Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Classic Shell hacked with compromised update that erases your partition table

classicshell.net

Post reply on HN
Print view View original

81–90 of 110 posts

Re: Classic Shell hacked with compromised update that erases your partition table

#81

Post by Kadin »

kuschku wrote: post #59
dhimes wrote: post #12

Earlier quoted context omitted.

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

And all of it just because they didn’t have a Windows 10 VM. Would’ve been funny to see what they’d have done with EFI – maybe a graphical message? Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.

> Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.

It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly become conditioned to click through the warnings.

I'll be honest: if there was an app that I wanted to install, and I got an unsigned-package warning, my first thought on both Mac and Windows would be that the developer probably had an ethical or financial problem with the signing scheme, not that the package was compromised. On Linux, I'd be more confident and probably stop what I was doing, but only because very little software makes it onto distribution systems if the developer has an issue with the platform...

Re: Classic Shell hacked with compromised update that erases your partition table

#82

Post by fuzzy2 »

Someone1234 wrote: post #53
fuzzy2 wrote: post #18

Earlier quoted context omitted.

Unless SmartScreen complains, the order of dialogs and buttons on those dialogs is exactly the same for both signed and unsigned programs. They only differ in content/design elements. That's not what I'd call prominent. There's nothing like HSTS for signed programs, so it can't be helped, though.

On Windows 10 you cannot install unsigned installers at all without disabling SmartScreen.

That's not true. Although the screen wide dialog thingy is a little tricky, you can still choose to continue. It doesn't even appear most of the time.

Re: Classic Shell hacked with compromised update that erases your partition table

#83

Post by yuhong »

voltagex_ wrote: post #16
dhimes wrote: post #12

Earlier quoted context omitted.

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.

I think you can easily do some of the UEFI DoS attacks directly from Windows without executing an EFI binary.

Re: Classic Shell hacked with compromised update that erases your partition table

#84

Post by yuhong »

digi_owl wrote: post #79
Zardoz84 wrote: post #61

Earlier quoted context omitted.

I'm begin to think that EFI is a very wrong turn way on modern computers.

The PC platform as a whole is going through a severe case of "second system effect".

Even back in the 1990s, there was ACPI. ACPI 1.0 for example dates back to the end of 1996 (of course before then there was drafts): http://uefi.org/sites/default/files/resources/ACPI_1.pdf But of course ACPI took years to catch on, during which low cost PCs from for example eMachines was coming.

Re: Classic Shell hacked with compromised update that erases your partition table

#85

Post by Karunamon »

Someone1234 wrote: post #64
Karunamon wrote: post #57

Earlier quoted context omitted.

SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons. Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s

What you see in that video isn't SmartScreen, SmartScreen is disabled in that video. Here is what SmartScreen actually looks like and actually does[0] on Windows 10 when attempting to download an unsigned installer. If Microsoft is aware that the file you're attempting to download is malware, they will block the download entirely (in IE/Edge). [0] http://imgur.com/a/l5JzM

Ah, yup. Good catch!

Re: Classic Shell hacked with compromised update that erases your partition table

#86

Post by snuxoll »

Kadin wrote: post #81
kuschku wrote: post #59

Earlier quoted context omitted.

And all of it just because they didn’t have a Windows 10 VM. Would’ve been funny to see what they’d have done with EFI – maybe a graphical message? Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.

> Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today. It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly bec…

It helps that signing packages for Linux distributions costs $0, since they all use GPG. I actively avoid adding repositories that aren't signed with GPG keys for this reason, though it still doesn't protect me from compromised keypairs.

Re: Classic Shell hacked with compromised update that erases your partition table

#87

Post by theandrewbailey »

ocdtrekkie wrote: post #21
theandrewbailey wrote: post #19

Earlier quoted context omitted.

Damn. You have no idea how close I was to reinstalling Audacity last night.

Downloaded it a couple days ago in my case! Close call, though I do backup my important files offsite.

I keep two offsite backups!

Re: Classic Shell hacked with compromised update that erases your partition table

#88

Post by tetha »

AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

End-User-Effort just doesn't work, sadly.

I'm currently rather thinking about some cross-referencing service. A developer would go ahead and register multiple download locations for their product. The system would go ahead and download the file from the various locations, compute checksums and alert if the checksums of different download locations differ.

If this service exists, you'd have to compromise this service and a download location in order to exchange a file unnoticed for more than 2*the check interval.

The major issues I see:

- Updates are a big issue, because updates are a planned exchange of the binary to download. So I guess there'd need to be a set of valid checksums, which weakens the guarantees of the system, but not too much.

- Resources are an issue, especially bandwidth and traffic. Imagine getting all debian isos from all mirrors to verify their checksums.

But either way, such a service could be a good way to detect irregular file changes and notify the security community, devs, site admins and so on.

Re: Classic Shell hacked with compromised update that erases your partition table

#89

Post by kuschku »

Someone1234 wrote: post #64
Karunamon wrote: post #57

Earlier quoted context omitted.

SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons. Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s

What you see in that video isn't SmartScreen, SmartScreen is disabled in that video. Here is what SmartScreen actually looks like and actually does[0] on Windows 10 when attempting to download an unsigned installer. If Microsoft is aware that the file you're attempting to download is malware, they will block the download entirely (in IE/Edge). [0] http://imgur.com/a/l5JzM

The issue is that due to the high costs of getting a certificate, a lot of legitimate software for Windows is still unsigned.

I know several large FLOSS projects, with hundredthousands and millions of users, that ship only unsigned binaries, telling their users to turn off SmartScreen.

If Microsoft would have used a GPG-like mechanism, or provided certs for free, it would look very different.

Re: Classic Shell hacked with compromised update that erases your partition table

#90

Post by steve-howard »

chrisper wrote: post #66
nailer wrote: post #6

Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.

Those warnings are as useful as the certificate error ones you get when browsing the web. Most (normal) people see them as annoyances and they do not really protect anyone as they will just click "continue." Same with the UAC pop up that tells you that the app is not signed. Most of the apps I downloaded are not signed...

From the linked forum post:

>When I installed it said it couldn't be trusted, I installed anyway but it did nothing.

Users have no way of knowing which things are safe and which things aren't if almost everything comes with a "this isn't safe" warning.

Post reply on HN