Slashdot Mirror
DNSChanger Shut-Down Means Internet Blackout Coming For Hundreds of Thousands
Since you're reading this here, you're probably already aware that in the early hours of Monday, lots of DNS calls are going to fail as the FBI turns off servers from which Windows machines infected with DNSChanger have been served. New submitter SuperCharlie adds a reminder of the impending shutdown, and adds:
"The FBI has a step-by-step method for you to see if you are infected in this PDF document, or you can go to dcwg.org for an automated check if you are so inclined."
a SOHO router or Windows... Currently on a cisco 2901 and arch..... ahhh the good life.
Zzzz, when will the ignorant Apple trolls get bored of these things?
http://techland.time.com/2012/04/23/dnschanger-fbi-warns-infected-computers-will-lose-web-email-access-in-july/
"DNSChanger targets Windows or Mac systems (Linux, iOS and Android users are in the clear) by manipulating Domain Name Servers (DNS), which translate syntax-based URLs into IP addresses. "
I think their internet connection will be just fine, it's the DNS that's going to shit the bed. Why does every article make this mistake?
I guess anyone who's stupid enough to get dragged into a botnet wouldn't know the difference though.
DSNChanger Shut-Down Means Internet Blackout Coming For Hundreds of Thousands
No. It means some folks with powned windows boxes will finally realize there is an issue, and call one of their friends/family to fix things for them. There was no reason to keep DNS service for these folks to begin with. Or, if they really were scared of taking some windows zombies off the net, they could have taken things down for a week, then brought their DNS back up and seen how many fewer users were hitting their DNS servers-- then make the decision on whether or not to down the replacement DNS. I bet in one week without the DNS working, they would have gone down to fewer users than all these months that have passed.
Why didn't they have Google Public DNS take over the IPs that were used by the bot net (or something)?
Is anyone else sick of hearing about this?
Just shut the servers down already and be done with it.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
They'll be getting lots of calls from all of the inept n00bs who got infected soon.
That is all...
What was ignorant about my comment?
It is fact that DNSChanger does not infect OSX. It doesn't infect iOS. It doesn't infect Linux, or BSD, or Amiga, or Android, or BeOS, or Plan 9, or Chromium, or OS2, or Solaris, or EMACS. I happen to be running one of the many OSs it does not infect.
Seriously? https://www.google.com/search?q=dnschanger+osx
Never ask for directions from a two-headed tourist! -Big Bird
iNo, iBut iYou iAre iNfected iWith iThe iFanboi iTroll iVirus, iWhich iS iNfinitely iMore iAnnoying...
Rather than shutting the servers down suddenly, why are they not just sending all requests to a website informing people they are infected, and explaining how to fix it? Then, after a week or two, shut 'em down.
.. instead of shutting it down redirect all DNS requests to a page that says "Hey, butthead, your computer is infected. Fix it!"
Is this a new one, or have the editors given up completely? /DNSChanger you fucktards
Are you sure? You may not be infected by this particular one, but it doesn't mean you aren't infected
"dcwg.org"? seriously?
.org website to run a security check on their computer?
Let me get this straight: the FBI is recommending people go to a nondescript
Can I next invite them to go to submit their information at fswrxt.net to check that their credit card wasn't hacked?
Simply false. DNSChanger can infect Windows, MacOS, and many consumer-grade routers that provide DNS or DHCP.
What's special about MacOS infections is that the user has to be an ignorant pollyanna to get infected. If I were you, I'd check my DNS config.
First DNSChanger, and now DSNChanger?! Thanks for the bad news, Editors!
Wait, which OS does this malware run on?
The "Feds" should have been redirecting these morons to a page that tells them how to get rid of it for months. Instead, now all these morons are going to be clogging up ISP tech support because "ma internets dun gone wonky and won't werk!"
-Kinsey
Did they serve up a web page that says, "You're infected, please go to xyz.fbi.gov to clean up your machine."
When I forget to pay my ISP, they redirect all my web pages to their own saying, "Sorry!" (And as an aside, they are idiots because they don't provide a link to pay from that disabled-page. It seems so obvious there's probably somebody with a patent demanding money to do that.)
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Derp. Seriously, now?
"DSNChanger"?
And this is yet another dupe of this tedious "story", last just two days ago.
FBI To Shut Down DNSChanger Servers Monday -- But Should It Cut Off 300k PCs?
Posted by Soulskill on Thu Jul 05, '12 04:18 AM
And a thousand Microsoft Access fat clients lose access to their back-end databases.
No, in this case, the malware is installed between the keyboard and the chair.
Why can't they just have all web traffic from the infected computers forwarded to a page with instructions on how to fix it instead of just shutting down the servers?
Redirect them to a page that says:
Please turn off your computer, put it back in the box, take it to the store and ask for your money back, you're too stupid to be allowed on the Internets.
DNSChanger infections by AS
Top infected ISPs:
source
Right... ignorant was the right word.
What a great idea! I'll just write a similar wallpaper-based antivirus in MSPaint right now.
Is it DSNChanger or DNSChanger? Pick one.
How do I know the FBI posted a PDF?
Because it doesn't have any logos or official headings!
I am not sure I trust opening a PDF, especially with Adobe Reader. They should have just used plain html.
DNSChanger affects Microsoft Desktop and Server Product. 99% of the internet and World Wide Web will be completely unaffected.
Snicker snicker
LoL
Pollyanna doesn't mean what you think it means.
Not sure why it was so important to mod this off-topic—there's a typo in the submission title!
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Why did this get flamebait? working in a PC shop 6 days a week i can tell you that since Vista damned near every bug I've seen has been a PEBKAC related infection.
