need to install something or run powershell/CMD as admin it will popup and ask for the separate login of the admin account. This is basically the default of how Linux works (sudo). It's also how any competent professional IT department will run windows.
If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install.
Another benefit is that you can use a relatively normal (but obviously not too short) password for your regular account and then have something much more complicated for the admin login. This is especially great on something like "Grandmas PC" or anyone who is at higher risk of clicking on the wrong thing.
- deleted 1y ago[deleted]
- Phurist 1y agoOr you know... just use Linux
- jay_kyburz 1y agoI've got a snap installed, I think it's for the google command line tools. It will quite often at random times pop up a window in KDE asking for the admin password, and there is nothing in that window that tells me what or why the admin password is needed. Decided it was a risk to just be typing the admin password whenever a random popup asked me to, so disabled all snap automatic updates.
- floundy 1y agoEvery couple of years I give daily driving Linux a try. I still find that old joke about "Linux is only free if your time is worth nothing" to be quite apt.
- sdoering 1y agoI switched to Ubuntu "skinned" with Omakub a few months ago. Never looked back. Work with Windows on my work machine and use my *nix box as my daily dev driver and machine for surfing the net, doing emails and documents. I actually use it for nearly everything except vector graphics/dtp & images, as I am still too used to the affinity suite. Will try out Omarchy just for the fun of it - not that I expect it to become my daily driver. But - depending on your needs - I think Linux can be on par (for me it is way better, longer battery life, better configuration, better tools, smoother workflows, but YMMV).
- udev4096 1y agoPlease don't use that horrible script. It makes no sense to install such bloatware on top of an already bloated distro, which adds unnecessary attack surface. I would recommend fedora or arch, both are perfect for beginners with minimal bloat
- pkulak 1y agoDo you mind elaborating a bit on what went wrong? Like, were you installing on a recent MacBook, or something else not well supported? In my experience, installing and running a popular distro is absolute cake. Easier than Windows, even, since you aren’t forced to create cloud accounts and answer a million privacy questions; you basically install then boot right into your new desktop.
- floundy 1y agoUsed it on various devices. A Dell laptop (with power switching between dedicated and iGPU, what a nightmare that was for Linux display drivers), a desktop I built myself, a Raspberry Pi running RPi OS. I find most things fine in Linux and I'm fairly comfortable with the terminal. However it's the 10% or so of things that are very cumbersome in Linux but instant in Windows/Mac that drive me away. Example: There is no Google Drive client for Linux. Spend an hour dorking around in rclone and get it set up and working with bidirectional sync. The token still expires weekly and needs to be renewed. Yeah, I get a potential solution is "don't use Google Drive" but the little projects to get my current workflow functioning on Linux, or change my workflow to fit Linux's constraints, end up adding up into a bunch of wasted time.
- EvanAnderson 1y agoThere's nothing magical about the Linux security architecture, when it comes to malware, aside from abysmal Linux market share. If it were popular it would be targeted. That's not to say there's no value. It's a case of security by obscurity, at best. The Unix security model is much more simplistic than Windows NT. Everybody disables SELinux so there's no meaningful capabilities functionality. Assuming you actually do run malware, all your user account's data on a Linux machine ends up being just as vulnerable to exfil or ransom as if you're running Windows as a limited user.
- gerdesj 1y ago"Everybody disables SELinux" That implies you are probably using a RH jobbie. With no working whatsover, I assert that many more Linux desktops will be rocking apparmor or no kernel security module. Oh and no I don't disable SELinux, except as a quick check to see if that is what is causing issues. Obviously I'm not everyone, but I am someone.
- EvanAnderson 1y agoI haven't used desktop Linux in a number of years, but back when I did I'd see disabling SELinux was a common recommendation. I hope things are getting better. On the Linux application hosting front the majority of vendor-supported garbage I have the displeasure of supporting that runs outside of Docker disables SELinux as a matter of course.
