Hacker News Reader

Comment by joshstrange | Hacker News Reader

It's not clear from the article (or maybe I'm missing it) but this isn't a vulnerability with PS right? The article would be the same if it "New Brazilian Banking Trojan Uses PHP", it's just a language/style that is new not what it is doing or how it's doing it AFAICT.

View on HN

Yes. It seems the user executes an attachment that's a PIF file (a type of shortcut file) that writes out a PS script to the temp directory and executes powershell.exe to run it. The point of highlighting PS in the article appears to be that previous distribution of this malware used a different mechanism, not anything wrong with PS itself.

As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry.

By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.)

[0] https://securelist.com/blog/research/74325/the-evolution-of-...

It took a while for powershell to be installed on most computers. It's still certainly missing on many computers (i.e. the oldest and most vulnerable).

I actually don't know whether it is installed as default in the latest Microsoft OS and patches.

That and the very easy way to analyse/reverse engineer scripts don't make a great candidate for malware.

Anyway, the windows shell is enough for trivial scripts, and one might as well write software in a real programming language for the rest.

It's been installed by default since Windows 7 and PS v2. The only version that wasn't installed by default with a Windows release was PS v1 (introduced at the same time as Vista).

Yep. There's nothing about PowerShell in particular that enables this attack apart from being able to execute code. Granted, it can do a bit more with the system than cmd could, but that's about it.

Reply on news.ycombinator.com