Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Norton 360 Now Comes with a Cryptominer

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 93 posts

Re: Norton 360 Now Comes with a Cryptominer

#81

Post by hayd »

melling wrote: post #30
hules wrote: post #8

I wonder if anybody has estimations of the contribution of anti-virus software to global warming. They run on almost all desktop computers, are generally large and bloated applications that consume tons of cpu for their continuous scans, I would not be too surprised if was far from negligible.

My 2 year old blog post has the answer to that. http://h4labs.org/ive-got-another-stupid-idea-to-deal-with-c... People come up with all sorts of silly ideas rather than actually addressing the real issue. Addressing virus software will save the world exactly 0 days. UPDATE Coal usage is at record usage for power generation. It emits over twice as much CO2 as natural gas while these silly little ideas about optimizing…

"Stop all economic growth"

I disagree with doing that even in the most developed countries, I've no idea how you imagine selling that to the least developed countries. Or by force?

However, I agree we aren't really able to do enough - that there's a lot of virtue signalling so we feel a little better about ourselves - and a technological solution is what's required.

Re: Norton 360 Now Comes with a Cryptominer

#82

Post by _8j50 »

sockaddr wrote: post #39
_8j50 wrote: post #27

Earlier quoted context omitted.

Ugh.. do you think AVs are useless or something? Why do people think this. Shit AVs are shit, end of story. Reading memory and is not cpu intensive the disk i/o intensity if windows vs linux alone is very drastic if you want to evaluate that as a baseline instead. It's like asking the carbon footprint of freeway guardrails. I mean, norton sucks, sure but at least turn on defender (which is really good btw). The amoun…

No, what's staggering is the number of my family members that simply cannot use their computer because it's bogged down by an AV. Also, your analogy is completely wack.

Your av sucks then...

Re: Norton 360 Now Comes with a Cryptominer

#83

Post by _8j50 »

HelloNurse wrote: post #53
_8j50 wrote: post #27

Earlier quoted context omitted.

Ugh.. do you think AVs are useless or something? Why do people think this. Shit AVs are shit, end of story. Reading memory and is not cpu intensive the disk i/o intensity if windows vs linux alone is very drastic if you want to evaluate that as a baseline instead. It's like asking the carbon footprint of freeway guardrails. I mean, norton sucks, sure but at least turn on defender (which is really good btw). The amoun…

Even a protection racket reduces crime. The trick is that it is someone else's crime.

For it to be a racket the av vendors need to collaborate with malwaee authors

Re: Norton 360 Now Comes with a Cryptominer

#84

Post by _8j50 »

Victerius wrote: post #54
_8j50 wrote: post #27

Earlier quoted context omitted.

Ugh.. do you think AVs are useless or something? Why do people think this. Shit AVs are shit, end of story. Reading memory and is not cpu intensive the disk i/o intensity if windows vs linux alone is very drastic if you want to evaluate that as a baseline instead. It's like asking the carbon footprint of freeway guardrails. I mean, norton sucks, sure but at least turn on defender (which is really good btw). The amoun…

Yes, I think AVs are useless now, although that didn't used to be the case.

This is one of thise silly things I see only among those with just enough knowledge to shoot their own feet.

The amount malware I see stopped by defender alone is very significant. Just write mediocre malware and send email , 10-15% infection rate. Checkout the loot the emoter gang had accumulated when they got raided or any if the ransomware gangs.

A little learning does much harm!

Most people don't run Linux (Aand most Linux desktop users don't harden). I mean, I could be very lazy and make bank without AVs on windows or Mac.

Speaking to you as someone who only discovered several serious intrusions after every layer of security was defeated except defender complained!

Re: Norton 360 Now Comes with a Cryptominer

#85

Post by _8j50 »

jjoonathan wrote: post #33
_8j50 wrote: post #27

Earlier quoted context omitted.

Ugh.. do you think AVs are useless or something? Why do people think this. Shit AVs are shit, end of story. Reading memory and is not cpu intensive the disk i/o intensity if windows vs linux alone is very drastic if you want to evaluate that as a baseline instead. It's like asking the carbon footprint of freeway guardrails. I mean, norton sucks, sure but at least turn on defender (which is really good btw). The amoun…

Freeway guardrails have never deleted my car's engine while I was minding my own business staying on the road.

They would be shitty guardrails if they did just like shit AV is shit. I am not asking you to buy norton but to at least leave defender turned on windows. It stops very real and serious threats. Like i have seen attackers move laterally and they only suceed on hosts where people turned off defender or it isn't updated.

I have a challenge for any of you who disagree: write basic malware that you can use to monitor keystrokes and browser creds/traffic. Easy right? Ok, now use it in windows with defender turned on for a day and keep defender from stopping it for a week! Even better if you turn on all defender features.

I mean come on! I heard this misninformation many times before. Not once from a person whose day job is incident response. Not even once!

