Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FlightSimLabs Alleged Malware Analysis

medium.com

Post reply on HN
Print view View original

41–50 of 62 posts

Re: FlightSimLabs Alleged Malware Analysis

#41

Post by exabrial »

Someone1234 wrote: post #30
lima wrote: post #26

Earlier quoted context omitted.

Not on Windows, but on Linux it's encrypted with your account password (it uses the Gnome Keyring/KDE Wallet APIs). But none of that is going to help against an attacker with the same permissions.

If that's the case that's a choice Google made. Windows via the CryptProtectData API[0] allows you to protect data via the user's session just like the Gnome Keyring/KDE Wallet. But as you pointed out, another process with the same privileges can decrypt it making it pretty pointless in both cases. Only way to securely do it is to prompt the user for a decryption key each time they open the browser which has usabilit…

So Windows doesn't have an equivalent of OSX Keychain, where an item can have a per-application ACL? [or I have misunderstood the OSX Keychain]

Re: FlightSimLabs Alleged Malware Analysis

#42

Post by yjftsjthsd-h »

tutts wrote: post #23
yjftsjthsd-h wrote: post #18

Earlier quoted context omitted.

Well yeah. The appropriate reaction here is to assume that the company is shipping malware in the product regardless of what particular format.

Sure, but what of significance has changed? Every time you run a program, you're trusting the developer not to do nefarious things like reading your Chrome credentials, because the only assurance you have is the developer's word about what the program does. As far as I can tell, that hasn't changed at all. I'm not saying this is okay - there are reasons why this is a bad thing to do, I just don't see how no longer be…

There is a difference between "developer could hypothetically do bad stuff" and "developer has been caught doing bad stuff"

Re: FlightSimLabs Alleged Malware Analysis

#43

Post by HHad3 »

exabrial wrote: post #41
Someone1234 wrote: post #30

Earlier quoted context omitted.

If that's the case that's a choice Google made. Windows via the CryptProtectData API[0] allows you to protect data via the user's session just like the Gnome Keyring/KDE Wallet. But as you pointed out, another process with the same privileges can decrypt it making it pretty pointless in both cases. Only way to securely do it is to prompt the user for a decryption key each time they open the browser which has usabilit…

So Windows doesn't have an equivalent of OSX Keychain, where an item can have a per-application ACL? [or I have misunderstood the OSX Keychain]

Correct, Windows does not have per-application identities that could be used with a keychain service. Furthermore, every application in your Windows session (unless sandboxed) has access to virtual memory of other applications in the same session.

On macOS, applications address spaces are isolated and code signing certificates are used for identifying application requests to the keychain.

Re: FlightSimLabs Alleged Malware Analysis

#44

Post by taneq »

bunderbunder wrote: post #28
zelon88 wrote: post #10

I never understood the point of DRM. "10 extremely determined people want to steal my intellectual property! I'll go miles out of my way to design this in such a way that 1,000 people have a crappy experience to slow down the 10 people who want to be pirates!" Vendor makes a shitty product Pirates find a workaround, pirate shitty product anyway Vendor makes shitty product even shittier for all 1,000 people to agin tr…

There is a different philosophy of DRM, maybe less well-known because it doesn't tend to produce newsworthy examples, that says that the goal is to provide just enough of a nudge toward paying for the product that you're not operating completely on the honor system. Under this approach, you really only want to make pirating the software just a little bit less convenient than paying for the software for most users. Be…

> The point is that hopping a turnstile is just a bit more of a hassle than fishing your transit card out of your purse. Just enough more that most people would rather do that.

I don't think it's even that it's more hassle, it's just a reminder of how things are meant to work. Most people will do the right thing voluntarily once their attention's been brought to it. Sort of like the courtesy lock on a bathroom stall - it's not to physically prevent entry, it's just to indicate that entry would be impolite.

Re: FlightSimLabs Alleged Malware Analysis

#45

Post by jnbiche »

ikeboy wrote: post #32
GCU-Empiricist wrote: post #25

Earlier quoted context omitted.

It still baffles me. You can't stay even moderately up to date on technology news, without knowing that initiating a security breach, even on someone who has stolen your product, will still be criminal.

Just have the user agreement state that if you pirate it, you allow them to exfiltrate all data on your system.

Yeah, not sure if you're being sarcastic, but if not: the law doesn't work like that. You can't annul a criminal statute simply by including a clause in your EULA.

Re: FlightSimLabs Alleged Malware Analysis

#46

Post by ikeboy »

jnbiche wrote: post #45
ikeboy wrote: post #32

Earlier quoted context omitted.

Just have the user agreement state that if you pirate it, you allow them to exfiltrate all data on your system.

Yeah, not sure if you're being sarcastic, but if not: the law doesn't work like that. You can't annul a criminal statute simply by including a clause in your EULA.

If someone signs a contract allowing you to do something you're generally allowed to do the thing, with exceptions.

Dropbox uploads data from your computer on to their servers, which would be illegal had you not agreed to that as part of signing up and installing the software.

Re: FlightSimLabs Alleged Malware Analysis

#47

Post by coldacid »

tutts wrote: post #14

"How do we know that FSLabs don’t use this, just because they say so?" How do you know the main executable doesn't do the same thing? How is trusting them not to run this .exe different from trusting them not to secretly implement this functionality in the actual program?

Once they ship malware in any one form, anything else from a developer is eternally suspect. Even if they don't do something like this in their apps' main executables _now_ doesn't mean they won't in the future.

Once a company pulls shit like this, they are dead to me, and they should be dead to everyone else as well.

Re: FlightSimLabs Alleged Malware Analysis

#48

Post by bubblethink »

lima wrote: post #26
exabrial wrote: post #12

The passwords aren't protected somehow from copying?

Not on Windows, but on Linux it's encrypted with your account password (it uses the Gnome Keyring/KDE Wallet APIs). But none of that is going to help against an attacker with the same permissions.

selinux can help in some of these situations (not saying it will necessarily in this case). Generally speaking, the browser context is not allowed to read user private data like ssh keys. However, since the browser context in this case needs to read passwords, it doesn't apply 1:1. You probably need a different context from the general browser context that can read password data.

Re: FlightSimLabs Alleged Malware Analysis

#49

Post by maze-le »

ikeboy wrote: post #46
jnbiche wrote: post #45

Earlier quoted context omitted.

Yeah, not sure if you're being sarcastic, but if not: the law doesn't work like that. You can't annul a criminal statute simply by including a clause in your EULA.

If someone signs a contract allowing you to do something you're generally allowed to do the thing, with exceptions. Dropbox uploads data from your computer on to their servers, which would be illegal had you not agreed to that as part of signing up and installing the software.

The difference is that Dropbox is only allowed to access those files I tell it to. If the Dropbox client would start crawling my filesystem for 'password.txt' or 'banking-tan.list' this would be illegal, no matter what clause is written in the EULA.

Re: FlightSimLabs Alleged Malware Analysis

#50

Post by ikeboy »

maze-le wrote: post #49
ikeboy wrote: post #46

Earlier quoted context omitted.

If someone signs a contract allowing you to do something you're generally allowed to do the thing, with exceptions. Dropbox uploads data from your computer on to their servers, which would be illegal had you not agreed to that as part of signing up and installing the software.

The difference is that Dropbox is only allowed to access those files I tell it to. If the Dropbox client would start crawling my filesystem for 'password.txt' or 'banking-tan.list' this would be illegal, no matter what clause is written in the EULA.

On what basis are you differentiating between agreeing to something that allows then to access your stuff, and "telling it" to access them?
Post reply on HN