12 ms·

The problem is much worse than this contrived 'I cant download PuTTY securely'. Lets choose an example, of which I have had my hands in with my tech support job

by kefka 13y ago

The problem is much worse than this contrived 'I cant download PuTTY securely'. Lets choose an example, of which I have had my hands in with my tech support job. * Goal: "Download Firefox" First, the user was using IE. And the user is not a tech savvy user (as in, cannot read words on the screen). Turns out, the user's computer was infested with spyware and garbageware. Mainly Conduit and others. Evidently, user "searched" for firefox rather than follow my directions to type in the address bar https://www.mozilla.org https://www.mozilla.org . This behavior lead him here: http://firefox.en.softonic.com/ http://firefox.en.softonic.com/ Normally, I would use a remote support tool and just do the cleaning for the user. However, this client comes from another area in which we are not allowed to use the remote support tool. In the end, I tried to have user uninstall the bad-firefox, and attempt to install the good, but the softonic installer installs a ton of crap everywhere. User got very frustrated and hung up when having him read the uninstall programs installed list. * That is the danger to most users, running Windows. EDIT: For the user whom penalized my comment score, why?

xonev 13y ago
I don't believe the original example was contrived. It sounded like a real series of steps that this guy went through. But you're right, it's even worse if you don't have any idea what you're doing.
raverbashing 13y ago
Exactly Dealing with Windows nowadays is akin to cleaning a septic tank. I wish I was kidding I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Working directly on Windows is impossible
- chops 13y ago
  Trinity Resource Kit: http://trinityhome.org/Home/index.php?wpid=1&front_id=12 http://trinityhome.org/Home/index.php?wpid=1&front_id=12 Among other things, it boots a live linux CD that's packaged with a handful of 3-5 antivirus scanners.
- zokier 13y ago
  > I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Working directly on Windows is impossible I don't think that would be all that useful. If you have a malware-infected system then your focus should be rescuing user data, and not cleaning the infection (which is pretty much impossible to do reliably).
  - pixl97 13y ago
    > your focus should be rescuing user data Good luck figuring out if the user data is the cause of further infections. Add some infected pdf, tif, jpg files and it could come right back. In the terms of less common applications there are likely thousands of libraries used by these programs with data interpretation exploits waiting to be be found.
- ctrijueque 13y ago
  >I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Kaspersky did it. http://support.kaspersky.com/viruses/rescuedisk http://support.kaspersky.com/viruses/rescuedisk
  - blueblob 13y ago
    Also bitdefender: http://download.bitdefender.com/rescue_cd/2013/ http://download.bitdefender.com/rescue_cd/2013/ and AVG: http://www.avg.com/us-en/download.prd-arl http://www.avg.com/us-en/download.prd-arl although I am not sure if they are linux based.
    - jethro_tell 13y ago
      They are. I've used the kaspersky and AGV live disks. It's nice because you boot up and you can download new definitions without something hogging your bandwidth and clicking through a bunch of popups or what ever.
  - codfrantic 13y ago
    Also Sophos http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx http://www.sophos.com/en-us/products/free-tools/virus-remova...
- eli 13y ago
  Only because that's traditionally where the users have been. If everybody switched to desktop linux, the malware would target linux instead.
  - nitrogen 13y ago
    Linux doesn't have a tradition of downloading and installing random software, though, so there would be a bigger behavioral hurdle to get users to install the malware.
    - eli 13y ago
      I think the behavioral differences are almost entirely because current Linux userbase is mostly people who have self-selected Linux over the default OS their laptop came with. (And I still see a fair number of Linux install scripts that look like "curl ... | sh")
      - marcosdumay 13y ago
        Linux has a nice repository, with nearly all the software you need available, signed with known good keys. Linux does not have "your mouse pointer moved. Are you sure you want to proceed?" dialogs. Linux has a manageable set of file permissions, including the "execute" permission being set by the users, not by any random server from where you download your file. (Yep, there was some regression here lately.) And, of course, Linux is actually hard to compromise without user intervention. Differently from Windows. If you really believe it's the users fault, you have your head deep buried on the sand.
        letstryagain 13y ago
        No you
      - josephlord 13y ago