What you see is the infections taking certain obvious routes over and over:: 1.- "ZOMG U got teh viruz! Run "Iz not viruz iz cleanerz!.exe" to kill teh bug ZOMG!" 2.-"want teh hot lezboz? U 2 can have teh hot lezboz! Just run "Iz not bug iz codecz.exe" and U can be watching teh hot lezboz right now!" 3.-"Want teh latest (insert Hollywood movie or song) for free? U 2 can have teh (insert Hollywood movie or song) for free! Just run "Iz not bug iz new limewirez" and U can have (insert Hollywood movie or song) right now!" 4.- "Hey my BFF on FB LOL! Look at my funny video! Just run "Iz Not Bug iz video.exe" and be sure to say yes to UAC so U can see teh funny!"
Notice how EVERY DAMNED ONE is a PEBKAC problem? That damned "New Limewire" one I even had an ID10T that I had to throw out of the shop because when the AV practically threw itself onto the screen screaming "ITS A BUG! DON'T DO IT!" what did he do? he uninstalled the AV and then wanted ME to fix it because "It says right there its the New Limewire so make it work dammit!"
So I'm sorry but as XP dies the days of the easy driveby are dying with it, replaced by an even easier target, lazy and or greedy and or stupid users.
ACs don't waste your time replying, your posts are never seen by me.
Translation: cracking (hacking for the media) is 95% social engineering. Always was. Always has been.
Don't fight for your country, if your country does not fight for you.
Keeping the server up for so long was a mistake. Not warning users was a huge mistake too.
What I would have done:
Keep the server up for 10 days. ... blah blah blah. Your internet connection will stop working in N days. Click here to continue to the site you where visiting".
Redirect all requests to a page that says "Your computer has been compromised
Simple yet effective.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
and mac you fag
it wont effect linux, but your obviously too stupid to something that didnt come with your mommy's computer
I don't understand the laziness of just turning the servers off and severing the uneducated dolts that haven't corrected for this yet.
It seems to me that the best public service that the government could offer in this case is to first change those servers so that all DNS requests lead to a single computer (or set of computers) that provide the same web page, regardless of what is requested: A page that explains that you could only be seeing it if you were infected with this virus, followed by instructions on how to get it cleaned up. The machine could also offer mail servers that accept any account and always return one message that matches the web page. Hmmm... I wonder if it would be possible to even simulate youtube, netflix, hulu and provide an educational video (since some of the yokels who are still infected may not be able to read all that well.)
It really doesn't seem that that should have been too difficult to set up during the past six months and it does seems like it might be an actual public service to attempt to educate the specific segment of the public that desperately needs it. The fact that the government is just going to shut down the temporary servers without taking this insanely obvious step in the process just shows how little they actually care for the people.
Sorry, I whine. I'll shut up now.
Until malware seriously impacts those who are affected by it, interest by people to defend against it will remain minimal. Spammers thrive in this environment, because people don't care and can get away with it.
I am still for a forced disconnect of any spamming botnet member until he has cleaned up his machine. When you drive your car on a public road, you have responsibility for it being roadworthy. Same logic applies to computers on the Internet. If you don't connect it to anything, I don't care how many kinds of malware your machine contains. If you go online, and you don't have working headlights, so to speak, you need to be taken off the road.
I've had this argument inside ISPs. I am disgusted to this day by their cowardice. They fear customers would leave for competitors. Yeah, they probably would. That's why we need laws and regulations here, so everyone is in the same boat, at least within the same jurisdiction.
So I applaud this move, though I think it should've come much earlier.
Assorted stuff I do sometimes: Lemuria.org
Notice how EVERY DAMNED ONE is a PEBKAC problem?
No, I don't. And I've given speeches about this very subject.
The problem is a user interface design problem. The computer lies to the user, a user untrained in computers and thus unable to spot the lie. I'm not talking about the "hot lesbians inside" lie, I am talking about the lie where the user intends to do one thing, instructs the computer to do it, and the machine does something entirely different without telling the user.
The computer displays an icon indicating that something is a video. User clicks on it, intending to watch a video. Instead, a program is executed and installs malware on the machine. There are so many design failures here, it is painful:
* false information about the nature of the object
* bad interface design not allowing the user to express his action clearly (clicking on an action has context-specific meanings)
* bad ACL allowing an unintended action to have even more unintended consequences
* bad feedback to the user as to what is actually happening
To abuse a car analogy - malware is like a CD that you put into your CD player in your car and it makes a copy of your car keys and when you're driving past the next post office, mails it to someone in Poland.
And you are blaming the driver. Seriously?
The real solutions are a little less convenient than simply blaming the user. They require thoughts, intelligence, lots of testing inside and outside the lab, to find better user interface paradigms. One that, for example, allows the user to make a difference between "show me this document" and "run this program". And a change in mindset that moves away from the "users are stupid, let's not bother them with the difference between documents and programs" to "actually, it turns out that with a bit of training, people do understand the difference between the switch that controls the lights and the one that controls the windshield wipers".
It also requires smarter technology that can really undo actions. When software installs follow the change set concept, then we are getting somewhere.
There's a lot more, and I don't claim to have even the majority of the answers, much less all of them. But I do know that we've been asking the wrong questions for way too long. I have about a dozen pieces of the puzzle that I've researched in depth, and in all cases it turns out that stupid users is not the root cause.
In fact, IT security would be a lot better off if it were to simply accept stupid users as a fact, just like limited memory and damaged network packages and find ways to work with them without falling over. You know, the Ping of Death was really, really embarassing. Most of IT Security is much like it.
And yes, I know what I'm talking about, I do this for a living, I give speeches about it, I've been doing research on this for over a decade. If you're in Europe, you can hire me on this.
