Comment by netule | Hacker News Reader

Comment by netule | Hacker News Reader

Parent Full thread

About a decade ago, I briefly worked for a company with the same business model. Since most Windows installers require Administrator privileges, the DLLs that they side-load will inherit these elevated privileges and can scan the user's machine for anything they are interested in.

The way this software worked (as far as I can recall): The installer bundled a DLL from which only a few minor functions were exposed to display offers within the host process. Usually, the only thing the client portion of this DLL needed was a HWND. During initialization, the DLL stored a copy of itself in the user's temp directory. The host application unknowingly then used rundll32 to load this copy as a separate (also elevated) process. This process would run at least as long as the calling process would. Once in place, the process would scan the user's computer for specific use patterns (geoinformation; MS Office presence; what language; etc.). In order to retrieve the latest advertising "offers", the DLL called home with this information over a secure pipe and checked for updates. This data was stored and referenced if the same user invoked the DLL again at some point. Only at this point would any actual targeted ads be displayed in the client application's window.

Things may have changed since then - these were the pre-Windows 10 days - but if it's anything like this, it's wise to avoid the Unity installer.

> About a decade ago, I briefly worked for a company with the same business model.

The best part is they likely had an EV code signing certificate with instant SmartScreen reputation while all the indie and open source developers are sitting around locked out of the system due to cost and the absolute clown show of security theatrics baked in to the the trust industry's identity verification processes.

> it's wise to avoid the Unity installer

What "Unity installer"? Games nowadays are all distributed on steam / epic / app store / etc.

If you are talking about the editor, this makes no sense they would bundled it up with malware (their target is the games made with it).

I'm not thrill about the announcement at all but there is a lot of unfounded fear.

These platforms still have an install process for the applications which involves the ability to run third party software with elevated permissions.

E.g. for Steam see the Install Script section here: https://partner.steamgames.com/doc/sdk/goldmaster

Of course but if a game has malware the publisher would get insta ban from these platform.

Depends if our definition of malware and Valve, EA, etc.'s are the same.

Pretty much all anti-cheat software meets the definition of malware

They share similarity, but they are still seen as two separate categories of software. The malware discussed above is absolutely not the same as DRM / Anti-cheat that are bundled in most games today and bundling something that is definitely a "malware" will get you kicked off those platform whereas DRM / Anti-cheat is tolerated.

> They share similarity, but they are still seen as two separate categories of software

Malware isn't really a uniform category of software. They can be harmful in a lot of different ways. Something like a kernel level anti-cheat is malware in almost every sense of the name except the developer's promise that it's not doing anything nasty. And there's a long list of DRM that affects the performance, security, or stability of the system while most users aren't aware this is happening or why. They install a game, everything else that comes with it is realistically hidden just like any malware.

So while you could group them in different categories, many forms of DRM are malware in form and function.

What matters here is the definition from those platform on what is considered "Malware". Not our philosophical definition of it.

How would you call a "Malware" as describe above versus a "Malware" DRM / Anti-cheat. There is a clear separation between the two for those platforms.

The philosophical definition is what is being discussed because at the end of the day that is all we have. There is no hard-coded, software-defined definition for malware other than the loose, varying definitions baked into anti-malware programs and services, that are based on our philosophical definition and frequently experience false positives and negatives. Conversely, there are very precise definitions for things like a regular expression or a hash table, but malware isn't like that. To say it is "our" philosophical definition is also a bit farsical -- malware is defined by the corporations that own the anti-malware companies. We don't have much say in what that definition is, in practice.

But sticking with a philosophical defintion, malware is a very fuzzy category, and that line is so blurred as to essentially not be there in the case of anti-cheat programs and services, which effectively spy on the user (malware behavior) for financial gain (having a gaming platform that doesn't have a large number of cheaters) and often employ malware tactics like rootkits, VM detection, process inspection, etc.. Similairly Google Analytics definitely meets the criteria we generally use to define malware (spyware in that case) if you raise the bar a bit for things running in the browser.

I agree to a certain point but what I'm trying to say is that you can embed google analytics in your games and it won't get banned from steam, but if you add some kind of software that install popup ads whenever you boot your computer, you will get banned.

No matter how we define those at the end of the day there is a difference between them, so maybe "malware" is the wrong word here as this seems to irk many, but seeing all the replies that group DRM / anti-cheat / analytics / ads (interstitial) and malicious software that get sneakily installed to add toolbar / popups to a computer all being grouped together as one and the same is just wrong because in the practical world those companies makes a clear distinction between them.

So my question is, if the correct word is not "malware" to uniquely specify that subset of software that is clearly banned from those store and won't at large also includes stuff that are OK like analytics. What is it?

