Hooking Candiru: Another mercenary spyware vendor comes into focus • Hacker News Board

Re: Hooking Candiru: Another mercenary spyware vendor comes into focus

#31

Post by rannor » Sat, Jul 17, 2021, 4:05 PM UTC

Anunayj wrote: post #25

deregulateMed wrote: post #11

Earlier quoted context omitted.

I wonder if those supposedly secure Linux distros are actually secure. Anything from MS, Google, and Apple cannot be trusted.

Well unless you are building everything from source (after auditing software), you end up trusting someone for the executable (packaged by distro maintainers). Distros like Gentoo solve this pretty well by giving a good suite of build tools, Nevertheless it's too bothersome for most users. Arch distributes it's package signing abilities to multiple maintainers who can revoke each other's keys. which imo is better tha…

“more eyes on the code”

Unless the code is coming from the University of Minnesota. :)

Re: Hooking Candiru: Another mercenary spyware vendor comes into focus

#32

Post by theamk » Sat, Jul 17, 2021, 5:49 PM UTC

qwerty456127 wrote: post #9

As a society, we absolutely have to start actively developing software (OS in the first place) and hardware with privacy as a topmost priority. Using Windows and common Windows apps leaves bizarrely many tracks on the computer. Just take a look at one of the many resources on "computer forensics" and you'll see. And I doubt this can be addressed without decreasing complexity.

This will make things described in the original article even easier.

The reason Candiru works is because Windows machines are general computing devices which give users almost complete access to the machine.

If you want a machine that malware cannot spy on, you want something non-general and locked down, like an Chromebook or iPhone or some other system with secure boot and mandatory code signing. There must be an authority that decides, “this is password stealer that must be blocked” vs “this is keyboard autocomplete handler and can be allowed”.

This requires standardized interfaces, code signing systems, auto updates, solid security boundaries, distributed app whitelists - lots of complex stuff. You can decrease complexity a bit, but if you go too far, you will end up with systems which are easy to compromise and hard to heal.

Re: Hooking Candiru: Another mercenary spyware vendor comes into focus

#33

Post by pabs3 » Sun, Jul 18, 2021, 2:52 AM UTC

deregulateMed wrote: post #11

qwerty456127 wrote: post #9

As a society, we absolutely have to start actively developing software (OS in the first place) and hardware with privacy as a topmost priority. Using Windows and common Windows apps leaves bizarrely many tracks on the computer. Just take a look at one of the many resources on "computer forensics" and you'll see. And I doubt this can be addressed without decreasing complexity.

I wonder if those supposedly secure Linux distros are actually secure. Anything from MS, Google, and Apple cannot be trusted.

Even if your software is secure, that does not mean it is private. For example there are all sorts of privacy violations in Debian:

https://wiki.debian.org/PrivacyIssues