Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Any sufficiently advanced uninstaller is indistinguishable from malware

devblogs.microsoft.com

Post reply on HN
Print view View original

471–480 of 556 posts

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#471

Post by yrro »

jjgreen wrote: post #457
Matl wrote: post #415

Earlier quoted context omitted.

> On Unix/Linux land the prevalence of pipe curl to bash type installers is not much different. This is a problem but only if you install software on Linux by manually going to the project page and copy-pasting whatever curl they have there, I think the difference is that mostly you're encouraged to go the package manager route, whereas on windows downloading .exes directly (ala the curl example) is the norm.

Actually no, the problem with curl | bash is that it can be detected on the server, so if the server is compromised, it can serve you malware and you will never know about it . It is safe(r) to curl > file, inspect the file, then execute it under bash.

The result of inspecting such a file is usually a series of disgusted shudders, "this will do WHAT do my machine"?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#472

Post by jjgreen »

yrro wrote: post #471
jjgreen wrote: post #457

Earlier quoted context omitted.

Actually no, the problem with curl | bash is that it can be detected on the server, so if the server is compromised, it can serve you malware and you will never know about it . It is safe(r) to curl > file, inspect the file, then execute it under bash.

The result of inspecting such a file is usually a series of disgusted shudders, "this will do WHAT do my machine"?

Sometimes a smile at the clarity and simplicity of the authors shell code, sometimes.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#473

Post by darkclouds »

sim7c00 wrote: post #432
thombat wrote: post #422

Earlier quoted context omitted.

It's more about how it does it: injecting executable code directly into the stack so that some other code unwittingly transfers control to it. Stack-smashing is a lot more malware-ISH than a few lines of shell script.

They inject something into Explorer. I would assume that to be some DLL that is injected? ---- Neither code injection nor detouring is officially supported. I can’t tell who did the detouring. Maybe somebody added a detour to the uninstaller, unaware that the uninstaller is going to inject a call to the detour into Explorer. Or maybe the detour was injected by anti-malware software. Or maybe the detour was injected b…

>I can’t tell who did the detouring

I was thinking hmm and so it continues that game of whack a mole.

If a new OS could be designed from scratch, there must be a way to prevent this sort of stuff.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#474

Post by _23sd »

mschuster91 wrote: post #294
TheNewsIsHere wrote: post #279

Earlier quoted context omitted.

I would also like this option. I see why Apple finds it undesirable though. Software installation safeguards are a game of whack-a-mole with (e.g.) support scammers who ask grandma/Lee-in-accounting/Cindy-next-door to naively click through all the warnings. The closest Apple comes to this capability is achieved via device Supervision and MDM, which might be comfortable for some of us here in this forum but obviously…

> Baddies keep ruining all the fun for the rest of us. IMHO the blame rather lies with our politicians who are unwilling to take the steps necessary to cut the baddies off from the Internet. Let's see just how fast India, Pakistan, Turkey and other scammer hotspots clean up their act when the US+EU threaten to cut them off from the Internet and SS7 unless the scam callcenters are closed down for good... the amount of…

I’m more than a little skeptical that scams would be less of a problem if specific countries cracked down on large operations. For one thing it’s not clear how you’d ever get the whole world on board. Pressuring India is hard enough, try Myanmar, a place that doesn’t get along with the West at all and is already a hotspot for phone scams targeting Chinese speakers. And if centralized, relatively open operations overseas were no longer possible, it would likely become more like other types of fraud run by local gangs. So I’m all for pressuring India to crack down on scammers, but I don’t see how that would reduce the desire to tighten software controls on PCs.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#475

Post by xp84 »

ChrisSD wrote: post #445
sim7c00 wrote: post #428

Earlier quoted context omitted.

Haha, well fair enough the crash is bad indeed, good point! This isn't intended behavior though and presumably, it doesn't crash on in cases of this technique being implemented in uninstallers. (a bit of a guess i admit!)

The fact it injects into another process means they can't know if it'll crash or not. You're just one Explorer update away from things changing enough for the hack to crash it. I guess they could do this more robustly. I.e pause the entire explorer process, save all its state, remotely allocate new memory to inject their code, remotely create a new thread, run only that thread using the injected code, restore all the…

Agree completely.

I would have assumed (naively?) that they could just copy their uninstaller into a temp folder and run it from there, and just rely on the OS to nuke it in due time, but as a consumer I appreciate the thoroughness of an uninstaller that leaves no trace.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#476

Post by sparkie »

pie_flavor wrote: post #304
jcarrano wrote: post #299

The guys at MS are smart enough to decompile assembly but still not enough to have a proper inode-based filesystem where you can delete files that are in use.

Allowing you to have inconsistently valid data, where a file can both exist and not exist depending on who's asking, is the opposite of smart.

