Hacker News Reader

Comment by thewataccount | Hacker News Reader

There's a misconception that you need to do something "stupid" to get a virus which is simply not the case. 0 days exist, and worms are still a thing (looking at you samba).

A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys.

Chrome also just had a 0 day 2022 - CVE-2022-3075

Pytorch supply chain attack via Triton 2022/2023 - https://www.bleepingcomputer.com/news/security/pytorch-discl...

EDIT: Also there's a misconception that linux somehow doesn't get viruses - however the Pytorch attack affected linux users. Making a virus for windows gives you far more targets then linux, which is why they're far more common.

View on HN

There will always be 0 days out there, but they will always be very expensive and rare. If you have the ressources to buy or find a 0-day, you definetly won't blow it by executing known malware, or other stuff, which falls under the detected by AV's. I really don't thing that having AV installed will protect any user from a 0-day.

On the other side, you install a very invasive av software, which runs as privileged user and intercepts everything thats happening on your system. They even make a great target for malware by themself. Just recently ClamAV had a bug in it's file scanner, which let to an rce: CVE-2023-20032

> 0 days exist,

And they're almost exclusively used in targeted attacks against valuable targets, because burning a 0-day to hack grandma's old laptop and steal her facebook password isn't a particularly good investment.

> A great example is Pytorch just recently had a supply chain attack, and installing the nightly version between December 25th and December 30th, 2022 - would result in your home directory getting uploaded including ssh keys.

Do you think Defender would have helped with that? I'm highly doubtful.

What would probably have, is if MS's implementation of protected folders, or whatever it's called, wouldn't have been completely brain-dead.

> EDIT: Also there's a misconception that linux somehow doesn't get viruses - however the Pytorch attack affected linux users. Making a virus for windows gives you far more targets then linux, which is why they're far more common.

That's correct. But at least on Linux, if you're so inclined, you can spend a couple of hours setting up some AppArmor or SELinux profiles to prevent random crap for accessing ~/.ssh and ~/top-secret.

This is true, but the overwhelming majority of malware on non-tech savvy peoples systems are going to be from silly things, like downloading and running a malicious executable, and not from 0 days.

Would windows defender have protected against this?

windows users will also happily "run as administrator", while a lot of linux users know not to do that in my experience

Yes, I have an absolutely pristine record and I have never, ever copy-pasted a script from the internet with sudo, or piped curl into bash because I'm lazy and I trust most github READMEs. Never.

I have literally never done this and do not understand why anyone would.

Installing software to the system should be handled by a package manager, but if you must install something like this, just throw it in a tmpfile and inspect the script before running it.

I know the response to this will be "but the things the script downloads and installs could be malicious", and while this is true, so long as the sources in the install script are fine, I consider this to be a separate issue (but still a big issue).

The issue of trusting source code or binaries is a thing but it doesn't justify copy pasta'ing random scripts in the shell.

Another thing to take note of, there in the past have been bugs in terminal emulators that allowed pasting certain characters that made the text look completely different than what it actually was, so pasting "ls $HOME" could have actually been "rm -rf ~/" for example.

I usually double check before running stuff as sudo, and piping into bash i dont really ever need (AUR). My heart goes out to those on distros where thats the way to distribute software.

AUR is perfectly safe. Got it.

>a lot of linux users know not to do that in my experience

README.md : "to get this to work, curl or wget the following script and run it as sudo"

Linux users: Aye

That is programmers etc using Linux, yes. Casual users wont touch the terminal.

In my experience, there are relatively few casual users of Linux.

Honestly...I'm far for afraid of my $HOME being uploaded somewhere. You don't need "run as administrator" for that.

> You don't need "run as administrator" for that.

This is what makes it so doable since you don't need any privilege escalation.

The reason why this is a big deal for a lot of people is your ssh keys will give you access to your git repos and other servers unless you have them password protected or use gpg/sk ssh keys which I think a lot of people don't do.

And of course if you can see the known hosts file/bash_history you'll likely have access to more servers to propagate to.

Also things like your browser cache is stored there.

Plenty of dangerous things stored in `~/`, they don't even need password for ssh-key if there is ssh-agent running (this is in case of dangerous process running, not just upload).

This is why I store keys on a hardware key that requires me to touch it when used and manually start ssh-agent when doing a lot of `git push`.

Yeah gpg/sk ssh keys are definitely the way to go.

Reply on news.ycombinator.com