11–20 of 112 posts
Earlier quoted context omitted.
I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.
> Interesting to note that another system, also a sister, seems to have caught the same, and I can't recall ever having run anything but VirtualBox VMs on that one, it's turned off right now until I figure out a recovery plan, so at least 2 systems to recover, and have one clean one to do so from.
That said, it could easily be explained if SSH private keys weren't encrypted (passphrase protected) and allowed an easy hop from infected to sister. And if somebody is running Firefox as root, it doesn't seem too extreme to assume they might have unencrypted private keys...
So it may just be from running Firefox as root, but it's still possible it could be from other things.
But it's still interest that they bother with making ransomware the first place for Linux.
Earlier quoted context omitted.
I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
1. when pages don't work at all, try looking for cloudflare links. They might have their JS and CSS hosted there
2. When you want to play videos or audio look for *cdn domains (aliexpress has alicdn for example). These ones I tend to add to my whitelist.
3. If you have something like google apis you can add it to the whitelist and add a sitespecific conditional in adblock or ublock.
Earlier quoted context omitted.
I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
I started blocking all JS by default for security, but I've actually found it to be a much better user experience as well. You deal with the annoyance of having to whitelist domains, and sure a lot of SPAs don't work at all until you enable JS for the client-side rendering, but many, many websites work far better because all the content I care about is server-side rendered and JS is used to load ads that disrupt the experience (this is especially true on mobile. For that I highly recommend the Brave browser). You'd be surprised how much better it can make parts of the web tho to have no JS :-)
Take the data you can recover offline and then reinstall from scratch. Don't try to fix it, just recover what you can and throw the rest away.
Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?
Or maybe that was not the source of the infection, just ssh enabled with a weak password
Earlier quoted context omitted.
I assumed that was implied for every HN reader. But even though I have noscript and ublock with a lot of things blocked you never have 100% coverage.
People claim to run noscript but every page calls js from 10 different domains. How on earth do you navigate what to let through and what to block? And at some point, to me, it’s just too many mouse clicks!
The uMatrix UI makes managing this a lot easier.
Nice read but nothing particularly special here and it happened months ago. The title is alarmist. TL;DR: The user ran firefox as root and the attack happened through adobe-flash. Hardly a sophisticated attack.
If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.