        No it can be worse than that the install instructions say: `curl http://example.com/foo/install.sh | sudo sh` or if it does request the script by https there is a fair chance that the install script itself will then download by http. Equally bad is adding a new key to apt/(other package manager) and add a new source then apt-get install (which definitely runs as root).
- mercurial 13y ago
  My day-to-day dealing with Windows being very limited, I find this interesting. Is it your impression that the security features introduced since Vista have been ineffective and only taught naive users to always click the "yes" button?
  - kefka 13y ago
    My experience in a tier 1 tech support job is: 1. The user clicks yes. They might read what they clicked yes to. 2. The user doesn't usually read prompts 3. The user will not read error messages, even if they are to their benefit. 4. The user doesn't know how to "google" problems 5. The user will sometimes even ignore IT professional help even when they call us. This is usually a "bitch session" with no clear resolution. 6. You will tell the user what to do, and they will also say yes. They still don't understand. 7. Users will install software and not understand how to remove said software (control panel<remove software). 8. Users are not curious. What would be obvious to simple reading they will ignore. 9. Only when the computing environment is unbearable, will they call in. Or it will be the simpleton user who wants you to do their work for them.
- lstamour 13y ago
  I was going to suggest Chocolate -- it's like Homebrew for PowerShell, but it doesn't always install things where you want it to. And as it turns out, PuTTY might not be maintained as much as it once was -- or that's the rumour. I was shocked by how many forks of PuTTY there are -- and most suck: https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-PuTTY https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-Pu... Many recommend KiTTY but with an ad supported site that complains about adblock when you go SSL (after a warning) and includes hidden features -- well, that's not something I'd trust either.
- agumonkey 13y ago
  Windows is such an open door (NPI) its incredible. Stupidly trivial malware can rewrite desktop icon shortcuts to append some url so the browser will start on it. I spent hours trying to help a neighbor before stumbling on this 'hack'.
- lazylizard 13y ago
  i'm only familiar with f-secure but imagine any av vendor would have something like this(but yea, what if system files were infected?)? https://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142 https://www.f-secure.com/en/web/labs_global/removal-tools/-/...
corresation 13y ago
EDIT: For the user whom penalized my comment score, why? Probably because you claimed that the example was contrived when it is actually very real, and is something many visitors to HN have specifically faced, and is a particularly ironic case given that the target software is critical security software, given essentially the keys to the lands. Ultimately many of us simply have to assume that Google's pagerank is the surest sign of the credibility of a link, but of course we know that can be gamed. And even had this site been on an appropriate domain with HTTPS, even that shows little given the completely lack of vigilance by most SSL cert firms now (partly at the behest of the tech community who find the cert process annoying and expensive).
- kefka 13y ago
  I have a few arguments about the way the article took his/her argument down. 1. There was no mention of http://putty.en.softonic.com/ 2. If you are looking for an SSH client, you are not a normal user and should know that CYGWin or Putty are freely available. 3. Using whois is considered more advanced end-user techniques. 4. Continual complaints that the download server doesn't have SSL. It's annoying and bad. Trying it again and again is kind of pointless. You made your point. 5. Tries to get the author's key via the MIT PGP server. This is NOT end-user stuff here.
  - __david__ 13y ago
    > This is NOT end-user stuff here. Did he claim it was? How is that relevant?
  - corresation 13y ago
    You seem to be arguing that the article wasn't an entirely different article. As __david__ rightly mentioned, he doesn't say "this is what the average person encounters". Indeed, I think the situation is even more profound given that it is, quite specifically, talking about security software that fairly adept practitioners use.
  - psykovsky 13y ago
    That was exactly his point, I guess. If an advanced user strugles like this to securely download some piece of software imagine a regular end-user.
anon1385 13y ago