Assorted stuff I do sometimes: Lemuria.org
Considering he was talking to a Mac user, I believe he meant "Friend of Dorothy."
Or you can look at the Apple logo in the upper left of your screen and masturbate furiously.
Which may be just as useless, but at least is more honest.
Also FatPhil on SoylentNews, id 863
No one sees the ".exe" extention except those of us who turn extension-hiding off. IzNotBugIzVideo.exe uses a video icon, and the same action (double clicking) plays videos and runs executables.
I remember jive and swedish chef, but it seems such "utilities" have fallen out of fashion.
So I hereby present, the iWank filter:
http://87.119.183.129/perl/rdf.pl
Also FatPhil on SoylentNews, id 863
I remember jive and swedish chef...
I plugged a quote from the movie Airplane! into a Swedish Chef translator:
"thet hunky moost be-a messeeng veet my oold lady"
What would someone in Poland do with my car keys?
Take off every 'sig' !!
Since you're reading this here, you're probably already aware...
Yes, yes we are. So why are you telling us again?
systemd is Roko's Basilisk.
Probably have better luck with hoping for better security.
So this bug tells a computer to use a different DNS and the FBI has been running said DNS to keep people online. Why can't the FBI server redirect all incoming traffic to a help page?
Wouldn't Windozers figure out something is wrong if every site they try to visit turns out to be a big splash screen explaining they have a stupid virus and a link to whatever will fix it?
If I mistype any URL I end up with a some advertising laden search screen generated by my provder. This seems like an easy solution and doesn't require umpteen million windose computers to be carried to the local repair guys tomorrow.
Build a car that works with them
I wish I had mod points, I'd give them all to you!
And saying that people who don't use the same OS as you are elitists tells us how far up your ass your head is.
No, sadly the translation is that hairyfeet has NEVER admitted MS software is responsible for problems.
Probably because reliable computers would mean the end of his business.
It's a much MUCH smaller deal than has been suggested.
At this point, the only way you have much chance of being impacted, is if someone's been totally negligent in the maintenance of the computer, and just does simply no security work at all for the computer and their LAN, or you are in a position of providing support for such a user, for network connectivity.
And I say that, because by now any DNSChanger impacted user has had a year to recognize the problem, and it's been a well-publicized threat.
Which - when run through GP's i-filter - yields:
iThet iHunky iMoost iBe-a iMesseeng iVeet iMy iOold iLady
You're not from Europe and it shows.
Over here in Europe, the Polish are famous for stealing cars. There's a bit of truth to it - quite a few stolen cars end up in Poland. In fact, I once had a polish girl friend, and she told me that she and her parents didn't leave anything of value inside the car when they were going back home to visit relatives, and were quite concerned with having their car stolen there.
Assorted stuff I do sometimes: Lemuria.org
Had you been using 100MB hosts files as APK does, your Internet would still work! Dummies!
I like and agree with most of what you said, but one small part jumped out at me.
"actually, it turns out that with a bit of training, people do understand the difference between the switch that controls the lights and the one that controls the windshield wipers".
See, it isn't that hard, even for non expert users to understand the difference between a program and a document. Is it so hard to turn on file extensions and see that despite the movie file icon, it is an exe and so a program?
You can only blame the paradigm so much. When users don't care about getting even simple thigns right, then it seems less of an issue with the paradigm and more an issue with users being willfully stupid.
If you ignore ACs because they are anonymous - you're an idiot.
The first step is actually the easiest if MS would get off their stinking ass and change a single default behavior as the OS Should Never - I say Never Hide any file extensions by default. This is the first setting I change on any window box I touch. It's not much but by god it helps the user detect that something is lying about what it is. Of course the PEBKAC still exists if the user doesn't pay any attention to the extensions - Seems that many americans now have less attention span then a damn Gnat. God help the internet.
Mod me up/Mod me down: I wont frown as I've no crown
Is it so hard to turn on file extensions and see that despite the movie file icon, it is an exe and so a program?
Who is the irresponsible idiot that hid the extensions in the first place, maybe it was the same that had by default auto start enabled on .inf files?
Yes MS I'm blaming you for bringing up a generation of clueless, at least in the DOS days we still knew what an extension stood for!
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Every few months or so, I see a post that deserves to be modded higher than the system allows because of the truths and insights presented. *sigh*
You nailed it. Hard. Respect to you kind sir.
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
I was just in Gdynia last week, and Toru last month.
Based on the technology I saw available, I think the only thing a Polish recipient could do with my car keys is melt them for scrap metal, or (as another poster has already pointed out) build a car to use the keys in.
Grr, stupid iPhone.
Toru -> Toru
AC -> FormOfActionBanana, "not from Europe and it shows"
Take off every 'sig' !!
WTFing F???
Toru -> Toru -> http://en.wikipedia.org/wiki/Toru%C5%84
Take off every 'sig' !!
"Untrained in computers?" How many *nix admins do you know who either always run sudo from an absolute path, or who enforce "write xor execute" on all filesystems for any user accounts authorized to run with elevated privileges?
What the FBI SHOULD have done is re-dirrect the web browsers of infected machines to an fbi.gov site informing them of the problems and providing instructions on how to re-install windows. Then mabey a link to add a cookie to bypass and keep browsing.
Then we have the issue that the malware is still live, but the FBI is controlling it. Does anyone else see a massive oppertunity for the FBI to use this to spy on people like the malware's original authors did.
For most people its going to be a slight headache to re-install, but nothing more. It should have been months ago.
That's a solution requiring technically informed users.
