Hacker News Reader

Comment by tyho | Hacker News Reader

I guess substituting the existing file served at that URL with a curl that when called by the particular malware in question (I guess you could detect this fairly easily) warns the user graphically of the infection would be considered going too far.

View on HN

I'm not even sure you could reliably detect that - the article says they didn't have any special/identifying headers. But yeah you're right if they could detect then supplying an exe that warned the user would still feel sorta weird IMO, and how many users are likely to trust a random popup or notification seemingly from out of the blue?

There are "indicators of compromise" listed at the end of the slides. So you could use that. But that's not curl's job... disabling some old versions by changing the url is more than enough in my opinion.

They don't need to trust it - the fact it is there is a good enough indicator that the machine was compromised. :P

Detect the malware in the binary served by the webserver when running on the infected machine, not on the webserver. i.e. always serve the `compromised` binary for that URL.

Detection would wind up being an arms race, I expect; if you were going to do this, better to replace it with an application that just does the warning, with a hint for valid users blindly downloading.

Of course, then there's checking MD5s, etc.

I would be more evil, I would make a custom version of curl package that randomly corrupt bytes only served to this malware.

Let the malware developper have fun debugging this issue.

You would not end up wasting any time of the malware developer, as the article states:

"an updated version of the malware comes bundled with the curl library"

It would be more like, "let the script kiddies using this tool shrug their shoulders when it stops working and switch to another (of which there are legion)."

How could you even tell the user that. The average user doesn't know what curl is so all they'd see is:

"!!!! Your computer is infected with MALWARE download this software now! !!!!"

Reply on news.ycombinator.com