If you are wondering why searching for "firefox" leads people to install malware the main reason is that most of the ads Google shows for that term, and which appear at the very top of the results, take you to sites with malware downloads. I've mentioned it a few times on here before[1], even directly to Google employees[2] and they don't seem to give a shit at all. I've even noticed searches for Chrome sometimes show links to (what appear to be) malware sites now[3]. Maybe that will motivate them to sort this out but I'm not hopeful. Putting my conspiracy hat on; it seems like there isn't much motivation for Google to sort out the problem because every new malware loaded PC is another potential convert to a locked down cloud based platform like ChromeOS. There isn't really much downside for them in making Windows as horrendously unsafe for non-experts to use as possible. Why Mozilla aren't screaming about it constantly is more of a mystery to me. [1] https://news.ycombinator.com/item?id=7101939 https://news.ycombinator.com/item?id=7101939 [2] https://news.ycombinator.com/item?id=7089727 https://news.ycombinator.com/item?id=7089727 [3] http://i.imgur.com/yVIMYKO.png http://i.imgur.com/yVIMYKO.png
- elliotz 13y ago
  I wonder why Mozilla doesn't go after these sites for trademark infringement. Mozilla made Debian change the name of their Firefox package to Iceweasel because they made modifications; surely bundling in adware also violates Mozilla's trademark policy?
  - RyanZAG 13y ago
    It does. Google goes after them as well. However, there is generally a large delay before they manage to take them down and verification is always done post-display and not pre-display. You can report bad adverts at https://support.google.com/adwords/contact/feedback?hl=en https://support.google.com/adwords/contact/feedback?hl=en and Google will eventually get to them, usually after their account balances have run down a bit. There's definitely no sign of any urgency on that front.
  - gcp 13y ago
    It turns out Debian is much more responsive to Mozilla requests than adware providers, and going through court takes a long time.
codebeard 13y ago
I hate to be _that_ guy, but for someone who values the opinion of others as you apparently, do, using 'whom' on the internet isn't likely to win you over any friends. Let alone using it incorrectly...
- oskarth 13y ago
  No you don't. If you do, just don't be that guy :)
  - codebeard 13y ago
    Eh, fair enough. He just struck three nerves on a Monday morning. 1. proselytism 2. grammatical solecism 3. inflating the value of a "downvote" In hindsight, I should have kept my mouth shut. But hit those three before my caffeine deficiency has been addressed, and I'll likely find myself in _that_ role.
    - dfc 13y ago
      > 2. grammatical solecism Is there any other kind? I will admit the whom-bomb was unpleasant. OP: If the answer is not him/her the question is probably not "whom."
fulafel 13y ago
> Turns out, the user's computer was infested with spyware and garbageware You're recovering from a system compromise, an unrelated problem from downloading Firefox. Hints to get started: unplug net, image the HD for later forensics, reformat & reinstall OS, carefully restore non-executable data files from backup.
- stuaxo 13y ago
  The user would get a blank look in their eyes if you told them that !
- kefka 13y ago
  Like I said, we are a tier 1 tech support. What I do is work for a university. We also do tech support for another university (contacted out to us), and that other university is a 2 year trade school in Indiana. Our service is mainly troubleshooting simple and mild problems, and escalating difficult issues to the relevant departments. A problem like spyware is a constant in our job, causing problems ranging from system instability to mal-rendering web pages. Ideally, a backup/wipe/reinstall is the idea solution here, BUT these are regular non-tech-savy users. The computer is a means to an end here. "It goes beep-blip-boop that my teacher wants" is the kind of thought. Explaining that a reinstall is ideal is ignoring the fact that this operation would cost ~200$ at Best Buy or similar place. Frankly, I use what tools I can. If that means manually uninstalling what I know is spyware, rebooting in safe mode and running Malware Bytes, I'll do exactly that. At least it triages the problem until next week when the user goes and downloads something Adfly or Softonic... again.
nayades 13y ago
save yourself some potential issues and use getfirefox.com
- kefka 13y ago
  Unfortunately, they would just search that as well. And if the machine is already infested, it's a conduit search at that. The problem is Windows. IE is too easy to hack and break. Drive-by exploits are routine with IE and Windows-Firefox. There is little security and process limitation in Windows to prevent an active expoit. Worse yet, I cant even delete an "open file" without special tools. In any other OS, that's not a problem. File gets removed. Windows acts like a toddler. BTW, Xubuntu works well here for friends and family whom I support. It just works, they're nigh invulnerable to exploits and problems are a kill and rm away.
Consultant32452 13y ago
This is somewhat mitigated with the Android Play store and the iTunes app store. I haven't used the Win8 store thing yet, but it should resolve these issues for most users. That's why even though I prefer an open ecosystem for my own devices I do appreciate the need for semi-closed ecosystems for non tech savvy users.

