Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered

«‹›105 »

BaseballPCHiker: Jan 16, 2006

I think we're agreeing? :shrug:

Yes AV is useless, no I dont personally pay for or use any AV myself. I guess my question was more about what to recommend to users who I know will not run a system without any AV because they think that would be like barebacking it in a Tijuana brothel. I know they are going to use it so I might as well find the one that is the most unobtrusive and wont take up a ton of system resources.

# ? Jul 31, 2015 16:08

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 06:09

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

BaseballPCHiker posted:

I think we're agreeing?

Yes AV is useless, no I dont personally pay for or use any AV myself. I guess my question was more about what to recommend to users who I know will not run a system without any AV because they think that would be like barebacking it in a Tijuana brothel. I know they are going to use it so I might as well find the one that is the most unobtrusive and wont take up a ton of system resources.

They all use the same amount of resources give or take. Just get a free one and be done with it.

Here, I made a choice at random for you: Microsoft has an AV so use that.

# ? Jul 31, 2015 16:30

pr0zac: Jan 18, 2004; ~*lukecagefan69*~; Pillbug

BaseballPCHiker posted:

Has anyone tried using this Tron script yet:
https://github.com/bmrf/tron/
Seems like it could be good for those start it and forget it situations where you can just let it run all day and check back on it later. Was curios to see if anyone has found it to be useful at all, or if it's basically a glorified batch script that just runs a bunch of AV scans in a row.

Speaking of what is the go to free AV to recommend to people these days? I have friends and relatives ask me all the time and I don't know what to tell them now except for watch what you click on and install ublock or something on your browser.

Please do not use something that installs flash, adobe reader, and java automatically.

# ? Jul 31, 2015 17:50

Nintendo Kid: Aug 4, 2011; by Smythe

BaseballPCHiker posted:

I think we're agreeing?

Yes AV is useless, no I dont personally pay for or use any AV myself. I guess my question was more about what to recommend to users who I know will not run a system without any AV because they think that would be like barebacking it in a Tijuana brothel. I know they are going to use it so I might as well find the one that is the most unobtrusive and wont take up a ton of system resources.

They should all be updating to Windows 10 over the coming year, and that has MSE built in as Windows Defender and it's impossible for them to disable it. So just tell them to do that.

# ? Jul 31, 2015 17:52

uPen: Jan 25, 2010; Zu Rodina!

BaseballPCHiker posted:

Has anyone tried using this Tron script yet:
https://github.com/bmrf/tron/
Seems like it could be good for those start it and forget it situations where you can just let it run all day and check back on it later. Was curios to see if anyone has found it to be useful at all, or if it's basically a glorified batch script that just runs a bunch of AV scans in a row.

Speaking of what is the go to free AV to recommend to people these days? I have friends and relatives ask me all the time and I don't know what to tell them now except for watch what you click on and install ublock or something on your browser.

I've thrown it against 3 infected machines. One it fixed (this machine was just some adware and other garbage), second machine had some flavor of trojan and Tron would lock and then reboot the computer after running for ~3-4 hours repeatedly, third computer it ran and cleaned but the computer re-infected itself a few hours after it was reconnected to the internet.

IMO it's largely useless, the automation is nice but the time it takes to run (8+ hours typically) is insane when you could get similar results doing it manually over 90 minutes or so.

As for free AV go with MSE, it's as useless as everything else but it doesn't advertise to you. The free copy of Norton/Mcafee for Comcast/ATT customers also works.

# ? Aug 2, 2015 04:09

BaseballPCHiker: Jan 16, 2006

uPen posted:

I've thrown it against 3 infected machines. One it fixed (this machine was just some adware and other garbage), second machine had some flavor of trojan and Tron would lock and then reboot the computer after running for ~3-4 hours repeatedly, third computer it ran and cleaned but the computer re-infected itself a few hours after it was reconnected to the internet.

IMO it's largely useless, the automation is nice but the time it takes to run (8+ hours typically) is insane when you could get similar results doing it manually over 90 minutes or so.

