Hacker News Reader

> It's virtually impossible to run a Windows (or Linux, or Mac) installation with the usual suspects--Java, Flash, Adobe Reader, etc.--without being exposed to good old, non-targeted malware. Take into account that most of it is distributed from "good" sites, and "if I don't see it, it must mean there's nothing there" and "I never go to any risky sites" prove pretty silly.

Do you have more information about this? I wasn't aware that malware was just "floating" out in the ether. I have been staunchly in the camp of, "If you know what you're doing you can remain safe." but you seem convinced otherwise. Why?

https://www.google.com/transparencyreport/safebrowsing/malwa...

See "Compromised sites" at the bottom.

In my experience, compromised sites and insecure ad networks are by far the most common means of distributing malware through legitimate sites.

Even if you know what you are doing, you are very likely to come across sites running e.g. Wordpress, Drupal, etc. with shitty addons, e.g. timthumb, that have been compromised and are serving exploits through hidden iframes, redirecting you to bad pages, etc.

What percentage of those exploits are 0day? Part of "knowing what you're doing" involves keeping your software up to date, after all. Commodity malware isn't a large threat if it can't run.

Very cool link though, thanks.

I don't know (presumably few to none if Google is detecting them), but yes, I agree. You can be exposed but not be vulnerable.

for your 3rd paragraph: I'm not sure I'm following you - are you saying that virtually every machine is infected? How come?

btw I have been running without AVG for ages on all kinds of systems. Once in a while I'm checking if my habits are still ok and run a bunch of standalone scans. They never find a single thing. Does that mean they all suck hard and that my machines are infected by newer and more invisble things than they can find? (note this is an honest question. I have no clue.)

As I understand this, virtually every machine gets exposed to the garden-variety malware; whether it's vulnerable to the given exploit is a different matter (look at the obsolete Java and Flash plugins eeeverywhere). Moreover, it is also important whether the exploit has an appropriate payload for the given system (I have yet to see e.g. a browser-vector transmitted payload which would run on Linux - which says something about its marketshare, not necessarily about its security).

And of course "absence of evidence is not evidence of absence," so either the scans suck hard, or you're clean; but barring a more specific (and probably not fully-automated) inspection, there's no way to tell.

You hit the nail on the head.

In my Windows 7 partition I don't have Java or Adobe Reader. I only have the Chrome Flash plugin and my Steam games.

Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you.

Otherwise, no antivirus is really necessary.

> Tell me how the virus manages to stay out of Sysinternals Autoruns, and I will panic with you.

There's a whole category of malware that does just that: https://en.wikipedia.org/wiki/Rootkit

The most common (and basic) way is to run as a child process inside svchost.exe.

> Otherwise, no antivirus is really necessary.

You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it?

The Sysinternals Autoruns utility shows a full set of things that run at startup, it is not just the start menu and some 'run' reg keys.

It shows all services with their signature, all device drivers with their signature, etc. It validates the signatures too.

I'm sure I only run signed services and drivers.

Also, there's a rootkit detector Sysinternals utility. The page you linked describes how Mark Russinovich one of the writers of the Sysinternals utilities, discovered the Sony Rootkit.

> You don't care what happens in all the time that elapses from you're infected with something until you realize you are, if you realize it?

Of course I do, that's why I have the Sysinternals utilities at hand.

I think you're missing my point. You don't care what happens from the point you get affected until you find it in whatever utility--be it 5 seconds, 10 minutes, or 3 days? No matter how vigilantly you stare at procexp, you're not going to stop it from running.

And I hate the "I can't imagine how to do this, so it's not possible" argument.

We have syslogs going back 7 years. You want to come audit our network? I'll bet you all of the money in my bank account that you find nothing.

> with the usual suspects--Java, Flash, Adobe Reader, etc...

Nobody in my house runs those.

> It's all about staying on the machine, and staying silent.

They have to communicate over the network at some point though. Otherwise, it'd be useless.

So yeah - as far as I know - and that's pretty damn far.

> And I hate the "I can't imagine how to do this, so it's not possible" argument.

I can imagine how to do it. But I also know that 99.9% of people don't.

> > with the usual suspects--Java, Flash, Adobe Reader, etc...

> Nobody in my house runs those.

That's very unusual, and you'll have to agree.

Let's assume that you are really doing so much that AV is completely moot. You're still being reckless by giving people the impression that they can just uninstall it and continue doing what they were doing (i.e. using Java, Flash, Adobe Reader, etc.), and everything will be exactly the same.

No. I am not. Read my original post again where I said:

...if you know what you're doing.

Where did I imply anything remotely close to what you just said?

Well, if you don't define what "if you know what you're doing" means, it could be anything from "running Chrome" to "using curl on an OpenBSD box and parsing the source manually." But I was referring to that and the general sentiment that "AV is shit and you can just uninstall it."

Literally anything could be possible "if you know what you're doing" if you leave it that ambiguous.

That's right. I was not specific. How then could you have possibly derived that very specific accusation from my own non-specific offering?