by kefka 13y ago

xonev 13y ago

I don't believe the original example was contrived. It sounded like a real series of steps that this guy went through. But you're right, it's even worse if you don't have any idea what you're doing.

raverbashing 13y ago

Exactly Dealing with Windows nowadays is akin to cleaning a septic tank. I wish I was kidding I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Working directly on Windows is impossible

chops 13y ago
Trinity Resource Kit: http://trinityhome.org/Home/index.php?wpid=1&front_id=12 http://trinityhome.org/Home/index.php?wpid=1&front_id=12 Among other things, it boots a live linux CD that's packaged with a handful of 3-5 antivirus scanners.
zokier 13y ago
> I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Working directly on Windows is impossible I don't think that would be all that useful. If you have a malware-infected system then your focus should be rescuing user data, and not cleaning the infection (which is pretty much impossible to do reliably).
- pixl97 13y ago
  > your focus should be rescuing user data Good luck figuring out if the user data is the cause of further infections. Add some infected pdf, tif, jpg files and it could come right back. In the terms of less common applications there are likely thousands of libraries used by these programs with data interpretation exploits waiting to be be found.
ctrijueque 13y ago
>I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Kaspersky did it. http://support.kaspersky.com/viruses/rescuedisk http://support.kaspersky.com/viruses/rescuedisk
- blueblob 13y ago
  Also bitdefender: http://download.bitdefender.com/rescue_cd/2013/ http://download.bitdefender.com/rescue_cd/2013/ and AVG: http://www.avg.com/us-en/download.prd-arl http://www.avg.com/us-en/download.prd-arl although I am not sure if they are linux based.
  - jethro_tell 13y ago
    They are. I've used the kaspersky and AGV live disks. It's nice because you boot up and you can download new definitions without something hogging your bandwidth and clicking through a bunch of popups or what ever.
- codfrantic 13y ago
  Also Sophos http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx http://www.sophos.com/en-us/products/free-tools/virus-remova...
eli 13y ago
Only because that's traditionally where the users have been. If everybody switched to desktop linux, the malware would target linux instead.
- nitrogen 13y ago
  Linux doesn't have a tradition of downloading and installing random software, though, so there would be a bigger behavioral hurdle to get users to install the malware.
  - eli 13y ago
    I think the behavioral differences are almost entirely because current Linux userbase is mostly people who have self-selected Linux over the default OS their laptop came with. (And I still see a fair number of Linux install scripts that look like "curl ... | sh")
    - marcosdumay 13y ago
      Linux has a nice repository, with nearly all the software you need available, signed with known good keys. Linux does not have "your mouse pointer moved. Are you sure you want to proceed?" dialogs. Linux has a manageable set of file permissions, including the "execute" permission being set by the users, not by any random server from where you download your file. (Yep, there was some regression here lately.) And, of course, Linux is actually hard to compromise without user intervention. Differently from Windows. If you really believe it's the users fault, you have your head deep buried on the sand.
      - letstryagain 13y ago
        No you
    - josephlord 13y ago
      No it can be worse than that the install instructions say: `curl http://example.com/foo/install.sh | sudo sh` or if it does request the script by https there is a fair chance that the install script itself will then download by http. Equally bad is adding a new key to apt/(other package manager) and add a new source then apt-get install (which definitely runs as root).
mercurial 13y ago
My day-to-day dealing with Windows being very limited, I find this interesting. Is it your impression that the security features introduced since Vista have been ineffective and only taught naive users to always click the "yes" button?
- kefka 13y ago
  My experience in a tier 1 tech support job is: 1. The user clicks yes. They might read what they clicked yes to. 2. The user doesn't usually read prompts 3. The user will not read error messages, even if they are to their benefit. 4. The user doesn't know how to "google" problems 5. The user will sometimes even ignore IT professional help even when they call us. This is usually a "bitch session" with no clear resolution. 6. You will tell the user what to do, and they will also say yes. They still don't understand. 7. Users will install software and not understand how to remove said software (control panel<remove software). 8. Users are not curious. What would be obvious to simple reading they will ignore. 9. Only when the computing environment is unbearable, will they call in. Or it will be the simpleton user who wants you to do their work for them.
lstamour 13y ago
I was going to suggest Chocolate -- it's like Homebrew for PowerShell, but it doesn't always install things where you want it to. And as it turns out, PuTTY might not be maintained as much as it once was -- or that's the rumour. I was shocked by how many forks of PuTTY there are -- and most suck: https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-PuTTY https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-Pu... Many recommend KiTTY but with an ad supported site that complains about adblock when you go SSL (after a warning) and includes hidden features -- well, that's not something I'd trust either.
agumonkey 13y ago
Windows is such an open door (NPI) its incredible. Stupidly trivial malware can rewrite desktop icon shortcuts to append some url so the browser will start on it. I spent hours trying to help a neighbor before stumbling on this 'hack'.
lazylizard 13y ago
i'm only familiar with f-secure but imagine any av vendor would have something like this(but yea, what if system files were infected?)? https://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142 https://www.f-secure.com/en/web/labs_global/removal-tools/-/...