I propose something different: Icon markings. Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files. A designer will have to work out the best option there. For this example, assume that it is a glow - executables glow, nothing else can ever glow, there is no way to make other symbols glow.
Users could be trained to look for that cue, that something that glows is a program, no matter what it otherwise seems to be, and that if an alleged image glows then it isn't an image.
Of course, that's a workaround. The real fix would be to realize that the metaphor is wrong that opening a program and opening a document are the same thing, because they aren't.
Imagine that nobody had ever thought of making a click do two different things. Imagine that from day one, we would have agreed that left click opens a document file, while right-click runs a program. All of those stupid e-mail attached trojans would fail, because the users would left-click them, expecting a picture or word document, and they would get their picture viewer open or word, showing them that the file is corrupted. They'd be none the wiser that it is a trojan, but a) they would not have been infected and b) it is highly unlikely that they would try to right-click it.
Assorted stuff I do sometimes: Lemuria.org
I have to agree with hiding the file extensions is a stupid idea, and yes, I turn that off as one of the very first things I do when I touch a computer.
Less attention span has very little to do with Americans and just people in general. It comes from the multitasking that the younger generation gets thrown into. They just can't pay attention to any single one thing for a decent amount of time. They are so used to juggling 5 things at once, and the human brain just doesn't multitask well for 98% of the people out there; I did read that around 2% (numbers aren't accurate, but it was indeed a small percentage) of people can actually multitask 2 things at once with little degradation of performance in either task, but it didn't say how good they were doing those tasks to start with.
Are you really this stupid? They actually pay you to make speeches about technology and this is what you give them. Here's a clue - *EVERY* action on a computer involves running some code. Even the "Show me the document" involves running code. The bad guys will use whatever they can to hide themselves and lie to the user. You're stupid suggestions do nothing to make this better. Making the user aware that they run a program to view a document will change nothing. They will simply drop context that they have to run a program and they will merely view is as they are viewing a document. You don't know how many times I have to inquire again and again as to what program they are actually running - even when they have to first run the program to view the document. They still don't know and they don't care. Viewing the document is all they think of. There will always be stupid users and they will always outnumber smart ones - just like there will always but stupid Europeans trolling the net looking for work selling their ill-formed opinions.
Windows and OS/X -- or roughly 99.8% of the PCs out there.
I know that we don't see eye-to-eye on many topics hairy, but I'm definitely with you on this one -- mostly.
Computers have gotten easy enough to use that most people think they can operate one. These types of things didn't happen 25 years ago when people using computers actually knew what they were doing. It's not that users are stupid, because most of them aren't. It's just they don't know enough about their computer to keep themselves out of trouble, and they have no real incentive to learn before trying breaking stuff. Of course it's guys like you in your line of business that have to clean up after them as they learn the hard way.
I'm wondering why the fsck it took so long. One of my previous job was at an ISP, and I had no problem cutting off customers if their machine was spewing off crap. (I probably enjoyed it too much)
Any of you repaired a 10-toolbar machine (where nothing was installed of course, and they never opened unknown emails)?
I fixed my sister's laptop last week, and it probably had more malware than software installed on it.
So yes, cut them off... Internet access isn't a right, if you can't manage your network you shouldn't have intertubes access.
(If my ISP cut me off because one of my machines was creating havoc on their network, I would gladly take it off and thank them for warning me about it)
I've got better things to do tonight than die.
Which sounds worse, "300000 USERS WILL LOSE INTERNET ACCESS!" Or "LESS THAN 0.01% OF INTERNET USERS WILL LOSE INTERNET ACCESS".... I think it's silly when you actually do the math. Not to mention the fact that it's not like they are going to lose an arm or a leg. It's not like their going to be denied food or shelter. It's the Internet FFS. Go to Best Buy and grab some anti virus, and then go back to trolling facebook all day. Problem solved.
I'm sorry but he's full of shit because he is still pretending everyone has WinXP when in Vista and Win 7 there is UAC WARNINGS before you launch executables but NO warning before you just play a video.
And perhaps you both better read what I wrote again because in damned near every case the AV TRIED to stop them, did everything but yank the damned keyboard away, but they simply refused to listen (or in the case of the "New Limewire" guy) actively REMOVED THE ANTIVIRUS TO ALLOW THE MALWARE IN.. Now you tell ME friend, short of an Apple style "You may do nothing without corporate approval" style iOS can you stop that in ANY way by changing any part of a UI?
The answer is you can't, because its NOT a UI problem, despite the "ZOMG HAIRY WORKS FOR M$" troll we had in this thread, its a dancing bunnies problem where the user KNOWS what they are doing is risky, they KNOW there is a more than average chance at infection, but for free movies/music/porn/stuff they simply DO NOT CARE and will happily help the malware writer remove any and all roadblocks that get between them and the prize. so I'm sorry, but you can't fix a user problem with a tech solution, it just doesn't work unless you take away all the rights and give them thin clients.
ACs don't waste your time replying, your posts are never seen by me.
You are missing the point friend in that they do not NEED to see the extension because while it is an executable the AV will be SCREAMING at them "Don't run that!" and they will DO IT ANYWAY because they want the porn/music/video/kitty screensaver.
Here let me give you an example, a real swear to God that happened in a small business I was working at setting up some systems: ME "Do NOT run that! Its a password protected zip with the password in the email! Its a Virus!" Velma "Oh you worry too much, its from my BFF Kim, see her name right there? Oh and it says its kitty pictures, i love kitties!" ME:"It is NOT from your BFF Kim because I KNOW KIM and she wouldn't have a clue about how to set up a Pword protected zip!" Oh you are just paranoid, stop drinking so many colas!" /Velma promptly ignores me, runs contents of zip, next thing here comes the pop ups/ "Velma:oops... ME..........