Personally, in the real world, I would never specify something like analytics or ads (interstitial) as "malware" (even if philosophically they are) because to me, the way I've seen it used was to identify software that get sneakily installed and add malicious stuff to the user's computer (popup / toolbar / crypto mining).

DRM / Anti-cheat, even tho they are "bad" (I get that), are not going to suddenly start showing ads popup (and if they did and they totally can, the stores would banned those games and would classify it as malware not just DRM).

Making a word too broad means we loose the meaning. There has to be a specific word that describes the exact type of software that I am desperately trying to specify. And I know you know what I'm referring to, and I'm sure everyone understood what I meant, and I get that it isn't "malware" but what is it?

> What matters here is the definition from those platform

I do not agree and I really don't see you being able to support this. They are just different categories of malware. Malware is defined by its characteristics, not the "platform's" (developer's?) definition.

Even if we don't have an absolutely clear, rock solid and immutable definition of what malware is, it's generally accepted that if a piece of software is affecting the stability, security, or performance of a system, while the owner may not even be aware of the presence, function, or impact of that software, then it's malware. More generally performing actions to the detriment of the owner and without the owner's knowledge.

White-hat software that infected routers to fix backdoors and eliminate black-hat malware (so to improve the security, stability, or performance of the system) was in practice still considered malware.

So keep in mind that an attacker punching you in the face doesn't get to decide whether it's assault or actually just percussive transmission of information. It's the characteristics of the action which define it.

What matters is how the platforms behave. Power and money defines how platforms behave, not their temporary principles or stances.

True, it's still technically a possibility. I guess my point was more that everyone seems to buy in the tabloid reporting that unity games installer will now be filled with malware when this merging is clearly meant that they want to add more Ads into unity games. And showing interstitial Ads in a game is not the same as malware.

> clearly meant that they want to add more Ads into unity games

That is only your interpretation of the purchase. Unless you have insider information you don't know what their true intentions are.

They could have purchased a more reputable company with the same goal you mentioned.

And yet 'anticheat' software and drm still exists.

Even without elevation, a process can "only" [1] interact with your whole profile

[1] https://xkcd.com/1200/

So you think it's unfounded to assume that them merging with a malware company means they will start installing malware somehow? I think there would be _no other reason_ to merge with a company that makes malware? Maybe it won't target devs, but the concern is no unfounded.

Absolutely, there's no shortage of reasons to hate on Unity or this merging, they have done so many things wrong it is infuriating but thinking that they would include malware as describe above forcibly, making any games made in Unity unpublishable on virtually all stores makes no sense.

Unity game dev will, willingly, include ads into their games, no need to sneakily force malware on users computer for that.

I get the fear, "unfounded" was perhaps the wrong word, most articles want to push the narrative this way, but despite their previous sketchy background, IronSource is one the leading mobile gaming ads company, they don't only make malware and clearly this merging is about "ads" and not installing malware.

No. I really don't see the concern. Unity's business model does not involve targeting users with ads by installing malware on their system. However, many games studios do choose to integrate ads into their game loop and as a game platform I can see exactly why Unit wants this type of talent in-house so they can make their platform more attractive for game devs that might be looking for this type of feature in a platform.

Unity just merged with a company whose business model is exactly that. Concern seems warranted.

Their business model is mobile ads. The installer business was a decade ago, and prior to another merger with another ad network.

The concern here is hyperbolic. This is about ads, not malware. There is no rational reason Unity would want to get close to malware.

Ads are malware. The reason ad networks use the same techniques as other forms of malware is that they're both trying to make the computer behave in ways that its owner doesn't want.

A non-trivial percentage of their revenue, however, is from Unity Ads.

malware like redshell come to mind

https://www.polygon.com/2018/6/20/17485762/red-shell-spyware...

A lot of anticheats used to work similarly back in the day. They’d set SeDebugPrivilege, and arbitrarily scan memory and files, then offload that data to some server. Truly behaving like malware.

Edit: Nowadays they take it a step further, like Vanguard. It’s a boot kit that injects a kernel mode driver right at the beginning of OS initialization,

That's not 'behaving like malware', that's malware.

That's why I run games only on a computer on which I do nothing else. It's also the only Windows machine in the house.

I do the same, but in a Steamdeck. It doubles as HTPC, as I can use a Steam Controller as mouse, and the pop-up keyboard with it.

unity games already do stuff not, they all phone home.

I get games from GOG.com, because they do not have DRM and are generally not evil.

But the unity games on the platform - they all phone home and send back detailed telemetry on what you do in-game. plus probably other stuff.

Thankfully the GOG terms allow you to install and run the games offline without requiring these shenanigans to play your game.

Doesn't that violate GDPR?

It probably would these days, but in 2012 there were no such regulations.

These sorts of shenanigans a decade ago certainly influenced the creation of GDPR.

Reply on news.ycombinator.com