corresation 13y ago

EDIT: For the user whom penalized my comment score, why? Probably because you claimed that the example was contrived when it is actually very real, and is something many visitors to HN have specifically faced, and is a particularly ironic case given that the target software is critical security software, given essentially the keys to the lands. Ultimately many of us simply have to assume that Google's pagerank is the surest sign of the credibility of a link, but of course we know that can be gamed. And even had this site been on an appropriate domain with HTTPS, even that shows little given the completely lack of vigilance by most SSL cert firms now (partly at the behest of the tech community who find the cert process annoying and expensive).

kefka 13y ago
I have a few arguments about the way the article took his/her argument down. 1. There was no mention of http://putty.en.softonic.com/ 2. If you are looking for an SSH client, you are not a normal user and should know that CYGWin or Putty are freely available. 3. Using whois is considered more advanced end-user techniques. 4. Continual complaints that the download server doesn't have SSL. It's annoying and bad. Trying it again and again is kind of pointless. You made your point. 5. Tries to get the author's key via the MIT PGP server. This is NOT end-user stuff here.
- __david__ 13y ago
  > This is NOT end-user stuff here. Did he claim it was? How is that relevant?
- corresation 13y ago
  You seem to be arguing that the article wasn't an entirely different article. As __david__ rightly mentioned, he doesn't say "this is what the average person encounters". Indeed, I think the situation is even more profound given that it is, quite specifically, talking about security software that fairly adept practitioners use.
- psykovsky 13y ago
  That was exactly his point, I guess. If an advanced user strugles like this to securely download some piece of software imagine a regular end-user.

anon1385 13y ago

If you are wondering why searching for "firefox" leads people to install malware the main reason is that most of the ads Google shows for that term, and which appear at the very top of the results, take you to sites with malware downloads. I've mentioned it a few times on here before[1], even directly to Google employees[2] and they don't seem to give a shit at all. I've even noticed searches for Chrome sometimes show links to (what appear to be) malware sites now[3]. Maybe that will motivate them to sort this out but I'm not hopeful. Putting my conspiracy hat on; it seems like there isn't much motivation for Google to sort out the problem because every new malware loaded PC is another potential convert to a locked down cloud based platform like ChromeOS. There isn't really much downside for them in making Windows as horrendously unsafe for non-experts to use as possible. Why Mozilla aren't screaming about it constantly is more of a mystery to me. [1] https://news.ycombinator.com/item?id=7101939 https://news.ycombinator.com/item?id=7101939 [2] https://news.ycombinator.com/item?id=7089727 https://news.ycombinator.com/item?id=7089727 [3] http://i.imgur.com/yVIMYKO.png http://i.imgur.com/yVIMYKO.png