And NOW do you see why extensions doesn't help? if the AV is saying NO and an honest to goodness human with years of experience is saying HELL NO and they do it anyway, how in the hell are you gonna stop them with extensions? Even the dumbest moron knows there is free AV out there, but that doesn't help if they ignore it if it gets between them and the "goodies" the malware writer is offering, as they will disable or even uninstall the AV if that is what it takes. Its PEBKAC friend, tech can't fix that.
Oh and the ONLY reason I was pointing out the extensions is that IE WILL LET THEM SEE THE FULL NAME including the extension as they download and they STILL ignore it, they just don't care.
ACs don't waste your time replying, your posts are never seen by me.
That's a solution requiring technically informed users.
It's nice to see someone else who doesn't see showing file extensions as some kind of panacea for computer issues. It really wouldn't help at all.
I propose something different: Icon markings. Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files.
I like this idea, but it seems like an unsolveable problem: How do you decide what is "executable" and what isn't? Sure, there are well-defined executable binaries for each operating system, but there are also a myriad of other ways you can run code. Whether it's a Bash script, VB script, embedded macro of some kind, etc. In Windows, the shell (Explorer) runs ShellExecute on the file to invoke the filetype's registered handler -- how would it know ahead of time what that handler might do? I could display an image or it could load embedded bytecode and run it through an interpreter.
And, on Windows at least, this "glow" already exists to some extent. Files downloaded through most (all?) browsers these days are given the "mark of the Internet", and alternate data stream tag that says "this came from the web". When a user runs a program (or certain other file types), a dialog box is displayed that says "Warning! This is an untrusted program that may break your computer!". Users simply ignore this -- will a glow be much different?
Imagine that from day one, we would have agreed that left click opens a document file, while right-click runs a program. [...] it is highly unlikely that they would try to right-click it.
I think I have to disagree with you on both counts here. First, because even if systems had been designed that way at the beginning, they would have evolved to what we have today. The reason is simplicity: We simply want the computer to "open" whatever it is we're interested. I don't want to be bothered every time, trying to decide if the file I'm looking at falls under "document" or "program". Say, for example, an HTML file. It's a "document", sure, but it also may contain various forms of scripting which falls (or should) under "program". Computers are supposed to take care of easy repeated tasks, surely knowing how to display a given type of file falls under that.
Second, and partially because of the first, I think users would very quickly train themselves to start right-clicking anything that didn't work when they left-clicked it. Download a good program and left-click it by habit -- oops, didn't work, hmm, try right clicking -- it works. Now they download an evil cat picture and left-click it -- oops, that didn't work, hmm, try right-clicking -- it works (and they're now infected).
Humans are very good at making deductive steps towards solving a problem -- "I tried left-click and that didn't work, but I know that right-clicking also does things to files I download, I will try right-clicking. It worked, therefore right-clicking is the answer when left-clicking doesn't work. Stupid computers, why are they so hard to use?" -- and then the whole system is void. If you observe users trying to figure something out, you quickly see they come up with all sorts of odd and unusual ways of going about it, just because "that's what works".
Fundamentally it comes down to understanding the separation of the two kinds of files and why it's important to treat them differently. This requires technically informed users -- the very same flaw as simply displaying file extensions.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
The really really popular one.
Jack of all trades,master of none
How many people cried out to take away extensions when using XP? I'm sure this is just another case of corporations pushing 'the users are stupid', either because they think that sells or they desperately want to make it true.
I'm sure he's positive.
And yes, I know what I'm talking about, I do this for a living, I give speeches about it, I've been doing research on this for over a decade. If you're in Europe, you can hire me on this.
Wouldn't life be wonderful if everyone who made speeches knew what they were talking about? What part of dancing bunnies is eluding you? Sure some users are morons, but the rest will do about anything to see those bunnies.
The problem is that your anecdote is not necessarily as representative as you seem to think it is.
Many AV's WILL report P2P programs as malware when this is not the case. McAfee lists TPB as a malicious website. "New Limewire" does indeed sound like malware (despite me being able to find NO references to any software by that name), but are you sure the AV wasn't just blocking non malware p2p software the user wanted to install? Just because the AV says something is malicious does not make it so.
I agree that the problem is more to do with users than UI, although I think both play a part. I think probably the largest problem is people may understand the problem, but not the consequences. Especially these days when malware tends to spy or operate in the background and is no longer inherently destructive. A user may want their PC to work the way they want it to, and may accept being spied on or being part of a botnet as acceptable, because they don't understand the consequences.
If you ignore ACs because they are anonymous - you're an idiot.
HOWEVER, there is a difference in attitude between "losers are stupid and should never be informed of the facts of life" and something at least aimed toward making the users more informed.
If you have a deadly disease, there is a difference between the doctor knows the name and refuses to tell you that name and the doctor tells you the name but you are not competent to understand the terms. Me I prefer the latter.
Hiding file extensions does not do EVERYTHING to help out the bad guys, but it does draw a line in the sand as to where Microsoft stands regarding informed victims of its software.
What if you can never execute programs directly. You can only open documents, the UI only presents documents. Open a document and it's program is launched. When programs are installed blank documents are also installed in a "stationary store" of some sort, and protected.
A malicious program lies about what it does?!
A computer is a machine. People who think a machine has any sort of inherent benevolence or honesty towards users, rather than doing whatever stupid shit it is programmed to do, are going to be the first against the wall come the robot uprising. They certainly shouldn't be owning computers.
Here's a clue
You think that I could study computer science without realizing that? What you don't realize is that there is an important difference in running a known application and having it open a file and running an unknown application. Secondly, that there is a difference between running an application when you want to and know that you are doing so and running an application without realizing that you are doing so.
