A glimpse inside CryptoWall 3.0
blog.brillantit.com
blog.brillantit.com
> And stopping: Windows Security Center Service Windows Defender Windows Update Service Windows Error Reporting Service and BITS
Won't these actions require administrator privileges? How do the program escalate its privilege if it starts by user clicking on a js file?
http://www.pretentiousname.com/misc/win7_uac_whitelist2.html
If UAC is set to Medium (the default).
If you're serious about security you should set it to High.
I don't know what OSX does, but it seems like I'm prompted to escalate far less often than I would be on a high UAC system. How do the requirements compare?
Source: I work for a hosting company with lots of WordPress sites.
[1]: In my experience, there's lot of purposely back-doored, or easily exploitable themes and plugins. Also, let's not forget that users and/or developers often get these illegally (without even knowing they did it; it happened a few times).
[2]: The entry barrier for PHP/WordPress is extremely low and many of these developers are beginners and lack even basic understanding of security or even how things work; they base stuff off from an overly-simplified tutorial written by someone only slightly more experienced than they are. There are also inherent language and CMS issues here, but I won't go into those.
[3]: We actually have users who don't to update WordPress or any of the plugins for ages. AGES! The other day, I had to argue with a client why having a WordPress version from 2006 (something from the 2.0.x release series) is a bad idea. This is either because the developer stopped supporting and abandoned development of some component their site depends on, or because of legacy custom-tailored code that was a once-off purchase.
We now scan for egregiously out of date WordPress installs and warn customers that their site will be at risk of being disabled if they don't upgrade to the latest version. If after a couple of days we see no action then we pull the site.
If we detect sites serving dodgy links then they're instantly shut down until the customer can prove they've secured the site.
In 99.9% of cases our customers are happy we do this because they're mostly businesses and serving malware damages their brand and reputation. We do get the occasional user who refuses to co-operate, and if they do we serve them notice to take their business elsewhere.
We have a similar approach to this actually. The exception being that we clean the malware ourselves, sadly. I tried to say is a bad idea multiple times, but no luck. What makes things worse, we have a few "spoiled" clients that keep getting their websites hacked (there's 3 such WordPress and Joomla development resellers) and they started expecting us to clean their websites. Sigh
Also, I tried to argue a few times that we do the scan-and-warn thing, but I got turned down with the counter argument that it would generate more backscatter on our support department than it would be worth it.
Flash and other plugins are a completely different thing. Running flash is not a core functionality of the browser. Making HTTP requests and rendering HTML is.
Browser vendors have already inserted themselves into this role by selectively blocking Flash, messing around with how certificates are presented by the browser to imply certain things ("green lock == safe") when no such implication can be made, blocking and/or allowing ad blockers, etc.
Maybe you're too young to remember when everyone had to update their Flash installations every week because that product was improperly sandboxed, so you think that the issue was purely battery related. Blocking and restricting flash is as much about security as battery, more-so in my opinion.
But OK, let's compromise -- rather than preventing connections to Wordpress sites, maybe they could draw a big red line through a picture of the Wordpress logo, and then perhaps warn the user that this site is or soon will be serving malware.
If you'd read my reply, you'd see I addressed this point.
> Maybe you're too young to remember when everyone had to update their Flash installations every week because that product was improperly sandboxed, so you think that the issue was purely battery related. Blocking and restricting flash is as much about security as battery, more-so in my opinion.
Yes, it is. And again, I addressed this in my post. I suggest reading it and responding to the points made. The key is the core functionality of the browser, of which the plugin API is not.
As for TLS, the CA system is completely broken. I wish we had something better. Given that we don't have anything that squares zooko's triangle that's likely to get uptake today (I don't see namecoin having reached a state where it's ready for large-scale deployment), I wonder what you'd like to do there instead?
The "green lock" EV stuff is clearly a racket. Browser vendors shouldn't put stock in it, but they do. I don't see how that's an argument for refusing to render HTML they don't like.