elliotz 13y ago
I wonder why Mozilla doesn't go after these sites for trademark infringement. Mozilla made Debian change the name of their Firefox package to Iceweasel because they made modifications; surely bundling in adware also violates Mozilla's trademark policy?
- RyanZAG 13y ago
  It does. Google goes after them as well. However, there is generally a large delay before they manage to take them down and verification is always done post-display and not pre-display. You can report bad adverts at https://support.google.com/adwords/contact/feedback?hl=en https://support.google.com/adwords/contact/feedback?hl=en and Google will eventually get to them, usually after their account balances have run down a bit. There's definitely no sign of any urgency on that front.
- gcp 13y ago
  It turns out Debian is much more responsive to Mozilla requests than adware providers, and going through court takes a long time.

codebeard 13y ago

I hate to be _that_ guy, but for someone who values the opinion of others as you apparently, do, using 'whom' on the internet isn't likely to win you over any friends. Let alone using it incorrectly...

oskarth 13y ago
No you don't. If you do, just don't be that guy :)
- codebeard 13y ago
  Eh, fair enough. He just struck three nerves on a Monday morning. 1. proselytism 2. grammatical solecism 3. inflating the value of a "downvote" In hindsight, I should have kept my mouth shut. But hit those three before my caffeine deficiency has been addressed, and I'll likely find myself in _that_ role.
  - dfc 13y ago
    > 2. grammatical solecism Is there any other kind? I will admit the whom-bomb was unpleasant. OP: If the answer is not him/her the question is probably not "whom."

fulafel 13y ago

> Turns out, the user's computer was infested with spyware and garbageware You're recovering from a system compromise, an unrelated problem from downloading Firefox. Hints to get started: unplug net, image the HD for later forensics, reformat & reinstall OS, carefully restore non-executable data files from backup.

stuaxo 13y ago
The user would get a blank look in their eyes if you told them that !
kefka 13y ago
Like I said, we are a tier 1 tech support. What I do is work for a university. We also do tech support for another university (contacted out to us), and that other university is a 2 year trade school in Indiana. Our service is mainly troubleshooting simple and mild problems, and escalating difficult issues to the relevant departments. A problem like spyware is a constant in our job, causing problems ranging from system instability to mal-rendering web pages. Ideally, a backup/wipe/reinstall is the idea solution here, BUT these are regular non-tech-savy users. The computer is a means to an end here. "It goes beep-blip-boop that my teacher wants" is the kind of thought. Explaining that a reinstall is ideal is ignoring the fact that this operation would cost ~200$ at Best Buy or similar place. Frankly, I use what tools I can. If that means manually uninstalling what I know is spyware, rebooting in safe mode and running Malware Bytes, I'll do exactly that. At least it triages the problem until next week when the user goes and downloads something Adfly or Softonic... again.

nayades 13y ago

save yourself some potential issues and use getfirefox.com

kefka 13y ago
Unfortunately, they would just search that as well. And if the machine is already infested, it's a conduit search at that. The problem is Windows. IE is too easy to hack and break. Drive-by exploits are routine with IE and Windows-Firefox. There is little security and process limitation in Windows to prevent an active expoit. Worse yet, I cant even delete an "open file" without special tools. In any other OS, that's not a problem. File gets removed. Windows acts like a toddler. BTW, Xubuntu works well here for friends and family whom I support. It just works, they're nigh invulnerable to exploits and problems are a kill and rm away.

Consultant32452 13y ago

This is somewhat mitigated with the Android Play store and the iTunes app store. I haven't used the Win8 store thing yet, but it should resolve these issues for most users. That's why even though I prefer an open ecosystem for my own devices I do appreciate the need for semi-closed ecosystems for non tech savvy users.