The bad guys will use whatever they can
That, exactly, is the point. Why do we give them so many ways to use?
You're stupid suggestions do nothing to make this better.
Sorry to burst your babble, but some of "my" suggestions aren't my own inventions but are from peer-reviewed articles that show they do have the desired effect. Unfortunately, much of this has never gone beyond prototype stage, because the major OS vendors aren't accepting the responsibility, either don't give a fuck (MS), are too focused on not breaking the consistency of their design (Apple) or are run by geeks who don't understand user interface design (Linux).
Making the user aware that they run a program to view a document will change nothing.
I see you are one of the people who believe that user awareness is the problem. It isn't. The futility of user awareness trainings, which we in the IT security industry have been running for decades to little effect, should've made clear that this isn't true.
There will always be stupid users and they will always outnumber smart ones
There is no such thing as a stupid user. Every time an IT security person uses the word "stupid user", he is trying to draw attention away from his own failures. I have done root cause analysis on "stupid user" topics, and I can show you a deeper cause for every issue commonly attributed to "stupid users".
Your attitude towards users is one of the reasons that things are as ugly as they are. If car makers would think the same about drivers, our highways would be slaughter houses and people would dread driving, not enjoy it.
Assorted stuff I do sometimes: Lemuria.org
When it found the bad guys in estonia, the FBI had a clean DNS server setup to replace the malicious one. Monday that server is being shut down. Why didn't the FBI have that DNS server re-direct all page queries to a single page that says "You are infected with DNS changer, you need to do this ..."?
How do you decide what is "executable" and what isn't?
Good point, yes. I don't have an answer for that. The reverse would be easier: The system knows what kinds of file types it can handle that are not executables.
Users simply ignore this
Of course they do. We've trained them for a decade that warning dialogs are a nuissance, nothing important is ever in them, they're filled with techno-babble, and interrupt their work at the worst possible moments and the default option is almost always the one they want.
The reason is simplicity: We simply want the computer to "open" whatever it is we're interested.
I believe we've been trained to think that way. I remember times when that wasn't true. Early computers didn't have this metaphors. You did not "open" a document from the command line. You ran a program and then opened the file from that program's open dialog. I still remember that opening a document directly was confusing to me at first.
Download a good program and left-click it by habit
But that's today's habit. My thought experiment was assuming that what we have today never happened, so this habit has never formed.
Fundamentally it comes down to understanding the separation of the two kinds of files and why it's important to treat them differently. This requires technically informed users -- the very same flaw as simply displaying file extensions.
I do believe that users aren't that stupid - you just have to speak their language. File extensions and binary code isn't their language.
What we need are better metaphors. The ones we have suck. Humans are fantastic at applying metaphors. I'm not a linguist except by interest, so I don't think I can come up with the solution. But I've done enough research to believe that the solution lies somewhere in that direction.
It'll be a jump, one we can hardly imagine. Like multitouch - it seems to natural and obvious now that we've had it for a while, but 20 years back it wasn't obvious in the least. Gestures? Please. Go back 30 years and try to explain gestures to the C64 home computer crowd. A mouse was revolutionary in those days.
I believe we will solve this on the user interface design front, and then we'll look back and wonder how we could ever be so stupid.
Assorted stuff I do sometimes: Lemuria.org
Doesn't work because you have quite a few programs that do not work with documents. Screensavers, utility programs (say, Quicksilver, Dropbox, etc.) and others.
Also, you have programs where documents are secondary at best. Most network tools (browser, e-mail, etc.)
Assorted stuff I do sometimes: Lemuria.org
If come Monday, and you have to help a friend regain DNS, Google's public DNS is at 8.8.8.8 and 8.8.4.4.
More here
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
UAC WARNINGS
One of the most useless, uninformative, unproductive computer messages there is.
so I'm sorry, but you can't fix a user problem with a tech solution,
People do it all the time. e.g. physical locks. M$ has been using this patheic excuse for decades to cover up their own incompetence (actually, willingness to profit more at the expense of pretty much everybody else) and it's sickening. They've raised two entire generations of people who think it's their own fault if their computer crashes or is infected. Even their current computer security iteration (so-called trusted boot) is more of the same. All about a small increase in profit to them at a large increase in cost to everybody else.
You nailed it. Hard. Respect to you kind sir.
That's what she said!
*ducks at incoming Karma hit, but I couldn't let this one slide*
"As the intrepid kobold companion continues his journey, he begins to wonder... if priests raises dead, why anybody die?
Which - when run through GP's iFilter - yields:
iFTFY
So what do you do when I add a picture to my files that makes it seem like they glow?
If something is possible on an icon it's possible on every icon.
I would NEVER EVER use a computer where I cannot root it if I need to.
*clap clap cap* This.
Try this for a change:
Update users mail client after user has been asking for it for 1year non-stop saying it's so much better.
1st hour after updating mail client.
"This mail sucks, the cursor goes down instead of up when I'm deleting an e-mail, this makes me delete e-mails I don't want to delete!"
2nd hour after updating mail client.
"The calendar is at the wrong place, the button is supposed to be on top, not on the bottom."
HOW IS THIS NOT A STUPID USER?
But you're not getting it. She's ignoring the warnings BECAUSE she's been conditioned to. Even "dumb" people get conditioned to this.
Using an obviously ill stated car analogy: If your warning light on the car was broken, and every time you started it it came on, but your mechanic told you it was just a faulty warning light, you'd ignore it. You're busy, and it would cost too much to fix.
Then another one does the same, and you check on it, and the mechanic tell's you again to ignore, or pay 2000 to fix it.
