Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware identified in CCleaner 5.33

blog.talosintelligence.com

Post reply on HN
Print view View original

41–50 of 229 posts

Re: Malware identified in CCleaner 5.33

#41

Post by cm2187 »

cyphar wrote: post #37
princekolt wrote: post #10

There has been a number of cases of installers from trusted developers being infected lately. (For example Transmission being infected twice...) On our side (developers) we need to be careful with this idea that "we will know" when something is wrong and be more careful when deploying software. It would also be nice if some form of tool could be used to test a binary to make sure it only contains what it should conta…

First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation…

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

Re: Malware identified in CCleaner 5.33

#42

Post by gigatexal »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

Ubuntu makes this pretty easy. Also solus 3 would be a good choice. And there are a number of resources and tutorials for this very thing. You can also customize your desktop environment so the critique of scroll bars and such can be resolved.

Re: Malware identified in CCleaner 5.33

#43

Post by sundvor »

exhilaration wrote: post #26
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

I rescued my neighbor's Mac from an adware invasion using Malwarebytes so I I would argue that not all these tools are created equal.

Malwarebytes is great. However, what if it was their installer that was attacked in such fashion?

Trusting old memories of what's good or not can be dangerous. I remember getting caught out once by CoreTemp which suddenly packed a load of dung in its default installer. :(

Re: Malware identified in CCleaner 5.33

#44

Post by dijit »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

I recommend KDE, it feels a bit more well put together for a desktop these days.

With regards to your question about triple monitors. I mean, I managed to get triple monitors working on FreeBSD without much fuss so I am not sure of how much help I can be when I say "it should just work". I am obviously biased.

But, it's likely that it will just work, the open source drivers for AMD are significantly superior to the open source drivers for nVidia. Although I only have nVidia cards running and I have 2 setups with triple monitors.

Re: Malware identified in CCleaner 5.33

#46

Post by ChrisSD »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

Fedora[0] might be what you're looking for. There are various "spins"[1] that use different desktop environments if the main one doesn't take your fancy. You can use a live image to try a few before you install.

[0] https://getfedora.org/ [1] https://spins.fedoraproject.org/

Re: Malware identified in CCleaner 5.33

#47

Post by cyphar »

cm2187 wrote: post #41
cyphar wrote: post #37

Earlier quoted context omitted.

First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation…

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

As I posted above, we have a build service that does this automatically for you. It takes maybe 30 minutes to create a few spec files, and now it's supported by a bunch of different distributions. You can then point your users at the repo (or mirror the repo if you prefer). Also OBS lets you create forks of projects that just inherit the unmodified packages (and said forks can also be cross-host so you don't need to self-host a whole distribution).

I agree that doing everything I mentioned manually is hard, that's again why I said that distributions have solved this problem and made it easy.

Re: Malware identified in CCleaner 5.33

#48

Post by julianj »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

Give Ubuntu desktop a try. The installer allows you to run the OS live without installation. You can use this to see if Ubuntu is something you may be interested in.

Re: Malware identified in CCleaner 5.33

#49

Post by happy-go-lucky »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

After trying a number of distros, I settled on Ubuntu and a while ago switched from Unity to Gnome. Most of the time I use two monitors without any problem and I live in a terminal.

Re: Malware identified in CCleaner 5.33

#50

Post by sdwisely »

cm2187 wrote: post #41
cyphar wrote: post #37

Earlier quoted context omitted.

First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation…

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

compile times are fast enough now that if the tools were friendly enough I don't know it would be so inconvenient to the end user anymore.

is there any distros out there now that are source based like Gentoo with more friendly defaults?

Post reply on HN