Any sufficiently advanced uninstaller is indistinguishable from malware • Hacker News Board

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#481

Post by elzbardico » Wed, Sep 13, 2023, 5:39 PM UTC

crabbone wrote: post #316

EvanAnderson wrote: post #292

Earlier quoted context omitted.

Windows has had an installer as an OS component since the late 90s (called Windows Installer). As a sysadmin I'd prefer apps use it. Many application developers do not. It's maddening. (Doubly so when Microsoft themselves don't use it-- newer versions of Office, Teams, etc. Microsoft suffers from too much NIH.) I get unattended installs and uninstalls "for free" when well-behaved applications use Windows Installer. P…

I had a friend who worked for a company that specialized in Web browser bars and MSIs. In other words, they were a shop to put all kinds of malware into these things. It was a viable business model for a company of something like 50 people. The whole story and ideas put into Windows installing programs are a stupid joke. It's designed by project managers who have no idea what they are doing and no imagination and is…

A lot of weird things in windows are reflections of the gestalt in the 90's and early 2000. People went all in on all sort of OOP-derived weirdness, like CORBA, COM.

"Plain-Text files for configuration? what do you think we are? savages? no, we need a hierarchical registry! every serious program must use some opaque binary format to store stuff!" seem to be the general animus at that time. Nowadays, even if you really hated the idea of a text files for configuration in your home direction, people would probably do something more straight-forward like using a SQLite db.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#482

Post by TremendousJudge » Wed, Sep 13, 2023, 5:43 PM UTC

ryandrake wrote: post #453

drbig wrote: post #418

I still long for the approach many software used on the AmigaOS - the app is a folder, the folder has the main exec and any assets it needs (libraries, images, etc.) and documentation and... That's it. Install? Copy the directory to where you like. Uninstall? Delete the directory. And if you wish you could keep any files used/generated with such an app in the same folder, making it 100% self-contained. I remember bei…

To be fair, Windows applications can be designed to be installable this way: a single executable, with everything it needs sitting next to it in the folder. Even better, a single executable with no other dependent files at all! Lots of little utilities used to be distributed this way. But many developers deliberately choose to structure their monster such that it needs to spread its tentacles all over the filesystem…

It sounds great but there are simple use cases where the "portable" app isn't enough. For example, if you want multiple users to be able to use the program and have their own settings, you need something to be saved to the user folder. Or, if you want any basic interaction with the system (run on startup, run from a browser address, etc), you need to start messing with the registry.

So in theory apps could be distributed portable .exes but in practice Windows doesn't any ways of interacting with the rest of the system that are that nice.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#483

Post by TremendousJudge » Wed, Sep 13, 2023, 5:46 PM UTC

kevingadd wrote: post #13

bippihippi1 wrote: post #6

interesting investigation and js. Though I'm wondering why does windows rely on the software to uninstall itself?

historically all windows software has either been unzipped into a folder or installed using an installer created by the vendor, so as a result the vendor has to provide their own uninstaller too. uninstallers are complex enough that the OS can't completely take their place, though Windows has shipped with an install/uninstall framework called MSI for a long time.

What they never shipped is understandable docs and tools for devs to create .msi installers, which caused the deluge of custom installers such as the one being discussed.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#484

Post by 10000truths » Wed, Sep 13, 2023, 5:47 PM UTC

TheNewsIsHere wrote: post #279

tmpX7dMeXU wrote: post #202

Earlier quoted context omitted.

That is not a user-specified authority.

I would also like this option. I see why Apple finds it undesirable though. Software installation safeguards are a game of whack-a-mole with (e.g.) support scammers who ask grandma/Lee-in-accounting/Cindy-next-door to naively click through all the warnings. The closest Apple comes to this capability is achieved via device Supervision and MDM, which might be comfortable for some of us here in this forum but obviously…

There is no Pareto optimal unicorn that provides both a democratized marketplace of software with low barriers to entry and an ironclad guarantee of security against compromise of personal user information. These two are fundamentally at odds. If anyone can produce and distribute software easily on a given platform, then so can people with malicious intent.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#485

Post by Matl » Wed, Sep 13, 2023, 5:51 PM UTC

sanitycheck wrote: post #467

Matl wrote: post #415

Earlier quoted context omitted.

> On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different. This is a problem but only if you install software on Linux by manually going to the project page and copy-pasting whatever curl they have there, I think the difference is that mostly you're encouraged to go the package manager route, whereas on windows downloading .exes directly (ala the curl example) is the norm.

It seems to be increasingly the case that package managers just don't have some software - or have a version that's years out of date. Perhaps the number of different ones available has become self-defeating. Directly sudoing a curl-ed script is like running a binary on Windows with admin permissions and with Defender turned off, which makes it somewhat more scary to me. On Windows I use Chocolatey when I can, and if…

> Directly sudoing a curl-ed script is like running a binary on Windows with admin permissions and with Defender turned off,

Most people would just say yes to any prompt they get, those wise enough not to aren't running random curl scripts either.