As for free AV go with MSE, it's as useless as everything else but it doesn't advertise to you. The free copy of Norton/Mcafee for Comcast/ATT customers also works.

I was mostly interested in it for relatives/friends computers but after looking at it and hearing some feedback, formatting and reinstalling is totally the way to go. Quicker and more effective. After arguing back and forth with OSI bean Dip I've just continued with my advice of installing ublock and telling people to watch what they click on, that and MSE running unobtrusively in the background. If someone really bugs me because they think free=bad I'll just tell them MalwareBytes or Kapersky.

# ? Aug 3, 2015 15:37

bobbilljim: May 29, 2013; this christmas feels like the very first christmas to me

BaseballPCHiker posted:

I was mostly interested in it for relatives/friends computers but after looking at it and hearing some feedback, formatting and reinstalling is totally the way to go. Quicker and more effective. After arguing back and forth with OSI bean Dip I've just continued with my advice of installing ublock and telling people to watch what they click on, that and MSE running unobtrusively in the background. If someone really bugs me because they think free=bad I'll just tell them MalwareBytes or Kapersky.

make them give you $20 and then pretend to install MSE

# ? Aug 4, 2015 00:55

Mirificus: Oct 29, 2004; Kings need not raise their voices to be heard

Oracle security chief to customers: Stop checking our code for vulnerabilities

# ? Aug 11, 2015 20:57

Ynglaur: Oct 9, 2013; The Malta Conference, anyone?

Mirificus posted:

Oracle security chief to customers: Stop checking our code for vulnerabilities

One of the Ars posters had a great retort. "Oh, so this means that Oracle is assuming all liability for their software? That's great!"

# ? Aug 11, 2015 21:23

Nam Taf: Jun 25, 2005; I am Fat Man, hear me roar!

This was my favourite response to that

# ? Aug 13, 2015 11:34

Mustache Ride: Sep 11, 2001

Netflix is dumping their AV: http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-anti-virus/

quote:

For years, nails have been hammering down on the coffin of anti-virus. But none have really put the beast to bed. An industry founded in the 1980s, a time when John McAfee was known as a pioneer rather than a tequila-downing rascal, has survived despite the rise of umpteen firms who claim to offer services that eradicate the need for anti-virus.

Now, however, movie streaming titan Netflix NFLX +1.53% is hammering a rather significant nail in that old coffin, one that could well lead to the industry�s final interment. Because Netflix, a well-known innovator in the tech sphere, is the first major web firm to openly dump its anti-virus, FORBES has learned. And where Netflix goes, others often follow; just look at the massive uptick of public cloud usage in recent years, following the company�s major investment in Amazon Web Services.

Let�s take a second to look at the decline of the anti-virus industry. Anti-virus has been the first line of defence for many firms over the last quarter of a century. Generally speaking, AV relies on malware signatures and behavioural analysis to uncover threats to people�s PCs and smartphones. But in the last 10 years, research has indicated AV is rarely successful in detecting smart malware. In 2014, Lastline Labs discovered only 51 per cent of AV scanners were able to detect new malware samples.

Despite its shortcomings, many are still required to keep hold of their AV product because they�re required to by compliance laws, in particular PCI DSS, the regulation covering payment card protections. There�s also the argument that AV is necessary to pick up the �background noise�, as Quocirca analyst Bob Tarzey describes it. �Despite more and more targeted attacks, random viruses are still rife and traditional AV is still good at dealing with these,� he claims. Major players, including Symantec and Kaspersky, continue to make significant sums, even if results aren�t stellar.

But it�s now possible to dump anti-virus altogether, and Netflix is about to prove it. The firm has found a vendor that covers those compliance demands in the form of SentinelOne. As SentinelOne CEO Tomer Weingarten told me, his firm was given third-party certification from the independent AV-TEST Institute, validating it can do just what anti-virus does in terms of protecting against known threats, whilst providing �an additional new layer of advanced threat protection�. Its end-point security doesn�t rely on signatures, it monitors every process on a device to check for irregularities and does not perform on-system scans or require massive updates like anti-virus, Weingarten said.

