Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Classic Shell hacked with compromised update that erases your partition table

classicshell.net

Post reply on HN
Print view View original

51–60 of 110 posts

Re: Classic Shell hacked with compromised update that erases your partition table

#51

Post by kalleboo »

beefhash wrote: post #35
warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic. [1] https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities [2] https://sites.google.com/site/itstheshappening/

It seems more reliable to check the developer signature in Properties on the EXE - the correct developer is "Ivaylo Beltchev". The infected download is unsigned and requires you to click through a warning.

Re: Classic Shell hacked with compromised update that erases your partition table

#52

Post by Someone1234 »

TazeTSchnitzel wrote: post #25

This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.

UWP apps don't have this problem. You can install from the store in the context of your user.

But everyone "hates" UWP apps[0] so....

[0] http://betanews.com/2016/07/27/windows-10-could-kill-steam-w...

Re: Classic Shell hacked with compromised update that erases your partition table

#53

Post by Someone1234 »

fuzzy2 wrote: post #18
nailer wrote: post #6

Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.

Unless SmartScreen complains, the order of dialogs and buttons on those dialogs is exactly the same for both signed and unsigned programs. They only differ in content/design elements. That's not what I'd call prominent. There's nothing like HSTS for signed programs, so it can't be helped, though.

On Windows 10 you cannot install unsigned installers at all without disabling SmartScreen.

Re: Classic Shell hacked with compromised update that erases your partition table

#54

Post by mtgx »

corobo wrote: post #4

It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.

I also hate that Fosshub doesn't even use HTTPS, even though they could get a Let's Encrypt certificate for free. They only offer file signatures, but even those are MD5 and SHA1, and both types should've been deprecated a while ago.

Re: Classic Shell hacked with compromised update that erases your partition table

#55

Post by kalleboo »

eeeeeeeeeeeee wrote: post #40
TazeTSchnitzel wrote: post #25

This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.

I agree, in a way, but what is the point of root access on an OS X workstation? The "good stuff" -- bank accounts, personal data, etc. -- is inside that user account, even if it's not an admin user. And you can backdoor the user account to a point that the average user will never find it, making getting root less of a useful achievement.

Yeah, at this point I'd like a warning on first launch of an app that's not sandboxed (sandboxed apps can only access files that have been selected through a system "open" dialog). Although of course once Apple do that it'll launch cries of slippery slope across the community and it won't really help casual users who don't understand the security model...

Re: Classic Shell hacked with compromised update that erases your partition table

#56

Post by kalleboo »

drewg123 wrote: post #26
TazeTSchnitzel wrote: post #25

This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.

There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/

Apps on OS X that have been installed through the App Store are sandboxed which is pretty close to the partitioning on iOS - for instance they can only access files the user has explicitly given access to (open dialog, double-clicking, drag and drop onto the app).

That doesn't help you with apps you downloaded through the web though, which for me is all my apps because the App Store is a PITA.

Re: Classic Shell hacked with compromised update that erases your partition table

#57

Post by Karunamon »

Someone1234 wrote: post #49
ianlevesque wrote: post #41

Earlier quoted context omitted.

In theory that's what Windows SmartScreen is there to prevent.

Unfortunately every single one of those terrible "stop Windows 10 spying on you!!!" guides tells people to turn off SmartScreen along with UAC/Windows Firewall/Windows Defender. Or worse tells them to download an unknown program which turns off a bunch of security features at a single click without an explanation of the cost. But at least the user feels less spied upon or something...

SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons.

Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s

Re: Classic Shell hacked with compromised update that erases your partition table

#58

Post by Karunamon »

eli wrote: post #37
teh_klev wrote: post #24

Earlier quoted context omitted.

Links on HN are rel="nofollow" so they're not going to get any google juice.

I don't think SEO is what pluma is concerned about

So what are they concerned about then? There's some moral wrong to watching crooks be crooks?

Re: Classic Shell hacked with compromised update that erases your partition table

#59

Post by kuschku »

dhimes wrote: post #12
Sir_Cmpwn wrote: post #11

Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

And all of it just because they didn’t have a Windows 10 VM.

Would’ve been funny to see what they’d have done with EFI – maybe a graphical message?

Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.

Re: Classic Shell hacked with compromised update that erases your partition table

#60

Post by kuschku »

pluma wrote: post #10
Kristine1975 wrote: post #7

Twitter account of the hackers: https://twitter.com/CultOfRazer

I'm not sure it's appropriate to give that kind of people unwarranted publicity.

What "kind of people"?

They had the power to abuse that data and ship malware to millions, but decided just to give people a scare.

That’s just the average grey-hat, or how most hackers were in the 90s.

Compared with the profit-obsessed and abusive hackers and companies on the web today, which try to shove actual malware, sometimes installers with tons of preselected options, sometimes bitlocker, they’re not bad.

Post reply on HN