Fortinet, a network security vendor, publishes threat research on malware, ransomware, vulnerabilities, and phishing.
HN commenters link it as a detailed writeup, for example on ransomware using a vulnerable driver, and for security definitions like spyware.
> Frankly this is absurd.
What's absurd is Apple's software sending requests to random and entirely-unvetted servers without even so much as notifying the user, let alone obtaining consent.
> Did you know that the file system of your computer contains your personal data, including files you save?
Why yes, and that would just so happen to be the reason why I ain't exactly comfortable with closed-source software silently sifting through it and blindly following anything and everything vaguely resembling a URL or encoding thereof.
> EDIT: No, that’s not what exfiltration means. You are simply misusing the word.
https://www.fortinet.com/resources/cyberglossary/data-exfiltration:
"A common data exfiltration definition is the theft or unauthorized removal or movement of any data from a device. Data exfiltration typically involves a cyber criminal stealing data from personal or corporate devices, such as computers and mobile phones, through various cyberattack methods.
"Another data exfiltration meaning is data exportation and extrusion, data leakage, or data theft, which can pose serious problems for organizations. Failing to control information security can lead to data loss that could cause reputational and financial damage to an organization."
Thanks to this crawler, anyone who sends you even so much as a QR-encoded image of a link will know that it was successfully received, that it was a macOS machine that received it, and quite possibly the public IP address of the…
You only need to decrypt once the payment has been received, so the private key doesn't need to be sent to the infected machine before that. Encrypt/Decrypt, it seems to be a moot point.
The "decrypt one file for free" feature seems to be specific to CryptoWall which, some have reported, do not use symmetric encryption like CryptoLocker. CryptoLocker stores symmetric keys for each file on the infected machine, encrypt those with a public key and when the payment is received, send the private key from the C&C Server. I would say it's very unlikely CryptoWall would store remotely a private key per file. That could mean a lot of information to be transferred over the wire. Probably because of using only asymmetric (slow) encryption, CryptoWall apparently only encrypt small files completely, and only a piece of the larger ones. One way the "decrypt one file for free" feature might work is by actually uploading the file (or the the encrypted piece of file) to the C&C Server, decrypting it remotely and sending it back. But the feature is definitely worth investigating.
https://blog.fortinet.com/post/cryptowall-another-ransomware-menace
http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scenes.html
Well, that's clearly incorrect: software displaying unsolicited advertisements is called adware, and requires no spying at all.
> Spyware is a form of malware that hides on your device, monitors your activity, and steals sensitive information like bank details and passwords [0]
> Spyware is loosely defined as malicious software designed to enter your computer device, gather data about you, and forward it to a third-party without your consent. [1]
> Spyware is malicious software that secretly monitors your activity and collects sensitive information, like passwords, location data, or browsing habits, without your consent. [2][3]
0: https://www.malwarebytes.com/spyware
1: https://usa.kaspersky.com/resource-center/threats/spyware
2: https://us.norton.com/blog/malware/spyware
3: https://www.fortinet.com/resources/cyberglossary/spyware
Sadly, that's yesterday news.
See here: https://security.stackexchange.com/a/249484
> ... a newly discovered ransomware variant exhibits the
ability to detect and compromise partitions (including
hidden partitions), a behavior not thought to have been
seen before in ransomware.
with a link to original source:
https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
quote from that link:
> At the time of discovery, FortiGuard Labs researchers
believed the ransomware was seeking out partitions to find
possible hidden partitions setup by systems administrators
to hide backup files. But further analysis confirmed an
even more advanced technique. The DarkSide Ransomware
variant seeks out partitions on a multi-boot system to
find additional files to encrypt.
Sure.
Kinda like how storing web templates in files is totally dependent on the people who upload them not putting crypto miners in the linked javascript(s) [1]. Or totally dependent on PAM not having a vulnerability [2]. Or totally dependent on SSH not having a vulnerability [3].
In terms of libraries and utilities I can give PAM and SSH a pass for fixing these things long ago. In the case of restricting a customer's access to the mechanism that renders their thing in favor of the option of "trust this guy who uploads things instead" you've got a much tougher sell about why that's better.
1. https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coin-miner-javascript-infection
2. https://www.cvedetails.com/cve/CVE-2002-1227/
3. https://www.cvedetails.com/cve/CVE-2002-0083/
As far as I remember, the "DLL hijacking" is a serious issue when the program like Microsoft Word searches for the DLL exactly at the location of the user file to be opened and exactly after the user selects the file: if you e.g. open a .DOC file from the Documents folder and an attacker placed in the Documents folder his own DLL, that DLL would have been then loaded too by some unpatched versions of Microsoft Word.
I don't see such a scenario described in this article, so it can be that the issue here has much less potential to be misused?
There is also a system-wide solution for all programs at once: SafeDllSearchMode registry entry.
https://www.fortinet.com/blog/industry-trends/a-crash-course-in-dll-hijacking.html