�Large enterprises are recognizing that anti-virus is not adding a lot of value to their security posture. Instead of just bolting on more and more layers, companies are looking for ways to reuse their anti-virus budget to achieve better security,� he added.

And that�s what Netflix has done. �It was three years ago we were doing a re-evaluation of anti-virus and out evaluation said that anti-virus is dead, so we�ve been trumpeting that for years,� Rob Fry, Netflix senior security architect, told FORBES. �The problem was there wasn�t really a replacement at the time. Fast-forward three years and now there�s next-generation everything. Then the next question is: how mature are they?

�The direction we decided to go was with a company called SentinelOne, who we�ve been working with for year and a half. They were a true replacement for end-point protection.

�We�re in the process of leaving anti-virus. We did not renew our anti-virus contract this year.�

He complained of poor support from his anti-virus provider, whom he chose not to name, noting Netflix simply �chose the one that sucked the least�. �The AV piece wasn�t even the most valuable thing, it was the URL filtering,� he added, referring to the blocking of malicious websites Netflix staff were visiting whilst on the corporate network.

For any CISOs out there, they�ll need some more convincing that SentinelOne really can do the job of finding low and high-grade malware. Aside from the AV-TEST Institute certification, there�s little in the way of third-party analysis of the company�s kit.

Skeptics on the death of anti-virus will have their voices heard too. �I don�t believe the era of anti-virus software is dead but that we need to evolve the technologies and other defences we use to properly address the variety and sophistication of the threats we face,� noted Brian Honan, security consultant.

But Netflix is unlikely to listen to naysayers. And it isn�t taking it easy on so-called �next-generation� kit either. In recent years, it decided to ditch FireEye, considered a major player in the post-AV anti-malware game. That�s not because of the quality of protection the firm offers, however, but the lack of application programming interfaces (APIs), Fry said.

APIs allow Netflix to hook up its various security systems so they worked concomitantly and could feed on each others� data to provide more advanced security. When Fry goes looking for fresh vendors, there are two musts: a cloud strategy and APIs. As FireEye wasn�t willing to provide them at the time, Netflix moved over to ProtectWise, another advanced attack detection company, he told FORBES.

A FireEye spokesperson noted that since early 2014 FireEye has had a �rich, secure, documented and formally supported� API across the majority of its products. �These APIs are used by a broad selection of end-customers, reseller/managed service and technology integration partners,� they added.

What�s apparent with the spate of major cyberattacks seen this year, from Ashley Madison to Hacking Team and the US government, the world�s biggest firms are demanding more from the companies that have tried and failed to adequately protect them.

And where Netflix goes the rest are soon to follow. Bye bye lovely AV!

# ? Aug 26, 2015 17:33

Professor Shark: May 22, 2012

I posted this in Hardware but maybe this is a better spot to ask: I just got my computer back from the shop after getting infected with Malware. I've changed all my important passwords and requested a new credit card, but I'm worried about plugging in my External Hard Drive. Is it possible for it to be infected? What can I run to put my mind at ease?

# ? Aug 26, 2015 18:41

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Professor Shark posted:

I posted this in Hardware but maybe this is a better spot to ask: I just got my computer back from the shop after getting infected with Malware. I've changed all my important passwords and requested a new credit card, but I'm worried about plugging in my External Hard Drive. Is it possible for it to be infected? What can I run to put my mind at ease?

Two things:

1) Just boot off of an Ubuntu disk and see what's on there. If you see anything malicious on there, remove it or somehow neuter it.
2) Make sure AutoRun is completely turned off. If AutoRun does not pick up on your drive, you should not have an issue plugging it in even if it is infected.

I guess the third thing could be don't have it plugged in at bootup too.

# ? Aug 26, 2015 18:51

Geemer: Nov 4, 2010

Professor Shark posted:

I posted this in Hardware but maybe this is a better spot to ask: I just got my computer back from the shop after getting infected with Malware. I've changed all my important passwords and requested a new credit card, but I'm worried about plugging in my External Hard Drive. Is it possible for it to be infected? What can I run to put my mind at ease?