- gerdesj 1y agoI haven't daily driven anything but Linux for 15 years or more. I remember when Xorg was the new kid and XFree86 could destroy your CRT (or so "they" said - I never managed it!) Mind you I also remember #make config taking about 20 minutes. Advice advocating disabling selinux is very similar to SFC /SCANNOW or "turn off your anti virus". As soon as you see advice like that you do have to wonder at the motive. A quick broad-brush approach to troubleshooting is fine and could be considered the first stage before a binary search is used to get to the real problem. So you make things safe first and then you switch off something like selinux. Does that work? If yes, then you switch it back on and then do your search within selinux and perhaps bother with reading logs. You obviously have to support a lot of cough enterprise ... RH based stuff or perhaps Oracle's sufferings. If you can, call someone's bluff: Insist on a standard. PCI DSS is involved as soon as a payment card is involved - that will soon sort things out. In the UK, we have Cyber Essentials and the plus form. Non UK Europe also has similar standards. The US will have Freedom versions of any standards and the rest of the world will have theirs. Go in with standards if you can. As soon as you permanently switch off a security mechanism you have failed (yourself and your customer). Good luck mate.
- johanneskanybal 1y agoRight tool for the job. Linux for deploying stuff to, Linux or mac for working on the stuff you’ll deploy. Windows for games and everyday use. They’re all superior in their category and it’s too obvious to spend time arguing about.
- cynicalsecurity 1y agoYou don't need Windows for games since ages. Steam games run on Linux.
- johanneskanybal 1y agoNot really if you ever tried. Barely playing music, games obviously don’t work if you ever tried playing games. (hint, game x not beeing terrible doesen’t mean ”it works”). like I said at the start this is fairly obvious.
- udev4096 1y agoI play AAA games on steam deck running stock steam OS. It's rock solid. Look at the sales of steam deck alone, it's quite successful
- ekianjo 1y agoYou can game on Linux for many years now. Windows is mostly mandatory if you play multiplayer games with anticheat
- johanneskanybal 1y agoyea pong working on linux doesen’t equal to gaming working on linux. Most games won’t start or play worse.
- 8note 1y agoive been playing elden ring fantastically on the steam deck. its the game of the year from a couple years back
- charcircuit 1y agoLinux ransomware does not require root.
- cortesoft 1y agoThere are many reasons someone might have to use Windows. I have a Windows box because a number of games I play don’t support Linux, even with WINE and Proton.
- KronisLV 1y agoI found that ProtonDB is quite helpful in figuring out how many games will or won’t run well: https://www.protondb.com/ https://www.protondb.com/ You can even log in with Steam and get the summary for your exact library, for anyone curious.
- NexRebular 1y ago> Or you know... just use Linux ...where namespaces provide excellent technology for hiding malware making linux one of the best platforms to turn into a evil host.
- codedokode 1y agoDo they? Processes inside a namespace still are visible from the top level namespace.
- supertrope 1y agoMake sure to never do curl example.com/easyscript.sh | sudo bash
- noisem4ker 1y agoIt sounds like you just described what User Account Control (UAC) has been doing since Windows Vista (2006).
- EvanAnderson 1y agoThere are UAC bypasses. Microsoft has repeatedly stated that UAC isn't actually a security boundary. It's better to run a daily driver account as a limited user and only elevate when you overtly need it. (It's even better to use a separate login, as opposed to "Run As...)
- Lwerewolf 1y agoAren't most UAC bypasses relying on the fact that UAC by default isn't "full sudo"mode - i.e. it allows certain things without prompting?
- Melatonic 1y agoExactly - UAC is like a poor man's Sudo and I never really got the point of it. There is a reason so many people tried to disable it. Daily driver as limited user should be the windows default even if it makes use ability more confusing.