And one day, a light comes on, you ignore it, and the engine explodes.
Actually the one you're pointing out apple released a fix for in 10.6, therefore if your system is updated you're not infected by that specific one. But your point still stands, Apple Machines are as easily infected by a DNS changer as anything else that uses DNSes...
No, it's still "hacking", albeit illegal. "Cracking" usually refers to breaking copy-protection schemes.
News flash: people in NYC do the same thing. Not because they fear their car will end up in Poland, but because they fear it will be broken into, their possessions will be stolen, and the car might even be taken as well. Whether it ends up in Poland or a Bronx chop shop is irrelevant.
Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files.
Technically any file is executable in the sense that when you double-click it, the OS may launch an associated app. For example, if you double-click a PDF file your OS usually launches a PDF viewer. And if we're talking Adobe Reader, you're potentially asking for a world of hurt if the PDF file contains an exploit. So you either have to warn the user every time they're about to launch an executable (in which case they will ignore the warning since it pops up every time), or only the first time. And then virus writers will program their malware to strike only upon second launch. So your scheme is still useless.
Dude I offer to install P2P for them if that is what they want so that is NOT the problem, all they have to do is ask and they'll have BT, Gnuc, eMule, whatever, as long as they don't expect me to support it it is their PC and I'll give it to them and make it clear I will. The "New Limewire" bit was right after they closed the real Limewire and a bunch simply refused to accept that LW was dead and downloaded "New Limewire" which was a Gnuc package loaded with trojans.
And how do you explain the "ZOMG U got teh viruz!" installs of Security Tool and AV20xx? Every single machine that leaves the shop has either Avast or Comodo IS installed which will TRY to warn them but again they ignore it. Or the "porn codec" bug? I actually had to find a bug free porno site just to keep certain customers from constantly falling for that one. Again the AV TRIED to stop them, but they'd rather have the titties so they ignored it.
Finally its not that they they "don't understand the consequences" it is that the "prize' of free music/movies/porn/whatever is worth MORE to them that a clean PC. Its the classic dancing bunnies problem that simply can't be solved with technical means because the users wants the bunnies MORE than they want the clean PC. Believe me friend, i've seen it a million times, all they have to do is offer the right bunny and the users will happily destroy any and all roadblocks you put in to see the bunnies. Every time a new Twilight comes out at least a half a dozen females will get infected by running "Twilight (name of movie) player.exe" and in every damned case the AV practically tried to jump on the keyboard to stop them and they ignored it, not because of any P2P blocks but because they wanted to see the new Twilight for free more than they cared what the AV said.
With all the money spent each year to patch holes and deal with user stupidity, don't you think MSFT and the AV vendors would LIKE to be able to stop this? Imagine the sales of a "user proof" AV, that corp would be richer than God, but there simply isn't a way to ward off a user fighting for the malware unless you stuff them into a walled garden and refuse to let them do anything without permission from an outsider, and most simply won't put up with that.
ACs don't waste your time replying, your posts are never seen by me.
How has she been conditioned to ignore ME, sitting right exactly there, telling her "Its a fucking bug!" and pointing out the person sending her the bug wouldn't have the skills to send a real anything that way?
In the end friend it has NOTHING to do with conditioning and everything to do with the dancing bunnies problem which is as old as the hills. The user WANTS the bunnies, you try to stop them from getting the bunnies she/he WILL IGNORE YOU and do whatever it takes to get the bunnies, simple as that. You can show file names, have the AV show a picture of Goatse with an arrow pointing to it saying "This is you if you run that" and it will not matter because they WANT the bunny dammit!
ACs don't waste your time replying, your posts are never seen by me.
You're talking a lot of sense here. As a user support person, my life gets a million times easier when I remember to see my users not as stupid, but as inexperienced. I remember that I can't do their jobs, so I shouldn't expect them to do mine and have the same level of comfort and education with IT systems. In nearly every case where the user is interested in the "why" something isn't working, they can understand it.
Also, it infected a lot of routers... Most people have no idea they should change the default password on their router (as opposed to their wifi network), or that such a password even exists! So a lot of people will *think* their iPhones, iPads, etc are infected when it's the router.
Tape a copy of the repair bill to the side of their monitor with the total in large font.
in Vista and Win 7 there is UAC WARNINGS
UAC has one and only one actual effect that has been verified by independent researchers: It trains people to ignore warning dialogs. I'm not joking, that is literally the result of studies done on the subject.
So, you were saying?
Now you tell ME friend, [...] can you stop that in ANY way by changing any part of a UI?
Yes, you can. Chameleon was a university prototyp designed specifically to deal with the malware download issue not by technological, but by UI means. That's just one example I can cite right away. If you research the topic a bit, you will find many ideas that have, at least in the lab, been shown to at least improve the situation, sometimes considerably.
If you're looking for a magic bullet, then I'm sorry, all I can offer you is the harsh truth of IT security: There are no magic bullets.
because its NOT a UI problem,
Says who, based on what studies?
HAISA (Human Aspects in Information Security Assurance) is a relatively new field, and as far as sciences go, quite immature (Stanton, "Empirical vs. Non-Empirical Work in Information Systems Security", 2007 - if I ask for studies, I should provide some for my points). As such, there is still a lot where we don't know, are partially or totally guessing, or have incomplete data. One thing we do know, however, is that in a THS triangle, only a small subset of security issues rest strongly in the "technology" corner. Many security issues are partially or strongly influenced by human and/or social factors. It stands to reason - and many studies, experiments and prototypes support the theory, e.g. the one outlined above or a couple of those listed in my keynote "Security & Usability" (DFN-CERT Workshopband, ISBN 9-783844-806885), that user interface improvements do have a measurable impact on those.