Re: Norton 360 Now Comes with a Cryptominer

#87

Post by riskable »

FastEatSlow wrote: post #72
vegetablepotpie wrote: post #61

Earlier quoted context omitted.

A computer that is compromised with viruses is easily remedied. Anyone can just reinstall the operating system from the OEMs supplied OS installation media or the user can provide their own operating system. I don’t buy this argument that anti-virus leads to fewer people throwing their assets out. Furthermore, viruses do not affect the underlying hardware, which is what people would be throwing away. The economics do…

I think that in the days before good windows security, it's true that more people threw out their assets due to malware. I've seen plenty of family members do it, reinstalling an operating system is sadly not something "anyone" can do. It doesn't make sense to throw hardware out because of some software, but most don't have such a distinction.

> I think that in the days before good windows security,

"Before"‽ Windows still sets every file as executable by default (just an example). If it had good security you wouldn't need anti-malware tools always running in the background looking for stuff that has already broken through (to some extent). Basically, Windows security has been and probably always will be absolute garbage.

A big reason why Microsoft won't (and can't, really) fix the security of Windows is backwards compatibility... If they fixed the "everything is executable by default" problem it would 100% for sure break a ton of stuff.

The code base for Windows is both old and enormous. They don't employ enough developers to constantly review and re-write all that code all of the time. Most of it--even today's Windows 10 core code--was written at a time when Microsoft didn't really give a rat's ass about security.

Just look at the past few years of Windows 10 vulnerabilities:

https://www.cvedetails.com/product/32238/Microsoft-Windows-1...

...and compare that to say, Canonical/Ubuntu's list:

https://www.cvedetails.com/vendor/4781/Canonical.html

Looking at last year, in 2021 Ubuntu had 29 CVE-listed vulnerabilities, four of which were "code execution" (the worst).

In that same period Windows 10 had 485 CVE-listed vulnerabilities, 112 of which were "code execution"!

Now consider for a moment that the scope of Canonical/Ubuntu CVE list includes vastly more software than what comes with Windows. I just looked (Ubuntu 21.04) and there's 6,080 packages in Ubuntu's "main" software repository which is what's in scope for those CVEs (I'm pretty sure anyway).

Whereas the scope of Windows 10 is just what comes with the OS which isn't much! If you drill down into the Windows 10 code execution vulnerabilities you'll see that it's all in the core stuff that comes with Windows like the print spooler, media services libraries, remote desktop, file system, etc. It's not obscure extras like bundled games or the snip tool or whatever.

Re: Norton 360 Now Comes with a Cryptominer

#88

Post by tata71 »

jerf wrote: post #71
vegetablepotpie wrote: post #61

Earlier quoted context omitted.

A computer that is compromised with viruses is easily remedied. Anyone can just reinstall the operating system from the OEMs supplied OS installation media or the user can provide their own operating system. I don’t buy this argument that anti-virus leads to fewer people throwing their assets out. Furthermore, viruses do not affect the underlying hardware, which is what people would be throwing away. The economics do…

"Anyone can just reinstall the operating system from the OEMs supplied OS installation media or the user can provide their own operating system." A careful examination of who that "anyone" is will reveal that as "anyone"s go, it's not very "anyone". It's certainly less than 50% comfortable doing that, and even less willing (e.g., I know how but that doesn't mean I want to).

Our society is so disenfranchised from tech that we can't type "reinstall" or "reset" into the search + follow prompts anymore.

Re: Norton 360 Now Comes with a Cryptominer

#89

Post by TheSpiceIsLife »

teakettle42 wrote: post #75
djur wrote: post #63

Earlier quoted context omitted.

Because they don't understand any of what you just said, and they think that malware can harm their computer.

> … and they think that malware can harm their computer. To be fair, it actually can — there’s plenty of writable flash on motherboards and in peripherals where malware could persist across OS reinstallation.

To add to this, isn’t a computer in this context some combination of hardware and software.

And malware is a contraction oh malicious-software.

And then is it not true that malware does, by definition, harm the users experience in someway, whether that’s detectable by the user or not.

Splitting technical hairs is entertaining though.

Re: Norton 360 Now Comes with a Cryptominer

#90

Post by qeternity »

jdavis703 wrote: post #46
qeternity wrote: post #29

Earlier quoted context omitted.

> Now imagine if tomorrow Microsoft decided to add a crypto wallet and mining tools to Windows, or Google to Chrome. People keep saying this as if crypto isn't already mainstream. Exchanges have hundreds of millions of customers. A significant portion of the world has traded crypto. And 99.99% aren't doing anything else with it but speculate. It's not as if magically bundling a wallet on millions of machines will sud…

What exchange has 100 million users? Coinbase has 6 million users. Even the largest banks barely crack that count. For example, Bank of America only has 46 million customers.

What are you talking about? Coinbase’s about page lists “73+ million verified users”.

I never said that any single exchange has over hundred million, but rather exchanges combined have hundreds of millions.

Post reply on HN