Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You’re infected—if you want to see your data again, pay us $300 in Bitcoins

arstechnica.com

Post reply on HN
Print view View original

251–260 of 295 posts

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#251

Post by im3w1l »

Wingman4l7 wrote: post #182
ggchappell wrote: post #98

I get annoyed when people are warned not to open some attachment. The real problem here is that in 2013 we're still using the flawed language of "opening attachments" -- as if running a native executable with full permissions is an action that belongs in the same category as viewing an image, reading a text file, or listening to music. Well, it doesn't. This is a problem that should have been solved at the level of O…

We only use that language because it's an order of magnitude easier to explain to novice computer users, and because as you stated, the problem still hasn't been fixed at the OS permissions / UI level. A modern OS lets us do that because lots of users are the sole user of their PC and do not understand the idea of permissions.

People understand that webapps are safe, because they have less permissions.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#252

Post by keeperofdakeys »

Pxtl wrote: post #169
keeperofdakeys wrote: post #142

Earlier quoted context omitted.

No, it's a required security feature that goes back decades in some operating systems. You need to be able to trust the code that runs on your system, and to do that you want to ensure only admin can install things. Of course, Windows has now partially solved that with UAC. Unfortunately you can never know if you can trust the software or not though. However this does stop malware from secretly running without your p…

Yes, but UAC has the same weakness as Linux permissions - it only protects the OS and programs, not the user-data. Programs can screw with userland data all they like without user permission.

The point is that UAC will (hopefully) prevent installing untrusted code in the first place, there by preventing those types of attacks. Unfortunately, you have to either trust that the user knows what programs are good, or go down the dark road that leads to things like an app store.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#254

Post by Pxtl »

pgeorgi wrote: post #215
venomsnake wrote: post #186

Earlier quoted context omitted.

Yeah but ... in Linux at least you have to set +x yourself on the downloads. Which is basic sanity check. In windows there are too many ways to get elevated. And only one level of elevation.

not as if users care about watching out before setting +x. After all, there are tons of popular projects requesting users to run "curl http://.. . | sudo sh" and consider that a good idea, too.

Exactly. This is just a more elaborate form of Windows little pop-up-boxes asking you "are you sure you want to...."

I keep trying to teach my nephews that the default answer to that question is no... but of course, "yes" is the way you get anything done.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#255

Post by FedRegister »

tracker1 wrote: post #204
shanselman wrote: post #129

Earlier quoted context omitted.

Unfortunately lots of stuff runs under there including, but not limited to: GitHub for Windows and dozens of apps it installs in there F.lux Anything installed with ClickOnce Chrome GMVault Xamarin's Android Support Markdownpad SkyDrive Join.me Assuming that everything in there is a virus is too much, I think.

I would think that .Net portable apps are likely also per user executables.. not to mention that there are usually at least one scripting environment even on windows cscript/jscript/vbscript/powershell for example, not to mention Java, Python, Ruby and/or node may be installed.

ClickOnce apps are as well. We get bit with this every day because our main desktop app is distributed through ClickOnce.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#256

Post by FedRegister »

Pxtl wrote: post #168
Silhouette wrote: post #105

Earlier quoted context omitted.

Doesn't Google Chrome run under %AppData% in a default (non-MSI) install? Yes, and from a security point of view it should be treated as hostile accordingly. There is no need to actively circumvent Windows security like this. Firefox, among many other examples, is quite capable of automatically updating itself using a proper Windows service mechanism. It's long past time that Google were called out on this one. Not o…

Installing into %AppData% is, iirc, Microsoft's intended approach with ClickOnce installers (which Chrome uses). The difference is that ClickOnce installers have a far more restrictive permissions model than old MSIs. ClickOnce-installed applications are limited to "Internet Zone" permissions. This can make them immensely frustrating to develop with, actually, since many of MS's own development frameworks fail misera…

Signed ClickOnce deployments can request elevated (above Internet Zone) permissions. We do that with the ClickOnce app we deploy.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#257

Post by FedRegister »

Silhouette wrote: post #183
AnIrishDuck wrote: post #170

Earlier quoted context omitted.

> This requires a very different model of access control and user/application privileges, and unfortunately I don't think any mainstream OS is even close to solving this one yet. I'm not sure it does require a different model of access control. It just requires people to actually use the access control mechanisms that exist already. You should not access banking details or any other sensitive information in the same…

Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do. On the other hand, if only explicitly authorised applications can create outbound Internet connections at all, and if applications like browsers and e-mail clients need explicit permission to read a gene…

>Your proposal is OK if accessing sensitive information is something you only do occasionally, but it's not very practical to switch users completely if you deal with sensitive information often, which many people do.

    $ sudo -u banking gnucash &
    $ firefox &
Done. My banking files and my Firefox session are now separated.

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#259

Post by linc01n »

elliottcarlson wrote: post #202
hollerith wrote: post #197

Earlier quoted context omitted.

On the contrary, after accumulating a certain amount of karma (500 points??) a user gains the ability to downvote comments (but not stories).

Also, downvoting is only available for a certain comment age. Once the comment is X hours old, you lose the ability to downvote, but can still upvote.

X should be 24 hours https://github.com/wting/hackernews/blob/master/news.arc#L10...

Re: You’re infected—if you want to see your data again, pay us $300 in Bitcoins

#260

Post by dmdeller »

makomk wrote: post #227
dmdeller wrote: post #185

Earlier quoted context omitted.

That would cost $25,600 and require 256 valid Social Security or DUNS numbers.

Alternatively, it would require compromising the machines of 256 Apple developers. Guess what kind of person is likely to be capable of doing that.

Still, it's not as easy as the person I was replying to made it sound.

How many Macs would you have to compromise before you randomly stumble upon a registered developer, let alone a registered Mac developer (of which there are far fewer than iOS developers)? And how much more secure is a developer's machine likely to be, and how much less is the user of such a machine likely to fall for common email attachment-based infection attempts?

At some point, the feasibility is low enough not to bother. That's what all security ultimately is, since nothing is foolproof.

Post reply on HN