In addition to what OSI bean dip said, you could also see if an offline scanner like Windows Defender Offline will recognize the external disc and use that to scan it.

# ? Aug 26, 2015 19:02

Rhymenoserous: May 23, 2008

Mustache Ride posted:

Netflix is dumping their AV: http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-anti-virus/

And where Netflix goes the rest are soon to follow. Bye bye lovely AV!

Honestly as much as I hate AV, we're not there yet. But I eagerly await some C level exec at Netflix taking half the network down because he browsed the wrong porn site.

# ? Aug 26, 2015 20:20

Hav: Dec 11, 2009; Fun Shoe

Space Gopher posted:

Previously, encryption software was either a closely held government secret, or an astoundingly expensive (and likely broken) commercial product. Anybody could download PGP and get NSA-grade encryption, in a fairly simple user interface that kept the details of the two-step process under the hood.This led to all kinds of political battles, including an arms-control investigation of its original programmer (who had, ironically, written it in support of anti-nuclear activism).These days, PGP isn't used that much anymore as a standalone product, but you can trace a direct line from PGP to online credit card transactions and easy-to-use full disk encryption at the OS level.

Phil Zimmerman drove around uploading the code to BBS' because the American government classified strong encryption as munitions, which led to people tattooing RSA onto their arms in protest. They attempted to prosecute him for doing so, but it led to a realization that it was dumb.

Didn't stop the idea getting refloated last year. Public/private key pairs were the real benefit. That first version of PGP was limited to 1024-bit keys that could take a couple of minutes to encrypt on the computers of the time; I could encode MP3s in about 3x their play time with a Pentium back then.

Pedantic note: Stop saying SSL. Poodle killed SSL. It's TLS.

# ? Aug 27, 2015 18:08

Aquila: Jan 24, 2003

Hav posted:

Pedantic note: Stop saying SSL. Poodle killed SSL. It's TLS.

Except TLS is just what Netscape let a committee rename SSL to in order to prevent Microsoft from taking their ball and leaving the browser encryption game.

# ? Aug 28, 2015 06:14

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Yeah, it was a hysterical concession, but not even Taher minded.

# ? Aug 28, 2015 06:25

Double Punctuation: Dec 30, 2009; Ships were made for sinking;
Whiskey made for drinking;
If we were made of cellophane
We'd all get stinking drunk much faster!

TLS isn't even an accurate name. It secures the Application layer, not the Transport layer.

# ? Aug 28, 2015 18:25

corgski: Feb 6, 2007; Silly goose, you're here forever.

Yeah well, ALS was taken.

# ? Aug 28, 2015 20:26

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

dpbjinc posted:

TLS isn't even an accurate name. It secures the Application layer, not the Transport layer.

How so?

# ? Aug 28, 2015 20:31

chessmaster13: Jan 10, 2015

OSI bean dip posted:

Two things:

1) Just boot off of an Ubuntu disk and see what's on there. If you see anything malicious on there, remove it or somehow neuter it.
2) Make sure AutoRun is completely turned off. If AutoRun does not pick up on your drive, you should not have an issue plugging it in even if it is infected.

I guess the third thing could be don't have it plugged in at bootup too.

If you really want to be sure that your computer is clean, Boot up another OS (for example ubunto from live CD) transfer all important files to a new hard drive or burn them on a DVD (better back up your stuff on a regular basis).
Afterwards, wipe the drive inside your computer ( http://www.dban.org/ offers a nice tool for this).
This ensures that the so called master boot record is also erased. One could argue that a fresh install of ubuntu would als do the trick, but I simply prefer to nuke HDDs from orbit.
Now you install a fresh copy of windows on the wiped drive and load you backed up files onto it.

This might be overkill (even tho you could go further down the rabbit hole and wrap even more tinfoil around your head).

There ARE some nasty things that might survive this treatment this, but that's pretty exotic stuff not regularly encountered in the wild.

Also, autorun should generally be disabled on your system.

# ? Sep 8, 2015 11:29

Ynglaur: Oct 9, 2013; The Malta Conference, anyone?

