61–70 of 110 posts
Earlier quoted context omitted.
From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
/Applications requires administrative rights to update. I never use an admin account for every day activity, so I need to type in a password to update /Applications.
This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/
Earlier quoted context omitted.
Unfortunately every single one of those terrible "stop Windows 10 spying on you!!!" guides tells people to turn off SmartScreen along with UAC/Windows Firewall/Windows Defender. Or worse tells them to download an unknown program which turns off a bunch of security features at a single click without an explanation of the cost. But at least the user feels less spied upon or something...
SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons. Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s
Here is what SmartScreen actually looks like and actually does[0] on Windows 10 when attempting to download an unsigned installer.
If Microsoft is aware that the file you're attempting to download is malware, they will block the download entirely (in IE/Edge).
This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.
OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications /Applications requires administrative rights to update. I never use an admin account for every day activity, so I need to type in a password to update /Applications.
Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.
Earlier quoted context omitted.
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
I'm begin to think that EFI is a very wrong turn way on modern computers.
It's described there as the Audacity portion being a compromise of an Audacity developer's account, with another reference to two compromised accounts. There were also other attack attempts going on at the same time, so the FossHub folks took things down for a time - not sure if they're done with their checking or not.
According to FossHub there were only ~300 downloads of Classic Shell during this time, and they may have caught the Audacity one faster.
Earlier quoted context omitted.
There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/
Apps on OS X that have been installed through the App Store are sandboxed which is pretty close to the partitioning on iOS - for instance they can only access files the user has explicitly given access to (open dialog, double-clicking, drag and drop onto the app). That doesn't help you with apps you downloaded through the web though, which for me is all my apps because the App Store is a PITA.