Adware Is Malicious, and It Uses Advanced Techniques to Infect
sensorstechforum.com
sensorstechforum.com
Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook.
Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!"
Telemetry/analytics/arbitrary callbacks used to be shady/questionable and require user consent, now it's standard practice to exfiltrate whatever you want from user devices. You've got root/elevated privilege, encryption is easy and your traffic can easily blend into the haystack, so why not.
Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout.
Seeing traffic from anonymous VPNs logging into financial accounts used to be an obvious giveaway of something suspicious going on. Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for and route all of your device's traffic through god knows where, which has the effect of making your traffic indistinguishable from a fraudster's.
Popular email clients, budget analysis and social media platforms will solicit and cache third-party credentials for your employer, your bank, or your life if you provide them. This despite a decade of trying to beat "never give your password to anyone!" into the popular mindset.
Same with algorithmically-generated domains/subdomains, etc.
It's surprising to me how rarely even reputable companies provide hashes/signatures.
I just downloaded a Windows virtual machine that MS offers for free[1].
No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads.
(MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location)
I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO.
[1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/v...
[1] https://download.cnet.com/HashTab/3000-2094_4-84837.html
[edit: typo]
Call me cynical, but this is what I expect to see if a government had ordered them to allow certain forms of interference with the OS. I don’t know enough to eliminate any other possibility, but it certainly smells fishy.
If there was a bug where the ubuntu website could force your browser to display https:// and serve content over http without a warning you would have most definitely heard about it before now.
As to why most mirrors serve over http, it's for the same reasons presented here: https://whydoesaptnotusehttps.com/
I believe your link does not explain why Ubuntu’s .iso files are not on https, as one of its justifications is that APT uses other mechanisms for integrity checking, which doesn’t apply to OS installation disk images.
Also grandparent's link states
>HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting
Which is untrue. An attacker can't tell which specific packages are being downloaded, which could be important depending on your threat model.
(The argument can be made size of DL leaks info, but that's a lot of work, and multiple packages could have same size)
I'd argue VPNs are increasingly tablestakes as consumer ISPs adopt darker patterns like tag injection. (Recently discovered this in the wild with my new residential ISP.)
It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.
Then came Google and everyone just surrendered their stuff voluntarily anyway.
I think sometimes the player just changes, and then users and media accepts the new reality.
With the number of data breaches by credit reporting agencies, Facebook is the least of your worries.
Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!"
With iOS, the amount of damage an untrusted binary can do is extremely limited.
Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout.
Sleazy billing has been a thing since Columbia House.
Two variants in particular, known as DealPly and DealAlpha use advanced persistence mechanisms that you'd find in APTs to make themselves nearly impossible to catch and remove.
The other risk is the advertising network itself that delivers the advertisement. Exploit kits have been using comprised advertising servers to deliver the exploit and compromise hosts since adware exists. These servers rarely have good security and the companies owning them generally don't care much. I even suspect that some willingly participate in the distribution for financial gain.
While doing forensics for a client a few weeks ago, I found what appeared to be a state-sponsored APT being delivered by a program bundled with adware.
I'm really upset with open source projects like FileZilla willingly serving bundled crap to its user downloading from the official website to finance itself. They're putting millions of computers at risk.
https://foxitsecurity.files.wordpress.com/2015/12/foxit-whit...
Do non-tech savvy people still have a reason to install software? Don't most people just need a web browser?
There are a bunch of well SEO'd sites that will come up if you google nearly any computer issue that will appear to have a solution, but step 3 is usually to try installing some software.
(For example, if you google "can't delete file windows" this site will come up. I don't recommend installing the software https://www.easeus.com/partition-manager-software/delete-fil... ) Here's a discussion on MalwareBytes forum about it: https://forums.malwarebytes.com/topic/166526-easeus-partitio...
No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake. (And they're searching for device drivers because they have a printer problem and they don't realize that the need to install a custom driver for a name-brand current printer on Windows or MacOS is very very rare)
It is amusing to me that you mention Canon, since they're one of the worst offenders I've dealt with in this regard. During the change from W98 to Win7, they cut off support for whole product lines. My scanner, purchased just a few years ago, was now useless. My Linux box had better driver support than my shiny new Windows box.
It was unbelievable that my scanner was no longer functional, and I was willing to try some hacking to try to get it functional again...
So... I understand especially why people are looking for drivers. They're looking to extend the value of their purchases.
That's interesting. It starts talking about different ways to try to delete a file, and at the end it recommends that software and gives instructions to wipe partitions with it. Did I misunderstood that?
> No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake.
Does Windows still not have package repositories like Linux distros do? Installing software from anywhere other than official repos should be an obvious no-no if repos simply existed.
Yes, of course. And If you must get the custom software (for example I like the value-added software for my Fujitsu document scanners with sheet-feeders) then the ONLY thing to do is to go to Fujitsu's official site--after making 100% certain it's really the site--and getting it from there.
Luckily, most of the time, you don’t need printer drivers for consumer printers for Macs. They mostly support AirPrint.
See: https://www.cultofmac.com/415565/how-to-eliminate-the-adware...
And no, you don't generally need to install printer drivers on Windows from anyone other than Microsoft via the update or the new-hardware detection.
You definitely don't have to worry about whether a new printer already has a driver distributed by Apple.
https://support.microsoft.com/en-us/help/4015386/windows-10-...
https://www.drivereasy.com/knowledge/solved-printer-driver-i...
People will ignore the giant red warning Windows gives you and install it.