<story><title>A Case of Stolen Source Code</title><url>https://panic.com/blog/stolen-source-code/</url></story><parent_chain><item><author>Sidnicious</author><text>&amp;gt; …breeze right through an in-retrospect-sketchy authentication dialog…&lt;p&gt;I can&amp;#x27;t blame them for this. A surprising number of apps ask for root (inc. Adobe installers and Chrome). As far as I know, it&amp;#x27;s to make updates more reliable when an admin installs a program for a day-to-day user who can&amp;#x27;t write to &amp;#x2F;Applications and &amp;#x2F;Library.&lt;p&gt;We&amp;#x27;re long overdue for better sandboxing on desktop (outside of app stores).</text></item></parent_chain><comment><author>kefka</author><text>It doesn&amp;#x27;t matter that much, honestly.&lt;p&gt;I only do root for administration tasks. Filesystem stuff, hardware, server config. All the goodies are in my homedir. Exfiltration is easy as that. Running bad binaries is easy as running under my username.&lt;p&gt;In the end, there&amp;#x27;s no protections of what my username can do to files owned by my user. And that&amp;#x27;s why nasty tool that:&lt;p&gt;&lt;pre&gt;&lt;code&gt;     1. generates priv&amp;#x2F;pub key using gpg
     2. emails priv key elsewhere and deletes
     3. crypts everything it can grab in ~
     4. Pops up nasty message demanding money
&lt;/code&gt;&lt;/pre&gt;
works so easily, and so well.&lt;p&gt;The only thing I know that can thwart attacks like this is Qubes, or a well setup SELinux.. But SELinux then impedes usage. (down the rabbit hole we go).&lt;p&gt;Edit: Honestly, I&amp;#x27;m waiting for a Command and Control to be exclusively in Tor, email keys only through a Tor gateway, and also serve as a slave node to control and use. I could certainly see a &amp;quot;If you agree to keep this application on here, we will give you your files back over the course of X duration&amp;quot;.&lt;p&gt;There&amp;#x27;s plenty more nefarious ways this all can be used to cause more damage, and &amp;quot;reward&amp;quot; the user with their files back, by being a slave node for more infection. IIRC, there was one of these malware tools that granted access to files if you screwed over your friends and they paid.</text></comment>
<story><title>A Case of Stolen Source Code</title><url>https://panic.com/blog/stolen-source-code/</url></story><parent_chain><item><author>Sidnicious</author><text>&amp;gt; …breeze right through an in-retrospect-sketchy authentication dialog…&lt;p&gt;I can&amp;#x27;t blame them for this. A surprising number of apps ask for root (inc. Adobe installers and Chrome). As far as I know, it&amp;#x27;s to make updates more reliable when an admin installs a program for a day-to-day user who can&amp;#x27;t write to &amp;#x2F;Applications and &amp;#x2F;Library.&lt;p&gt;We&amp;#x27;re long overdue for better sandboxing on desktop (outside of app stores).</text></item></parent_chain><comment><author>mstade</author><text>True story. The status quo unfortunately conditions people into &amp;quot;just answer yes to the stupid questions&amp;quot; which then renders everything from developer certs to elevation warnings moot. &amp;quot;But you got a warning&amp;quot; is little recourse for when your hard drive is encrypted by some ransomware. (I know I&amp;#x27;m mixing current events here – cut a fella some slack!)</text></comment>