Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

541–550 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#541

Post by pbhjpbhj »

FirmwareBurner wrote: post #218
pbhjpbhj wrote: post #199

Earlier quoted context omitted.

There was a Steam package error, the error warned it might be temporary, the installer said it wouldn't continue because that would remove "popos-desktop" amongst other things. So, he opened a console (like any user?), then used apt-get ... which had a WARNING ... "This should NOT be done unless you know exactly what you are doing!". He then had to type "Yes, do as I say!" in order to "do something potentially harmfu…

That would happen to any other user trying linux for the first time because not every user knows they should first update their packages before trying to install something because why doesn't the OS do it automatically like any other OS? It's 100% an OS UX error you're trying to spin into an user error.

It's an application error (a transient error with Steam), MS Windows doesn't even offer general application updates.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#542

Post by pbhjpbhj »

dist-epoch wrote: post #208
pbhjpbhj wrote: post #156

Earlier quoted context omitted.

So there's a way to have Windows uninstall a program that doesn't offer an uninstaller? Where do I look in the OS for the manifest of all installed files from an installer? Thanks, I'm mostly a Linux user and I've sorely missed a `dpkg -L` on MS Windows for ages.

Windows does have an official package manager now - winget. It also supports the uninstall command. Also 'winget list' https://learn.microsoft.com/en-us/windows/package-manager/

Whilst winget looks like progress (presumably there'll be a non-CLI interface soon?) it seems like it's a tool for a limited set of applications that are allowed into a Microsoft list, not even applicable to .msi[x] in general and definitely not a way to uninstall (nor even just list) files installed by applications in general.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#543

Post by dist-epoch »

pbhjpbhj wrote: post #542
dist-epoch wrote: post #208

Earlier quoted context omitted.

Windows does have an official package manager now - winget. It also supports the uninstall command. Also 'winget list' https://learn.microsoft.com/en-us/windows/package-manager/

Whilst winget looks like progress (presumably there'll be a non-CLI interface soon?) it seems like it's a tool for a limited set of applications that are allowed into a Microsoft list, not even applicable to .msi[x] in general and definitely not a way to uninstall (nor even just list) files installed by applications in general.

Running "winget list" on my system lists all installed application, no matter how they were installed.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#544

Post by S3rM5Y5 »

sim7c00 wrote: post #428
PcChip wrote: post #409

Earlier quoted context omitted.

>How is the proposed solution better than the original thing? I'm only assuming here, but maybe because it won't crash explorer and it's just a few lines of self-documenting code?

Haha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)

The technique could have been made a little more robust by calling GetProcAddress to get the function pointers in Explorer's context, assuming GetProcAddress wasn't itself detoured.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#545

Post by stevemk14ebr »

jaclaz wrote: post #165
coldtea wrote: post #54

Earlier quoted context omitted.

Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments (called payloads) to any Win32 binary. Detours preserves the un-instrumented target function (callable through a trampoline) as a subroutine for us…

Only for the record, there is also easyhook: https://easyhook.github.io/ https://easyhook.github.io/#features https://github.com/EasyHook/EasyHook

And my more sophisticated library, https://github.com/stevemk14ebr/PolyHook_2_0

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#546

Post by grishka »

TheHappyOddish wrote: post #525
grishka wrote: post #269

Earlier quoted context omitted.

Android apps themselves can't run as root. The apps that do perform operations "as root" do so by spawning a shell process running as root, usually using `su -c`. That's on a rooted device. Normally, all privileged actions are done by system daemons that run with appropriate permissions and that apps communicate with through the "binder" IPC mechanism. Those daemons also handle access control — both the regular Andro…

Thanks for the explanatin, I'd never looked into it. > The apps that do perform operations "as root" do so by spawning a shell process running as root, usually using `su -c`. That's on a rooted device. So in a scenario like what we're discussing here (a dev deciding to build an uninstaller their own way), on a rooted device (as per the GP's context of "this coming to Linux and Windows"), the app in question could sti…

An app that has root access can grant permissions to itself. It can as well remount /system as writable and make itself privileged by copying its apk to /system/priv-app

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#547

Post by danbruc »

Arch-TK wrote: post #531
danbruc wrote: post #369

Earlier quoted context omitted.

What happens when you run an executable from a FAT formatted partition under Linux, then I would guess Linux also no longer allow deleting the file while it is running, right? In the end this is a feature of the file system, can you delete open files?

On Linux you can unlink open files even on a FAT formatted partition (I just tried it with busybox). It's actually quite intriguing how this works. When you delete a file on FAT it seems to remove the directory entry, but does not update the free space information and doesn't free the clusters. If you run a fsck.fat on a filesystem in this state, it frees up the space (likewise, if you just let the process exit and u…

So essentially the same as with Ext4, either sans the orphan list or maybe they even store one somewhere so that they can clean up while mounting in case the system crashed.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#548

Post by fragmede »

fragmede wrote: post #213

There was a bug in an uninstaller, once, that deleted all of the files on the disk. Sounds like malware to me!

Someone found a reference to this! Wasn't quite all the files on disk, "just" C:\program files\, but still!

https://arstechnica.com/civis/threads/i-tried-to-uninstall-s...

https://news.ycombinator.com/item?id=37566895

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#549

Post by sim7c00 »

kazinator wrote: post #470
sim7c00 wrote: post #437

Earlier quoted context omitted.

The script doesn't inject. But a lot of malware downloads a script and runs it, so you'd hit another rule.

The way I understand it, the uninstaller program that wants to delete itself doesn't have to download the script from anywhere; it generates the script out to a file.

this is true, a good heuristic would see the difference perhaps. but malicious scripts can also be generated rather than downloaded (or more commonly decrypted from some seemonly random data) so it can be hard to tell, especially given threat actors having access to security products easily while the opposite is not always true.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#550

Post by sim7c00 »

Arainach wrote: post #503
dmazzoni wrote: post #477

Earlier quoted context omitted.

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior? What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk? It just feels like a different hack to me. Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it…

There is never a good reason to inject code into another process - particularly a system process. At the point at which you believe this is necessary you are several layers of hackiness deep and should go find a beverage and think over what your actual goal is. As a metaphor: you find the instructions to sweep your floor cumbersome so you reprogram your neighbor's Roomba to come clean your floor. Sure, it may well go…

security products have valid reasons, though maybe not _good_. forcing plt and got entries to be bound rather than lazy loaded, forcing certain segments to be read only and hooking a bunch of stuff is neccesary for them, and that can only be done by suspending processes at startup and then injecting and modifying them. its a bandaid to a bad system hence its a valid but maybe not good reason (better to prevent than this cure of theirs..)
Post reply on HN