Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

401–410 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#401

Post by mschuster91 »

cto_of_antifa wrote: post #321
mschuster91 wrote: post #294

Earlier quoted context omitted.

> Baddies keep ruining all the fun for the rest of us. IMHO the blame rather lies with our politicians who are unwilling to take the steps necessary to cut the baddies off from the Internet. Let's see just how fast India, Pakistan, Turkey and other scammer hotspots clean up their act when the US+EU threaten to cut them off from the Internet and SS7 unless the scam callcenters are closed down for good... the amount of…

they probably don't do it because it's a bad solution.

Is it? I prefer to tackle problems at the source, and its crystal clear that overseas scammers are exploiting corrupt local law enforcement in conjunction with easy access to targets via the Internet and shady telephone providers.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#402

Post by catiopatio »

Tainnor wrote: post #376
ubermonkey wrote: post #367

Earlier quoted context omitted.

It more or less doesn't in MacOS, and has NEVER really been a thing. While there ARE some tools that require a more invasive "installation" process (e.g., VMWare Fusion), the overwhelming majority of Mac software is installed by just dragging the application bundle into /Applications. (App bundles are just special directories, more or less, so you're moving more than just the file, but it presents as a single thing.)…

It's a bit weird to act as if macOS didn't have installers and uninstallers. For one thing, there's the App store. And then, probably most developers use something like homebrew. What you describe works for a specific kind of app, the ones that can be easily sandboxed and don't have shared dependencies.

The App Store literally just places an application bundle in /Applications.

Homebrew and MacPorts are used for Unix software that requires a Unix-style package management.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#403

Post by devnullbrain »

Tainnor wrote: post #385
devnullbrain wrote: post #379

Earlier quoted context omitted.

How do you differentiate between download and install? Is self-modifying code repeatedly installing itself?

There's no good distinction, but given that browsers have caches, I think there's at least a very blurry line there.

Then perhaps the distinction should be the programs called 'Windows installer' type in Explorer that TFA is talking about and not a blanket inclusion of all software that isn't ASM written on the device running it.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#405

Post by sim7c00 »

Zambyte wrote: post #339
marvinblum wrote: post #315

Earlier quoted context omitted.

https://fedoraproject.org/wiki/Migrating_From_Microsoft_Wind...

That's not uninstalling it though. For example on Fedora I can uninstall Linux with sudo dnf remove linux, or even remove the package manager (arguably what makes Fedora: Fedora) with sudo dnf remove dnf So not quite what I'm looking for :D

killdisk->wipe_disk - should allow you to thoroughly purge it ;)

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#406

Post by doloputer »

dataflow wrote: post #35

You can't rely on JScript being present unfortunately. It can be disabled.

It probably should be disabled on most machines. The last time I heard about it was @swiftonsecurity complaining about it being an easily overlooked malware vector.

I'd be surprised if this capability is only available from jscript though. (and sad, I don't think jscript has been updated in years)

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#407

Post by devnullbrain »

yankput wrote: post #172
tetris11 wrote: post #153

Earlier quoted context omitted.

One thing I like about Linux package managers is that you can query any file to see which package owns it. How does Windows not track this?

Except they all leave files everywhere in ~, ~/.cache, ~/.config, ~/.whatevertheyfeellike

Try opening C:\Users\%USERNAME%\Documents\My Games

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#408

Post by SAI_Peregrinus »

koiueo wrote: post #364
threatofrain wrote: post #359

Earlier quoted context omitted.

I find that Linux software culture also leaves stuff behind and leaves it up to the assumed system mastery of the user to clean things up.

That's too broad and misleading. Package manager tracks every single file installed by a package, preventing overwrites by other packages. Strict permissions prohibit software from littering all over the place. What are you taking about? Do you want package manager to remove yourb personal data of it was created by an application your decided to remove?

It should certainly be capable of removing everything the application created that wasn't manually exported by the user or saved into a user data directory. E.g. everything it made in XDG_CONFIG_HOME, XDG_STATE_HOME, XDG_DATA_HOME, XDG_CACHE_HOME, etc. Probably not anything from XDG_DOCUMENTS_DIR or the other "user data" directories.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#409

Post by PcChip »

sim7c00 wrote: post #399

The author says the binary looks like malware because it self-deletes, sleeps and touches this uninstaller thing. But the script he proposes, which would be triggered by this same thing, does the same. I am ignoring the injection thing since he guesses at it (likely correct) and also because, lots of things inject into processes without being malware. (monitoring stuff like AV etc.) Additionally, binaries which termi…

>How is the proposed solution better than the original thing?

I'm only assuming here, but maybe because it won't crash explorer and it's just a few lines of self-documenting code?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#410

Post by doloputer »

unnouinceput wrote: post #209

Does that means the corollary: "Any sufficiently advanced malware is indistinguishable from an uninstaller" would be true as well? I mean can you write a simulation of an uninstaller to create havoc on target's system and still remain "the good guy, the OS is at fault" type of situation when you write a malware?

I've heard this before, about cryptolockers. It's hard for the OS to know if you're encrypting all of your files on purpose, because you might actually want to do that.
Post reply on HN