Does someone have a good idea of what additional things Malwarebytes Anti-Exploit does over the main Malwarebytes Anti-Malware product? My work just rolled out both, so I'm wondering if there's a good reason to have both at home.

# ? Oct 2, 2015 16:35

co199: Oct 28, 2009; I AM A LOUSY FUCKING COMPUTER JANITOR WHO DOES NOT KNOW ANYTHING ABOUT CYBER COMPUTER HACKER SHIT.

PLEASE DO NOT LISTEN TO MY FUCKING AWFUL OPINIONS AS I HAVE NO FUCKING IDEA WHAT I AM TALKING ABOUT.

Kafeine has a good write-up on it (they paid him to test it) here: http://malware.dontneedcoffee.com/2014/06/mbae.html. It should block exploit kits like Angler and Nuclear which deliver ransomware among other things.

# ? Oct 3, 2015 01:41

ugh its Troika: May 2, 2009; by FactsAreUseless

An old router I plugged in to test for something became infected with Linux.Wifatch within minutes, which... hardens the router against further attacks? :staredog:

# ? Oct 3, 2015 02:05

Geemer: Nov 4, 2010

-Troika- posted:

An old router I plugged in to test for something became infected with Linux.Wifatch within minutes, which... hardens the router against further attacks?

Doesn't it also create some backdoors? In theory the creator could act all nice until he gets enough routers infected to flip the switch and make them all ~~do his bidding~~ mine a bitcoin.

# ? Oct 3, 2015 20:47

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

-Troika- posted:

An old router I plugged in to test for something became infected with Linux.Wifatch within minutes, which... hardens the router against further attacks?

Throw it out. While sure this malware may have protected you from something, the fact that this happened and the fact that foreign software was installed on your device without your consent does mean that you cannot trust it.

Just buy a new D-Link or something router and don't plug it into the Internet until you're certain that nothing can access the device from the outside.

# ? Oct 4, 2015 16:13

OWLS!: Sep 17, 2009; by LITERALLY AN ADMIN

OSI bean dip posted:

Throw it out. While sure this malware may have protected you from something, the fact that this happened and the fact that foreign software was installed on your device without your consent does mean that you cannot trust it.

To be fair, it infects devices via insecure telnet passwords and removes itself upon reboot.

Flash the router with a newer firmware, set some passwords that aren't 'password', save some money.

# ? Oct 5, 2015 20:51

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

OWLS! posted:

To be fair, it infects devices via insecure telnet passwords and removes itself upon reboot.

Flash the router with a newer firmware, set some passwords that aren't 'password', save some money.

To be fair, you're assuming that you know exactly what the third-party code did and assume that it removed itself at reboot. You are also assuming that the flashing mechanism hasn't been touched either.

Please don't take offence but don't give lovely advice like this. It's what makes my job much harder. Thanks.

# ? Oct 5, 2015 20:58

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Do you also incinerate laptops if they get owned, or do you just reinstall the software stack? If you don't reuse compromised hardware after restoring from a known source, can I have your old stuff? I promise to be very careful with it.

# ? Oct 5, 2015 21:02

Prosthetic_Mind: Mar 1, 2007; Pillbug

Once a system like that gets infected, you're relying on the malware to allow you to flash the firmware. There's nothing you can do to verify that it isn't installing hooks into it when you upgrade and even reporting an MD5 that indicates that the image is clean.

You don't know what dark corners of the device that hooks may or may not have been hidden in. Unless you can wipe every bit of writable memory on the thing without missing anything you have no guarantee that you fully removed the malware.

# ? Oct 5, 2015 21:19

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Prosthetic_Mind posted:

Once a system like that gets infected, you're relying on the malware to allow you to flash the firmware. There's nothing you can do to verify that it isn't installing hooks into it when you upgrade and even reporting an MD5 that indicates that the image is clean.

You don't know what dark corners of the device that hooks may or may not have been hidden in. Unless you can wipe every bit of writable memory on the thing without missing anything you have no guarantee that you fully removed the malware.

