Norton 360 Now Comes with a Cryptominer
krebsonsecurity.com
krebsonsecurity.com
It's like asking the carbon footprint of freeway guardrails. I mean, norton sucks, sure but at least turn on defender (which is really good btw). The amount if lives not ruined and money not lost due to cybercrime thanks to AVs alone is staggering imo
I have a challenge for any of you who disagree: write basic malware that you can use to monitor keystrokes and browser creds/traffic. Easy right? Ok, now use it in windows with defender turned on for a day and keep defender from stopping it for a week! Even better if you turn on all defender features.
I mean come on! I heard this misninformation many times before. Not once from a person whose day job is incident response. Not even once!
The amount malware I see stopped by defender alone is very significant. Just write mediocre malware and send email , 10-15% infection rate. Checkout the loot the emoter gang had accumulated when they got raided or any if the ransomware gangs.
A little learning does much harm!
Most people don't run Linux (Aand most Linux desktop users don't harden). I mean, I could be very lazy and make bank without AVs on windows or Mac.
Speaking to you as someone who only discovered several serious intrusions after every layer of security was defeated except defender complained!
http://h4labs.org/ive-got-another-stupid-idea-to-deal-with-c...
People come up with all sorts of silly ideas rather than actually addressing the real issue.
Addressing virus software will save the world exactly 0 days.
UPDATE
Coal usage is at record usage for power generation. It emits over twice as much CO2 as natural gas
while these silly little ideas about optimizing your website to use less electricity or using a different computer language are a fun way to waste the day, all the coal we keep burning is costing us significant time.
Anything else is better. Waiting for the windmills isnt working.
Anyway, just the occasional reminder that we keep squandering valuable time and now we need a bigger miracle.
Good luck with the shaming to address the problem.
UPDATE 2
"Stop all economic growth"
No one said that. That is a right wing sound bite simply meant to add noise to the discussion.
I disagree with doing that even in the most developed countries, I've no idea how you imagine selling that to the least developed countries. Or by force?
However, I agree we aren't really able to do enough - that there's a lot of virtue signalling so we feel a little better about ourselves - and a technological solution is what's required.
To be fair, it actually can — there’s plenty of writable flash on motherboards and in peripherals where malware could persist across OS reinstallation.
And malware is a contraction oh malicious-software.
And then is it not true that malware does, by definition, harm the users experience in someway, whether that’s detectable by the user or not.
Splitting technical hairs is entertaining though.
An extended family member of mine had been planning on replacing their computer because they were having problems logging in to Office 365.
Just because you think people shouldn't behave a certain way doesn't necessarily mean they don't behave that way, though. There are definitely people out there who toss their laptops when they get cluttered with malware
I haven't received install media of any kind from an OEM in over a decade. Commonly they're using a hidden disk partition to reinstall the OS. This can just as easily be compromised as the boot partition. So "just reinstall" skips a number of laborious or impractical steps.
A careful examination of who that "anyone" is will reveal that as "anyone"s go, it's not very "anyone". It's certainly less than 50% comfortable doing that, and even less willing (e.g., I know how but that doesn't mean I want to).
"Before"‽ Windows still sets every file as executable by default (just an example). If it had good security you wouldn't need anti-malware tools always running in the background looking for stuff that has already broken through (to some extent). Basically, Windows security has been and probably always will be absolute garbage.
A big reason why Microsoft won't (and can't, really) fix the security of Windows is backwards compatibility... If they fixed the "everything is executable by default" problem it would 100% for sure break a ton of stuff.
The code base for Windows is both old and enormous. They don't employ enough developers to constantly review and re-write all that code all of the time. Most of it--even today's Windows 10 core code--was written at a time when Microsoft didn't really give a rat's ass about security.
Just look at the past few years of Windows 10 vulnerabilities:
https://www.cvedetails.com/product/32238/Microsoft-Windows-1...
...and compare that to say, Canonical/Ubuntu's list:
https://www.cvedetails.com/vendor/4781/Canonical.html
Looking at last year, in 2021 Ubuntu had 29 CVE-listed vulnerabilities, four of which were "code execution" (the worst).
In that same period Windows 10 had 485 CVE-listed vulnerabilities, 112 of which were "code execution"!
Now consider for a moment that the scope of Canonical/Ubuntu CVE list includes vastly more software than what comes with Windows. I just looked (Ubuntu 21.04) and there's 6,080 packages in Ubuntu's "main" software repository which is what's in scope for those CVEs (I'm pretty sure anyway).