With proper capabilities (the correct way to do security), this is just normal. If you don't have the capability, the object does not exist. Capabilities can be revoked at any time too.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#477

Post by dmazzoni »

kazinator wrote: post #413
sim7c00 wrote: post #399

The author says the binary looks like malware because it self-deletes, sleeps and touches this uninstaller thing. But the script he proposes, which would be triggered by this same thing, does the same. I am ignoring the injection thing since he guesses at it (likely correct) and also because, lots of things inject into processes without being malware. (monitoring stuff like AV etc.) Additionally, binaries which termi…

The .js script isn't injecting code into another program in order to deletee itself; it is deleeting itself directly. It can do that because, I'm guessing, the file isn't open; the run-time isn't executing instructions from that file. The file was read, the content compiled into memory, and closed. The script is deleting its source code, not itself. What actually deletes the script itself is the garbage collector in…

Is the behavior that a running .js script is fully loaded into memory and the file doesn't need to exist documented, supported behavior?

What if, hypothetically, the system was suspended in the middle of script execution, and the resume function was designed to reload the script from disk?

It just feels like a different hack to me.

Also - trying 20 times and pausing 500 ms seems wasteful. What are the chances that it's going to succeed a subsequent try if it fails the first try? Why not catch the error message and only retry for errors that have a plausible chance of succeeding if you retry?

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#478

Post by sebazzz »

Spivak wrote: post #454
sebazzz wrote: post #375

Earlier quoted context omitted.

It has also failed enough times for me, but luckily it often works like "on error resume next" do the package manager doesn't get stuck in a bad state. Regardless, installation on Linux is often just dropping some files somewhere and perhaps a modprobe. In Windows you have so many things you can do: filesystem, registry, COM registration, GAC, file associations, etc.

It's not really that dissimilar. People like to act that Windows is so complicated and convoluted when in time the Linux desktop has invented all the same concepts. registry -> dconf com registration -> dbus objects gac -> shared libs file associations -> dconf settings windows scheduler entries -> systemd user session

Right, but most of these entries are still (1) only files or (2) are almost never touched by most packages.

And the GAC isn't really comparable, perhaps WinSxS is comparable, but the GAC requires a specific API and isn't a matter of just dropping a file in /usr/lib.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#479

Post by WorldMaker »

delfinom wrote: post #311
mariusmg wrote: post #305

Earlier quoted context omitted.

> with a fairly steep learning curve and a ton of "tribal knowledge" Yes, people preffer to debug their own code rather than spend shitload of time to understand Wix/MSI. Microsoft deciding early on to not produce low cost tools for Windows Installer also didn't helped with the adoption.

The joke is, Microsoft devs even now use NSIS for things like VSCode rather than deal with MSIs lol But there is the modern implementation of AppX Bundles which was later extended to create MSIX which allows app distribution without the windows store. There are still drawbacks to using MSIX usually because you want to touch Windows in ways you can't inside the sandbox.

To my understanding, MSIX today supports the full MSI catalog and will do entirely unsandboxed (unattended [0]) installs if you want it to. But you need to understand all the same complexity of MSI to build installers in it. The biggest remaining difference MSIX and MSI is an MSI is a strange nesting doll of ancient binary database formats that is tough to build (which is why WiX exists and is part of why WiX is so complex) whereas MSIX is "just" an ordinary ZIP bundle of your files plus XML manifests. With the final punchline being that those XML manifests have yet another dialect from WiX's ancient MSI-database-influenced XML and of course it also isn't as simple as deleting the WiX compiler and just zipping a WiX project.

In my experience, you can pretty easily write the nice sandboxed MSIX manifests by hand, it's not too bad, but general MSIX doing weird MSI things you still want better more expensive tools to build them (and of course Microsoft themselves still don't exactly provide that and will point you to plenty of expensive third party installer studios for options, many of which are the exact same ones people have been overpaying for decades).

[0] The one complaint I'm aware of is that you can't do custom installer UI and "attended" installs with user choices. There's one MSIX UI and it is barebones but acceptable. That's all you get.

Re: Any sufficiently advanced uninstaller is indistinguishable from malware

#480

Post by WorldMaker »

mavhc wrote: post #435
EvanAnderson wrote: post #292

Earlier quoted context omitted.

Windows has had an installer as an OS component since the late 90s (called Windows Installer). As a sysadmin I'd prefer apps use it. Many application developers do not. It's maddening. (Doubly so when Microsoft themselves don't use it-- newer versions of Office, Teams, etc. Microsoft suffers from too much NIH.) I get unattended installs and uninstalls "for free" when well-behaved applications use Windows Installer. P…

As soon as Office 2007 didn't use MSI the format was doomed. I assume the Here in NIH refers to an individual team, not MS as a whole. Teams is entirely NIH https://github.com/Squirrel/Squirrel.Windows for updates to the Electron app. I would use winget, but MS made it weirdly hard to run as a script on multiple computers, it installs per user, because... who knows. So still using chocolatey

To be fair, Squirrel came from GitHub and early Electron before Microsoft bought GitHub, so it wasn't Microsoft's NIH that built Squirrel originally.
Post reply on HN