- deleted 1y ago[deleted]
- EvanAnderson 1y ago> The best anti malware on any version of windows has always been to make your default account you use everyday a non admin account. In the early 2000s up thru about 2012 I'd agree with you. Post-Vista malware adapted to UAC and now all malware works well as a normal user. Any data your normal user can access (local or on a remote CIFS server) is fair game for ransomware. Limiting administrator rights doesn't do anything to prevent the malware from getting at your data. Persistence has moved to per-user, non-Administrator, too. Of course, all the various quasi-malicious customized versions of Chrome that end users inevitably install when they go searching for software to end-run their IT departments operates the same way. I do think your daily driver Windows users shouldn't have administrator rights. It just isn't going to help much with malware. I use physically separate boxes for my most sensitive activities (banking, mainly) but you could do nearly as well having separate non-admin Windows logons and compartmentalize your access to data you don't want ransomed. Isolation between different user accounts on Windows is actually fairly good. Just limit the common data the accounts can access. Personally I've always wanted to use Qubes (and stop using physically separate machines) but I haven't taken them time to learn their contrivances. Edit: I should have said "quasi-malicious customized versions of Chromium", not Chrome.
- pogue 1y agoWhat are these "quasi-malicious customized versions of Chrome" you're referring to?
- dfedbeef 1y agoEdge? (joking)
- Melatonic 1y agoConfused by that as well - what version of chrome can be installed without admin?
- EvanAnderson 1y agoIt cannot. There are malicious third parties who have made distributions of Chromium that are fully functional browsers, installing in the user's AppData folder w/o Administrator rights, that have additional "functionality" like exfiltrating browsing history or displaying extra t This is really what any Electron-based app is. It's just Chromium running out of the AppData folder. There's a whole ecosystem of "shadow IT" software that installs out of the AppData folder, meant to end-run IT and central control, that functions great w/o Administrator rights.
- Aachen 1y agohttps://xkcd.com/1200/ https://xkcd.com/1200/ It feels bad to post a link-only response but I really don't have anything to add to it. On a system used by multiple persons, sure, you help prevent that a compromise on sister's account immediately impacts mom's and dad's accounts, but that qualification isn't in the comment and probably most computers that HN readers use are single user. Or on a server, dropping privileges speaks for itself. But if you're on a desktop and you do online banking in your browser and also open email attachments on that computer... Not being admin would only help clean up the situation without needing to make a live boot (namely, you could theoretically trust the admin user and switch to that) but this isn't recommended practice anyway if you're not a malware specialist and can make sure it is fully gone. I cannot think of any situation where a single user desktop system benefits from admin privilege separation So basically, what the comic conveys > The best anti malware Not being admin doesn't prevent malware from running and gaining persistence within your user account...
- seb1204 1y agoSo the mum or grandpa should also use an admin account to execute the file they just downloaded?
- Aachen 1y agoThey need this access to be able to use their computer, but even if they don't manage their own computer... maybe read the above comment and then let me know what I've overlooked rather than me repeating the whole thing
- Melatonic 1y agoMost malware I've commonly seen on individuals computers (like the grandma example) comes about when they want to install something and use and installer that has it bundled with legit software. Or they visit a site that's a shady copy of a legit one.
- zahlman 1y ago> If an admin elevation popup happens when you haven't triggered it then you probably know something is wrong. And most malware will not be able to install. Malware can still do a lot without "installation". Running as an unprivileged user, it can still do anything to/with the filesystem that the user would be able to do, and will (on most normal setups) be able to make outbound Internet connections without limitation. In short, these kinds of privileges don't protect against data exfiltration, ransomware operating on the user's important data files, simple vandalism....
- Melatonic 1y agoThis is true but defense is a multi layered approach and even the built in Microsoft stuff (like Defender AV) have massively improved. I would argue most malware comes down to uneducated users doing the wrong thing - but that's a whole different can of worms :-)
- cube00 1y ago> I would argue most malware comes down to uneducated users doing the wrong thing This feels unnecessarily harsh. Those users are the victims of criminal activity. The protective controls could be a lot better. Windows doesn't offer immutable local file versions to protect against ransomware running as a non-privileged user. It doesn't offer any protection if a single application suddenly starts to overwrite huge amounts of data. Instead they choose to try and shove OneDrive down our throats as the only answer to ransomware protection.
