Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

441–450 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#441

Post by some_random »

sim7c00 wrote: post #399

The author says the binary looks like malware because it self-deletes, sleeps and touches this uninstaller thing. But the script he proposes, which would be triggered by this same thing, does the same. I am ignoring the injection thing since he guesses at it (likely correct) and also because, lots of things inject into processes without being malware. (monitoring stuff like AV etc.) Additionally, binaries which termi…

Cybersecurity is pretty much all bad heuristics with the belief that if you use enough of them they average out to an ok determination of maliciousness. It works alright, sometimes.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#442

Post by alerighi »

highwaylights wrote: post #159
blackpill0w wrote: post #149

Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?

I don't think any major desktop OS handles this well. I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved. macOS comes pretty close to what I'd ideally want i…

> I suspect the final form for software installation is probably where iOS and Android are going in the EU, where there's a single means of installing software to the device so that everything can be sandboxed properly, but the acquisition/update process can be pointed to a URL/Store that the user has pre-approved.

Basically how Linux distributions works since the beginning. Tough at the start the installation source was not remote but a CD-ROM things didn't change.

You have a repository of packages (that can be on a local source as a CD or remote source such as an HTTP/FTP server), that have some sort of signature (on Linux usually the pagkage is signed with GPG) with some keys that the user trusts (and the default are installed on the system), and a software that allows to install, uninstall and update the packages.

Android/iOS arrived later, but they didn't invent anything.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#443

Post by alerighi »

Well I like the "workaround" that Microsoft proposes for a limitation of Windows that shouldn't really be to this day.

UNIX resolved this decades ago: the filename is just a link to a structure on disk. You can delete a file even if it's used, since the file is there but you only delete the reference (filename pointing to the inode) that it has. Programs that have the file open can continue using it. When the file is no longer open by any programs the reference count is checked: if it's zero it means that the file can be safely deleted.

Not a difficult thing to implement, since they did it in the 70s... still Widnows doesn't get it.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#444

Post by realslimjd »

drbig wrote: post #418

I still long for the approach many software used on the AmigaOS - the app is a folder, the folder has the main exec and any assets it needs (libraries, images, etc.) and documentation and... That's it. Install? Copy the directory to where you like. Uninstall? Delete the directory. And if you wish you could keep any files used/generated with such an app in the same folder, making it 100% self-contained. I remember bei…

This is how a lot of apps on MacOS still work.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#445

Post by ChrisSD »

sim7c00 wrote: post #428
PcChip wrote: post #409

Earlier quoted context omitted.

>How is the proposed solution better than the original thing? I'm only assuming here, but maybe because it won't crash explorer and it's just a few lines of self-documenting code?

Haha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)

The fact it injects into another process means they can't know if it'll crash or not. You're just one Explorer update away from things changing enough for the hack to crash it.

I guess they could do this more robustly. I.e pause the entire explorer process, save all its state, remotely allocate new memory to inject their code, remotely create a new thread, run only that thread using the injected code, restore all the process' state and finally start it running where it left off. A script would be easier though.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#446

Post by [deleted] »

koiueo wrote: post #364
threatofrain wrote: post #359

Earlier quoted context omitted.

I find that Linux software culture also leaves stuff behind and leaves it up to the assumed system mastery of the user to clean things up.

That's too broad and misleading. Package manager tracks every single file installed by a package, preventing overwrites by other packages. Strict permissions prohibit software from littering all over the place. What are you taking about? Do you want package manager to remove yourb personal data of it was created by an application your decided to remove?

[deleted]

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#447

Post by amelius »

edaemon wrote: post #357
amelius wrote: post #345

Why do we still need to install stuff? Why can I run webpages just fine without installing anything? Installation shouldn't exist, at least not from the user's point of view.

You had to install a web browser to run those web pages.

Installation of the OS and the browser can be amortized away over a large number of app installations.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#448

Post by frankchn »

alerighi wrote: post #443

Well I like the "workaround" that Microsoft proposes for a limitation of Windows that shouldn't really be to this day. UNIX resolved this decades ago: the filename is just a link to a structure on disk. You can delete a file even if it's used, since the file is there but you only delete the reference (filename pointing to the inode) that it has. Programs that have the file open can continue using it. When the file is…

Isn't that what the second line in the JavaScript snippet does: delete itself while the script is still in use (i.e. running?)

In any case, I am not sure the Unix way is the best API design here. Sure, it does help in these scenarios, but now you can have hidden files lying around in the filesystem being used that I can't easily tell are even there.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#449

Post by [deleted] »

alerighi wrote: post #443

Well I like the "workaround" that Microsoft proposes for a limitation of Windows that shouldn't really be to this day. UNIX resolved this decades ago: the filename is just a link to a structure on disk. You can delete a file even if it's used, since the file is there but you only delete the reference (filename pointing to the inode) that it has. Programs that have the file open can continue using it. When the file is…

[deleted]

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#450

Post by riskable »

winthrowe wrote: post #270
BoppreH wrote: post #258

Earlier quoted context omitted.

That was the first option, "provides a framework for installers/uninstallers". But what would you do with the millions of existing programs, most unmaintained? And what about programs with strong opinions on update schedules, or built-in extension marketplaces? It's easy to solve this problem if your first step is "replace every program".

If you care about this enough to abandon old software, they built that and called it Windows S and few wanted it.

Windows without backwards compatibility is a dead end because the only reason why Windows exists is backwards compatibility and the existing user base. As an OS it is decades behind all its competitors, with a 30yo filesystem, file locking ridiculousness (which is why uninstallers and updates end up being so complex and require reboots), an antiquated central registry for settings that ends up slowing the system down over time, and a security framework so broken that you need anti-malware software running and inspecting every little thing happening on your system or you're easily compromised (everything is executable by default).

The security situation is so bad at this point that you can't trust any Windows benchmarks anymore. The benchmark suite will run on a "bare" Windows system; probably with updates and Windows Defender disabled and many other system services stopped to maximize performance and prevent background services from slowing everything down. The reality though is that on a regular user desktop all these things and a whole lot more will be enabled, resulting in vastly degraded performance compared to the benchmarks. The end user experience sucks.

Now they're forcing ads down your throat and pestering you at every turn to use more Microsoft software (e.g. trying to get you to use Edge). They've also recently included UI changes in "essential" system updates that can't easily be reverted or undone, breaking people's workflows. It's anti-user insanity and it's all because Microsoft can't actually go back to the drawing board with Windows anymore because the alternatives are just too good.

After using a Linux desktop full-time for a while, going back to Windows feels like going from having modern plumbing to pooping in the woods.

Post reply on HN