Whereas the scope of Windows 10 is just what comes with the OS which isn't much! If you drill down into the Windows 10 code execution vulnerabilities you'll see that it's all in the core stuff that comes with Windows like the print spooler, media services libraries, remote desktop, file system, etc. It's not obscure extras like bundled games or the snip tool or whatever.
Not much has changed with crypto. Everyone and everything has to go “in” on crypto. Next up! Texas Calculator adds Crypto Miner “Calc-a-Coin”. Buy now or miss out!
Its just waiting for the next crash when people decide they want “out”
All across the world, there are millions of languishing enterprise/educational fleets (generally Windows) administered by a single or a few "IT folks". In my experience, these people are often the only technologically aware people in the organization. This is Norton cutting them in on the grift. Install acclaimed "Norton Antivirus", which is likely already a line item on procurements, mine crypto on the sly for yourself on idle fleets at night, and give Norton a slice of the pie while you're at it.
Nobody's likely going to look twice at Norton running on a machine, we've already collectively conditioned ourselves to think of antivirus software as "slowing the machine down", and as a bonus: unless the next person in is as up to speed as your are, your grift can keep running long after you've moved on.
> Norton Crypto is an opt-in feature only and is not enabled without user permission
> “Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit,” tweeted security researcher Chris Vickery.
Which is unlike a bike rack which if enabled/purchased but never used would be a one time loss. And for some one likely to transport bikes the bike rack would probably be beneficial.
Edit: After doing some calculations for profitability with say the RTX 3070 with a hash rate of 60.5 MH/s and a power consumption of 160 W [0] at both the min and max average US state electricity prices of .1038 $/KWh and .3428 $/KWh respectively [1] is currently profitable with a return of $2.86/day and $1.94/day respectively [2] (ignoring all other costs).
So for some this would be profitable for them with a potential reduction in the lifetime of their hardware.
0: https://www.nicehash.com/blog/post/nvidia-geforce-rtx-3070-m...!
1: https://www.eia.gov/electricity/monthly/epm_table_grapher.ph...
Not everyone has 1) configured their system properly and 2) has the knowledge to avoid dangerous cyber situations.
The 15% mining fee that Norton 360 is charging is a little higher than that.
It's a mistake to focus on Norton in this context. The "correct" way of reading of this headline should be something like "reputable company puts an Ethereum wallet and mining software in the hands of millions of users".
Now imagine if tomorrow Microsoft decided to add a crypto wallet and mining tools to Windows, or Google to Chrome.
If it were all that altruistic then they shouldn't need to collect 15%, give them the miner they could download for free.
The only correct response is "Fuck you Microsoft/Google/etc. You're expunged and I'll never trust you again."
After that it's, your bank doesn't allow you to log on except with an approved device with the security chip.
Then it's, your government imposes misdemeanor charges for not checking in on your COVID quarantine app (which runs only on security-chipped phones). Due to COVID restrictions, your arraignment hearing will be held on Zoom, which in its latest update, only runs on security-chipped hardware.
None of this will seem especially draconian in today's "green bubbles = breakup" society.
People keep saying this as if crypto isn't already mainstream. Exchanges have hundreds of millions of customers. A significant portion of the world has traded crypto. And 99.99% aren't doing anything else with it but speculate.
It's not as if magically bundling a wallet on millions of machines will suddenly cause a bunch of usecases to materialize.
I never said that any single exchange has over hundred million, but rather exchanges combined have hundreds of millions.
(pdf) https://assets.ctfassets.net/hfgyig42jimx/5u8QqK4lqjEgL506mO...
https://markets.businessinsider.com/news/currencies/crypto-u...
But 100m people isn’t mainstream? Coinbase has 73m (mostly American) customers itself, and undoubtedly there are many many more who know of Coinbase but aren’t customers. The Super Bowl commands fewer than 100m viewers. Crypto companies are sponsoring sports teams and stadiums. Matt Damon is doing commercials for them.
You don’t think that’s mainstream?
In the world, no 100m is not mainstream, particularly by its definition, "the ideas, attitudes, or activities that are regarded as normal or conventional; the dominant trend in opinion, fashion, or the arts." Crypto is not normal or conventional yet, traditional money is still dominant; its more a curiosity.
You make a good argument about the superbowl, but parallel your first sentence - viewership was only at the time of, and doesn't account for people present or who watched at a later date (ie., many). It's also been around for decades as part of American culture, maybe crypto will do this eventually. I don't see statistics for coinbase by country, but 73m is their total userbase.