91–100 of 110 posts
Twitter account of the hackers: https://twitter.com/CultOfRazer
Warning: Certain audio editing software and system customization tools may be incompatible with Razer firmware.
A new ClassicShell update was released to patch incompatibilities with Razer hardware! Download it at http://classicshell.net
To anyone upset: At least we didn't decide to steal all your shit. Because you ran that as admin. We totally could've installed a rootkit.
Earlier quoted context omitted.
From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
Laptops are another story.
Earlier quoted context omitted.
Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).
Per the developer at that forum thread: "To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature." And per another user (silmar), my sentiments: "The problem with signed installers is: many software developers don't sign, so you install even if Windows warns yo…
While I'd like to think things are generally better now, I think the historical inertia of Windows' ecosystem and how conditioned users have become to ignoring such warnings is at least partially (mostly?) at fault. There's no easy way to correct people's behavior, and enforcing certain settings (e.g. only installing signed software) would mean either 1) upsetting power users or 2) users still finding a way to disable such checks.
Earlier quoted context omitted.
Yes, dragging the application there requires admin rights, but it doesn't grant those to the app itself.
What if the app had an suid binary? Disclosure: I'm not a mac user, and never have been one long enough to mess around with /Applications.
Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.
It wipes the MBR, but no other data. The MBR isn't that hard to recover.
It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.
It looks like they have a dump of the Fosshub user database. Audacity was also affected: http://www.audacityteam.org/hacked-download/
Earlier quoted context omitted.
And all of it just because they didn’t have a Windows 10 VM. Would’ve been funny to see what they’d have done with EFI – maybe a graphical message? Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.
> Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today. It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly bec…
And it does work in this case - try googling both the published good and bad hash :)
Earlier quoted context omitted.
You're a bit behind the curve on this. EFI has been criticized for being horrendously complicated and gross since its inception.
Obligatory Matthew Garrett quote from a Linux kernel EFI patch in 2011: UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" is an ancient African word meaning "Why do something right when you can do it so wrong that children will weep and brave adults will cower before you", and "UEI" is Celtic for "We missed DOS so we burned it into your ROMs". https://lkml.org/lkml/2011/5/25/228
Earlier quoted context omitted.
> Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today. It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly bec…
I usually check the hashes of all software I download. How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google it. If you find what look like legitimate hits associating this file with this hash, call it good. And it does work in this case - try googling both the published good and bad hash :)