As for Defender being any kind of protection, I have my doubts.

> it seems to be increasingly the case that package managers just don't have some software - or have a version that's years out of date.

This is entirely distro dependant, some are very up to date and have most things you'd want, especially if you include the likes of AUR in that. But then there's usually a Flatpak or an AppImage that you can use in the odd case that they don't.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#486

Post by nneonneo » Wed, Sep 13, 2023, 6:15 PM UTC

ChrisSD wrote: post #445

sim7c00 wrote: post #428

Earlier quoted context omitted.

Haha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)

The fact it injects into another process means they can't know if it'll crash or not. You're just one Explorer update away from things changing enough for the hack to crash it. I guess they could do this more robustly. I.e pause the entire explorer process, save all its state, remotely allocate new memory to inject their code, remotely create a new thread, run only that thread using the injected code, restore all the…

The problem isn’t that the injected thread is racing explorer - indeed, pausing the entirety of explorer to run your uninstaller would probably be strictly more dangerous than what they’re doing - the problem is that the injected thread is using function pointers that do not exist in explorer.exe. Most likely, the reason is that the uninstaller itself has been “detoured” by yet another program to patch calls to certain functions, and it’s copying the detoured addresses instead of the addresses to the real functions.

Both detouring and remote thread injection are supported on Windows, but fall into the category of gray-hat techniques; there are some legitimate uses but quite a lot of illegitimate uses, and using these techniques correctly (without crashing anything!) can be a real challenge.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#487

Post by omnicognate » Wed, Sep 13, 2023, 6:16 PM UTC

dmazzoni wrote: post #477

kazinator wrote: post #413

Earlier quoted context omitted.

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

> Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior?

If Raymond Chen says to rely on it then yes.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#488

Post by HdS84 » Wed, Sep 13, 2023, 6:17 PM UTC

EvanAnderson wrote: post #292

blackpill0w wrote: post #149

Why do Windows programs need special installers/uninstallers? Why isn't this handled by Windows itself?

Windows has had an installer as an OS component since the late 90s (called Windows Installer). As a sysadmin I'd prefer apps use it. Many application developers do not. It's maddening. (Doubly so when Microsoft themselves don't use it-- newer versions of Office, Teams, etc. Microsoft suffers from too much NIH.) I get unattended installs and uninstalls "for free" when well-behaved applications use Windows Installer. P…

Wix is part of the problem. It's basically making money for the developers who offer consultancy for it.

Therefore the documentation is poor , like the absolute worst I've ever seen. Opening issues for doc issues never results in anything. Pointing out UX issues is usually shot down. Finally, until this year you needed .net 2 installed to build it, which does not play well with windows docker.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#489

Post by chrchang523 » Wed, Sep 13, 2023, 6:27 PM UTC

dmazzoni wrote: post #477

kazinator wrote: post #413

Earlier quoted context omitted.

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

Agree, I'm shocked at how ugly the recommended alternative is. This does not make MS look good.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#490

Post by mschuster91 » Wed, Sep 13, 2023, 6:28 PM UTC

_23sd wrote: post #474

mschuster91 wrote: post #294

Earlier quoted context omitted.

> Baddies keep ruining all the fun for the rest of us. IMHO the blame rather lies with our politicians who are unwilling to take the steps necessary to cut the baddies off from the Internet. Let's see just how fast India, Pakistan, Turkey and other scammer hotspots clean up their act when the US+EU threaten to cut them off from the Internet and SS7 unless the scam callcenters are closed down for good... the amount of…

I’m more than a little skeptical that scams would be less of a problem if specific countries cracked down on large operations. For one thing it’s not clear how you’d ever get the whole world on board. Pressuring India is hard enough, try Myanmar, a place that doesn’t get along with the West at all and is already a hotspot for phone scams targeting Chinese speakers. And if centralized, relatively open operations overs…

> For one thing it’s not clear how you’d ever get the whole world on board.

You don't need the whole world. The Western world is enough - no Internet and phone service (both easily enforced by requiring providers to reject ASNs / phone country codes) means a lot of lost business for an affected country.

> Pressuring India is hard enough, try Myanmar, a place that doesn’t get along with the West at all and is already a hotspot for phone scams targeting Chinese speakers.

Honestly, that's China's problem to solve.

> So I’m all for pressuring India to crack down on scammers, but I don’t see how that would reduce the desire to tighten software controls on PCs.

When software vendors don't have to gate more and more features behind more and more obnoxious bullshit simply to whack-a-mole scammers, they won't.