- ropable 1y agoAs someone working in infosec for a largish 2000 seat organisation - it's honestly not inaccurate. No matter how much accessible information security training we try to provide and the EDR controls we implement, >95% of our incidents involve an end-user following (sometimes extremely obvious) phishing links. And contrary to what you've said, Windows Defender (in conjunction with Airlock) has actually saved us from ransomware attacks.
- exiguus 1y agoUsually, private individuals are not the target of ransomware attacks by organized criminals. Companies often have to pay a lot more money to get their data back. The Petya ransomware is a good example of this. Nevertheless, when you are on any machine as an intruder and have normal user rights, you can still actively search the machine and network for admin accounts and steal sessions. The ultimate goal is to gain Domain Admin rights. Besides that, it is not necessary to have admin rights to delete and encrypt data or to run and hide software. There are also many ways, besides stealing sessions, to gain admin rights, such as through unpatched software, inappropriate user rights, zero-day exploits, and social engineering. A common way to get users to install malware or ransomware is to bundle it with useful software that the user wants to install.
- eestrada 1y agoThe best anti malware on any version of windows has always been to not run windows.
- fortran77 1y agoWe're all very impressed that you're such a 1337 h4x0r that you run Arch Linux and not Windo$e. See also https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-samples-suggest-a-threat-actor-sharpening-its-tools/ https://www.sentinelone.com/blog/macos-notlockbit-evolving-r... and https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emerging-threat/ https://blog.sekoia.io/helldown-ransomware-an-overview-of-th...
- akimbostrawman 1y agoI don't see how those links are relevant. Nobody claimed there is no malware on linux. However the feature and culture of software distribution very much makes it safer. The overwhelming majority of malware gets distributed over ads from websites or search results. Package manager prominently used by all linux distros remove that attack vector or at the very least minimize it. Ofc it does not prevent somebody from still executing random binaries from the internet if they really want to, nothing does.
- udev4096 1y agoI wouldn't be surprised if attackers started leveraging Wine for not going through the hassle of cross-compiling for different operating systems
- kevingadd 1y agoUnfortunately a lot of modern software triggers UAC popups now. Games (for anticheat and/or network connectivity), development tools (for network connectivity or debugging), updaters for stuff that live-updates like Electron apps, etc.
- cookiengineer 1y agoThis is good advice, but it will not protect you against any malware that has been written in the last 10 years. Stealer frameworks and dropper frameworks have implemented a lot of bypasses. From using other installed programs (lolbins / gtfobins etc) to using embedded scripting engines to do their bidding up until just reusing signed and installed default drivers to execute their payloads. A lot of drivers have sideloading and execution capabilities due to how the $igning process in Microsoft is constructed. Additionally, nobody needs "root" access to do anything these days, this is just plain wrong assumption. Most malware will go for your browser profiles which are readable by your user (duh), so a separate privilege escalation exploit avoiding user account won't help you there either. It's much better to sandbox your applications as good as possible. Even just using firejail profiles will go a long way, especially in regards to electron apps or apps that have remote update and plugin installation capabilities (e.g. discord, slack and the like). Please, drop some malware binaries through ghidra or other tools before you give advice like this. You might be part of survivor's bias without realizing it.
- udev4096 1y agoLPEs exist. In linux world, you get tons of new LPEs every week. On windows, significantly harder
- smallstepforman 1y agoIts easy to reinstall the OS. Its a lot more damaging if you lose your childs birthday photos, tax documents and anything you actually care about. This is where the entire PC security fiasco breaks down, since I want my docs directory protected FROM any system installed app/driver. I want an OS that asks for permission when accessing doc directory.