Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
Classic Shell hacked with compromised update that erases your partition table
11–20 of 110 posts
Re: Classic Shell hacked with compromised update that erases your partition table
#12Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
From their Twitter page
Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.
Re: Classic Shell hacked with compromised update that erases your partition table
#13Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
or ramsomware!
Re: Classic Shell hacked with compromised update that erases your partition table
#14A youtuber who usually does videos of classic DOS viruses made a video of this one in action.
Re: Classic Shell hacked with compromised update that erases your partition table
#15I hope the auto update wasn't affected. I just did this at work, no big warning screen. Now I'm paranoid to reboot..
Update: Looks like I wasn't affected. There was an official update (4.3.0) which was released on the 30th leading to unfortunate timing.
Re: Classic Shell hacked with compromised update that erases your partition table
#16Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
Re: Classic Shell hacked with compromised update that erases your partition table
#17It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.
It looks like they have a dump of the Fosshub user database.
Audacity was also affected: http://www.audacityteam.org/hacked-download/
Re: Classic Shell hacked with compromised update that erases your partition table
#18Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.
Unless SmartScreen complains, the order of dialogs and buttons on those dialogs is exactly the same for both signed and unsigned programs. They only differ in content/design elements. That's not what I'd call prominent.
There's nothing like HSTS for signed programs, so it can't be helped, though.
Re: Classic Shell hacked with compromised update that erases your partition table
#19It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.
It looks like they have a dump of the Fosshub user database. Audacity was also affected: http://www.audacityteam.org/hacked-download/
Damn. You have no idea how close I was to reinstalling Audacity last night.
Re: Classic Shell hacked with compromised update that erases your partition table
#20Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.
I get warnings every time I try to run something I downloaded, so I've just tuned them out. Unless this one was somehow completely different from those, I wouldn't have given it a second thought.