This is exactly the thing I am bantering about.

For the majority of you in this thread, you're all likely going to try and flash the device via the web interface. You have no assurances that the flashing tools included with the software haven't been compromised and you definitely cannot tell me that the settings stored within the router's NVRAM will not persist after a flash and restart. Even trying to fix it using TFTP and whatnot does not provide you a guarantee that the problem has been mitigated.

The purpose of such software is to remove the problem from the public Internet. It's a bandaid and an improper one at best. If you find out your device is affected, the best course of action is to outright remove it from your network and pick up another one. Someone has gone and modified your device without your consent and even if you think it was for the best you cannot be ascertain of that.

Lain Iwakura fucked around with this message at 21:27 on Oct 5, 2015

# ? Oct 5, 2015 21:23

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Can I have your stuff?

I was thinking of reflashing like one does after bricking a device, but if you don't have a trusted channel for the reflashing then I can see the concern. Of course, I don't think I would reflash my PC BIOS (and video card, and so forth) as part of eradicating malware either, so maybe I'm just insufficiently paranoid.

# ? Oct 5, 2015 21:24

Prosthetic_Mind: Mar 1, 2007; Pillbug

Subjunctive posted:

Of course, I don't think I would reflash my PC BIOS (and video card, and so forth) as part of eradicating malware either, so maybe I'm just insufficiently paranoid.

Can your PC BIOS potentially subvert all communication going between your network and the internet to do things like steal banking and other information, as well as act as part of a botnet?

# ? Oct 5, 2015 21:52

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

Prosthetic_Mind posted:

Can your PC BIOS potentially subvert all communication going between your network and the internet to do things like steal banking and other information, as well as act as part of a botnet?

My PC BIOS can potentially subvert anything, it controls the way the OS gets loaded. It was in the NSA's catalog of dirty tricks that got leaked a couple years back, and Equation Group was doing it with drive firmware too.

E: http://www.wired.com/2015/02/nsa-firmware-hacking/ has a good overview. I don't even know how to reflash my drive firmware in a trusted way, so I guess I really should be pulverizing equipment and hitting NewEgg from a trusted device if I get owned...

Subjunctive fucked around with this message at 22:14 on Oct 5, 2015

# ? Oct 5, 2015 22:11

wyoak: Feb 14, 2005; a glass case of emotion; Fallen Rib

Subjunctive posted:

My PC BIOS can potentially subvert anything, it controls the way the OS gets loaded. It was in the NSA's catalog of dirty tricks that got leaked a couple years back, and Equation Group was doing it with drive firmware too.

E: http://www.wired.com/2015/02/nsa-firmware-hacking/ has a good overview. I don't even know how to reflash my drive firmware in a trusted way, so I guess I really should be pulverizing equipment and hitting NewEgg from a trusted device if I get owned...

It's certainly a matter of risk assessment vs cost but new routers are like $80 so pony up

# ? Oct 5, 2015 22:29

Ireland Sucks: May 16, 2004

I've always wanted one of those BIOS's where you could press a button and it would reflash it from ROM, but I dunno if they are a thing nowadays.

Also a usb flash drive with an actual hardware write protect switch, they don't seem to be manufactured now either in modern sizes.

# ? Oct 5, 2015 22:36

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

wyoak posted:

It's certainly a matter of risk assessment vs cost but new routers are like $80 so pony up

lol at your peasant router I bet it doesn't even have an app

But yes, I was responding to the "potentially" aspect. I think I would be OK with tftp reflashing versus landfill for this case myself.

# ? Oct 5, 2015 22:41

Toast Museum: Dec 3, 2005; 30% Iron Chef

Didn't it come out that intelligence agencies were intercepting shipments of hardware and reflashing them with compromised firmware before they hit the market?

# ? Oct 5, 2015 23:19

Adbot: ADBOT LOVES YOU

# ? Jun 3, 2024 06:09

mindphlux: Jan 8, 2004; by R. Guyovich

yes

# ? Oct 5, 2015 23:45

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered

«‹›105 »