Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Classic Shell hacked with compromised update that erases your partition table

classicshell.net

Post reply on HN
Print view View original

41–50 of 110 posts

Re: Classic Shell hacked with compromised update that erases your partition table

#41

Post by ianlevesque »

ayuvar wrote: post #36
AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

Signing the installer would help detect tampering, except it seems like in this case the compromised installer was not signed and the usual one is. Nothing really stops you from unpacking all of the contents of the first installer, and repacking it with your payload into an unsigned installer which is likely what happened here.

In theory that's what Windows SmartScreen is there to prevent.

Re: Classic Shell hacked with compromised update that erases your partition table

#42

Post by ultramancool »

warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

Someone have a copy of the infected version? I'd like to take a look.

Re: Classic Shell hacked with compromised update that erases your partition table

#43

Post by nexxer »

DougN7 wrote: post #39
AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).

Per the developer at that forum thread:

"To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature."

And per another user (silmar), my sentiments:

"The problem with signed installers is: many software developers don't sign, so you install even if Windows warns you. Even if someone signs and then stops signing, it may be that he forgot about it. But you want to install NOW, so you skip the warning."

Admittedly the download page doesn't mention signing or how to look for that, though, per the comment I referenced above, I doubt it would make much difference to the vast majority of users.

Re: Classic Shell hacked with compromised update that erases your partition table

#44

Post by fencepost »

zamalek wrote: post #5
fletchowns wrote: post #2

Related thread on reddit: https://www.reddit.com/r/pcmasterrace/comments/4vw21h/massiv...

The fix: http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&... Close one for me: I was downloading WinDirStat when I came across that post.

Semi-unrelated: WinDirStat is amazing, but you might also look at WizTree for speed - it does its space analysis based just on reading the MFT, so it's quite fast.

Re: Classic Shell hacked with compromised update that erases your partition table

#45

Post by Someone1234 »

DougN7 wrote: post #39
AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).

Just to be clear, the original Classic Shell installer is signed. I agree they could make the point of having people check that.

Re: Classic Shell hacked with compromised update that erases your partition table

#46

Post by Grom_PE »

beefhash wrote: post #35
warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic. [1] https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities [2] https://sites.google.com/site/itstheshappening/

MD5 is broken in a sense that you can craft two different files with the same hash, but it's still hard to create a file with specific MD5 hash.

So it's still good for identifying files that aren't specifically crafted to have a malicious counterpart.

Re: Classic Shell hacked with compromised update that erases your partition table

#47

Post by fencepost »

Forge36 wrote: post #15

I hope the auto update wasn't affected. I just did this at work, no big warning screen. Now I'm paranoid to reboot.. Update: Looks like I wasn't affected. There was an official update (4.3.0) which was released on the 30th leading to unfortunate timing.

The thread on Classic Shell specifically notes that the auto update pulls from a different source that was not affected.

Re: Classic Shell hacked with compromised update that erases your partition table

#48

Post by PeanutNore »

I must have gotten very lucky, because I downloaded and installed installed Classic Shell on a fresh Windows 10 install yesterday afternoon and was not affected - the installer bore the right signature and my system is intact and boots fine. If I had tried a few hours later, I would probably be reinstalling Windows 10 for the second time in 2 days.

Re: Classic Shell hacked with compromised update that erases your partition table

#49

Post by Someone1234 »

ianlevesque wrote: post #41
ayuvar wrote: post #36

Earlier quoted context omitted.

Signing the installer would help detect tampering, except it seems like in this case the compromised installer was not signed and the usual one is. Nothing really stops you from unpacking all of the contents of the first installer, and repacking it with your payload into an unsigned installer which is likely what happened here.

In theory that's what Windows SmartScreen is there to prevent.

Unfortunately every single one of those terrible "stop Windows 10 spying on you!!!" guides tells people to turn off SmartScreen along with UAC/Windows Firewall/Windows Defender.

Or worse tells them to download an unknown program which turns off a bunch of security features at a single click without an explanation of the cost. But at least the user feels less spied upon or something...

Re: Classic Shell hacked with compromised update that erases your partition table

#50

Post by [deleted] »

warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

[deleted]
Post reply on HN