Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

461–470 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#461

Post by tgtweak »

terabytest wrote: post #47

I’m probably missing something but why is an uninstaller allowed to inject code into explorer.exe? That seems like a massive security flaw?

Uninstaller likely running with admin privileges or as system. Despite it's huge surface area, explorer is not a super privileged binary on windows and is essentially a userspace program that has tons of open ports to plug in for many many apps. Locking it down like this would likely cause a lot of apps to break. I know for a fact microsoft keeps very close eyes on crash reports of their core apps such as explorer, and if your app causes a fault in explorer and you're registered on windows developer portal you'll get notified of this when they roll out beta insider preview releases.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#464

Post by tssva »

Tuna-Fish wrote: post #256
BoppreH wrote: post #245

Earlier quoted context omitted.

How could Windows handle it by itself? If it provides a framework for installers/uninstallers, it'll be fighting the inertia of decades of legacy software, programmer habits, and old tutorials. If it tracks file ownership by program, it might accidentally delete user files. How would it differentiate between a VSCode extension that should be uninstalled, and a binary compiled with VSCode for a user project? A false p…

The same way any linux distro does? Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages. Uninstall removes everything related to a program from this directory. > In the age of shared runtimes, auto-updaters, extension marketplaces, and JIT compilers, managing installed applicat…

> The same way any linux distro does?

I'm going to assume you are talking about rpm and deb packages since they are still currently the dominant installation packages on Linux.

> Define a separate directory for program installations, that user processes cannot write to. Only program that can do so is the package manager, which other programs can call to install packages.

Windows does this. Programs are installed in directories under "C:\Program Files" which is only writable with elevated system rights.

> Uninstall removes everything related to a program from this directory.

rpm and debs don't install all the files needed for a program in a single directory. They are scattershot all over the file system and in many of these directories comingled with files from other programs. Windows comes closer than Linux in this regard since it does create the directory under "C:\Progtam Files" which while unfortunately doesn't always contain all the required files usually contains the vast majority.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#465

Post by jjcoffman »

RajT88 wrote: post #414
EvanAnderson wrote: post #292

Earlier quoted context omitted.

Windows has had an installer as an OS component since the late 90s (called Windows Installer). As a sysadmin I'd prefer apps use it. Many application developers do not. It's maddening. (Doubly so when Microsoft themselves don't use it-- newer versions of Office, Teams, etc. Microsoft suffers from too much NIH.) I get unattended installs and uninstalls "for free" when well-behaved applications use Windows Installer. P…

Can confirm. I would be considered by most to have been a Windows Installer expert at one point. Installshield / Wix / Whatever else. It is intentionally obtuse at times (MSIFileHash table uses rearranged MD5 hashes for example), and also many features made sense for the late 90's/Early 2000's era where bandwidth was low and connectivity limited, and lots of stuff was distributed on CD's. The look on people's faces w…

Orca ftw

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#466

Post by 0x0000000 »

jiofj wrote: post #125
PreInternet01 wrote: post #75

Earlier quoted context omitted.

> There are already many services and APIs for doing this I... don't think so? The particular problem here, is that an uninstaller executable needs to delete itself from disk after doing its main job. Other than using MoveFileEx with a NULL destination file and the MOVEFILE_DELAY_UNTIL_REBOOT flag, then suggesting/forcing a reboot, I can't think of a straightforward solution. And that solution instantly lights up you…

>Other than using MoveFileEx with a NULL destination file and the MOVEFILE_DELAY_UNTIL_REBOOT flag, then suggesting/forcing a reboot, I can't think of a straightforward solution. And what's the problem with this?

One of the comments on the article gives one example:

> When our product’s uninstaller sees an undeletable file (possibly a DLL loaded in another process), it uses the MOVEFILE_DELAY_UNTIL_REBOOT flag to mark it for deletion, and warns the user “Please reboot as soon as possible to remove the remaining files.”

> However, some user uninstall our product, just to be able to reinstall it later, to the same location. And of course they ignored the warning. Once they reinstalled it, everything works, until a reboot.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#467

Post by sanitycheck »

Matl wrote: post #415
irusensei wrote: post #253

Earlier quoted context omitted.

Everyone is pointing at Windows but there are still installer software on MacOS. Normally crusty old corpoware like Citrix that needs to extend its tentacles to the whole system. On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different. I normally keep both types away from my computers.

> On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different. This is a problem but only if you install software on Linux by manually going to the project page and copy-pasting whatever curl they have there, I think the difference is that mostly you're encouraged to go the package manager route, whereas on windows downloading .exes directly (ala the curl example) is the norm.

It seems to be increasingly the case that package managers just don't have some software - or have a version that's years out of date. Perhaps the number of different ones available has become self-defeating.

Directly sudoing a curl-ed script is like running a binary on Windows with admin permissions and with Defender turned off, which makes it somewhat more scary to me.

On Windows I use Chocolatey when I can, and if I can't (or it looks dodgy anyway) I'll either just not install it or try it in a sandbox. Things that aren't choco-able are generally commercial software obtained from the vendor's download page, we theoretically trust those things somewhat. YMMV.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#468

Post by RajT88 »

jjcoffman wrote: post #465
RajT88 wrote: post #414

Earlier quoted context omitted.

Can confirm. I would be considered by most to have been a Windows Installer expert at one point. Installshield / Wix / Whatever else. It is intentionally obtuse at times (MSIFileHash table uses rearranged MD5 hashes for example), and also many features made sense for the late 90's/Early 2000's era where bandwidth was low and connectivity limited, and lots of stuff was distributed on CD's. The look on people's faces w…

Orca ftw

If you go way down the rabbit hole, you end up at modifying OpenMCDF.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#469

Post by bobsmooth »

internetter wrote: post #334
Macha wrote: post #271

Earlier quoted context omitted.

EVE online's patcher once deleted boot.ini (a file configuring their launcher that they stopped needing) without checking the working directory which caused it to delete C:\Windows\system32\boot.ini which was important to booting the then current Windows version.

It's impressive how incredibly bad the code must have been for that to happen

System32 is the default directory for cmd. Might have something to do with that.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#470

Post by kazinator »

sim7c00 wrote: post #437
kazinator wrote: post #413

Earlier quoted context omitted.

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

The script doesn't inject. But a lot of malware downloads a script and runs it, so you'd hit another rule.

The way I understand it, the uninstaller program that wants to delete itself doesn't have to download the script from anywhere; it generates the script out to a file.
Post reply on HN