I'm sorry, but you can't fix a user problem with a tech solution
It's not a tech solution. It's a user (interface) solution. Just above you complained that it's not a UI problem, now it suddenly is a user problem. I'm sure you know what the "U" in "UI" stands for, so please make up your mind.
Assorted stuff I do sometimes: Lemuria.org
They certainly shouldn't be owning computers.
Welcome the the 21st century, I hope you had a restful cryo sleep. They should have told you in debriefing that this sentiment went out of business 10 years ago.
Assorted stuff I do sometimes: Lemuria.org
The dancing bunnies was an interesting blog idea with a good punchline and made a really good summary for a well-known problem. It is always worth to stop and think about it.
It is not, however, absolute truth from on high. It's a simplified aphorism on a real problem. Don't judge actual research against aphorisms. The funny thing about researching humans is that more often than you think, the truth is counter-intuitive, more complicated than everyone thought, or just outright strange.
For example, Miller and Wu ("Fighting Phishing at the User Interface", 2005) made a study where the change of a dialog element from buttons to a short drop-down list dropped the error rate of users from 30% to zero.
Assorted stuff I do sometimes: Lemuria.org
Technically any file is executable in the sense that when you double-click it, the OS may launch an associated app.
You may have noticed in my posting that this is what I consider the root cause issue - the one action (a double-click) can cause different things based on intransparent dependencies.
I'm not trying to solve all security issues with one stroke, that's impossible. I am showing an idea for one specific problem to demonstrate that solutions exist, we don't have to take some stupid idea some idiot once had up the arse for all eternity.
Assorted stuff I do sometimes: Lemuria.org
So what do you do when I add a picture to my files that makes it seem like they glow?
If something is possible on an icon it's possible on every icon.
Nonsense. I can easily add some kind of effect to icons OS-side that is disallowed or technically impossible within the icon itself. For example, something that extends beyond the visual space of the icon itself, or a marker that is displayed next to it.
Assorted stuff I do sometimes: Lemuria.org
I know nothing about you except those few sentences and yet I'm sure that the users you support like you more than they like the geeky guy who tells them they're stupid idiots - even if he is better on the technology.
And I'm sure they are more likely to tell you what they actually did when it broke than give the usual "nothing" excuse.
That's the part the too many security people don't get - that trust is something that is built in mutual respect. Many security people are right in distrusting the user - because the users are in fact distrusting their security people.
Assorted stuff I do sometimes: Lemuria.org
HOW IS THIS NOT A STUPID USER?
What part of his complaints do indicate a low intelligence? I agree with you that he's a PITA and probably whining for no reason, and whatever else you want.
But I don't see indications of stupidity. Maybe you are using that term in an exceptionally broad sense for everything you dislike about users?
Assorted stuff I do sometimes: Lemuria.org
Well you would THINK after me handing them the bill a couple of times they would get a fucking clue and at least call or email me before doing something REALLY stupid, but instead I've found it settles quickly into one of 2 camps. 1.-The ones that listen to me, which run year after year without needing me for more than hardware upgrades. i like these customers a lot, even though I make less money off of them, because they are just so easy to support. I tell them what is bad, point them to what is good, and they listen, its nice.
The other camp simply ignores everything I say, and after clicking ignore enough times on the AV ends up with more viruses than a Bangkok whore on coupon night. The totally gobsmacking batshit part? they will simply KEEP USING THE INFECTED PC until it simply won't run anymore and THEN bring it to me. They of course make me more money but every time you get spam, have your internet slow to a crawl because of the latest worm? you can lay the blame at these bozos, because in the end nobody is gonna keep them from that free movie/music/porn/ screensaver dammit!
Just as a test I gave one of the "must have teh tittiez!" customers Mepis, just to see if the vaunted Linux security would keep Goober from shitting on the PC, did it work? Nope, he made it unbootable in less than a week, how? He decided he didn't like the package manager and just Googled "Linux programs" and got enough crap off of Freshmeat (boy is THAT name perfect) to put the entire system in dependency hell...sigh.
In the end you just can't fix stupid, you just can't. You can try to lessen the damage the average mouth breather can do but in the end you'll end up having to clean up the mess, because some will simply NEVER learn or worse think they are smarter than they are, but in either case shit will be broke and malware will spread, all you can do is clean up the messes.
ACs don't waste your time replying, your posts are never seen by me.
OK, this is a short reply, since you seem to have misunderstood my last reply. Even though you are not actually disagreeing with me.
It isn't a dancing pigs problem(the more common name), because the user is not aware of any breach of security.
It doesn't matter what the AV says. AV's lose credibility when they report non-malicious stuff as malicious. As I said, McAfee counts aircrack and thepiratebay as malicious. If you know enough to know thepiratebay is not malicious then your AV loses credibility.
The reason it isn't a dancing pigs problem is because the user does not understand the consequences. They are not making a choice to choose pigs over security, because security does not come into the equation. They can be part of a botnet, but it doesn't affect them in anyway. They don't notice a slowdown, don't lose access to their documents etc.
The consequences here are that they are participating in DDoS attacks, potentially having their passwords farmed so spam is sent from their accounts, maybe cc numbers, etc. But, most of the time it doesn't affect them directly, so they are not aware of it.
It isn't like 10 years ago where malware would fuck up your documents and programs. These days there is generally little sign to the end user, which is why they are not aware of the consequences, because they don't even know that anything is happening. Regardless of what the AV says, which is not trustworthy anyway.
Oh, and a tip might be to stop giving customers Avast which is overly loud and noisy and tends to freak people out or make them ignore the warnings. Give them MSE instead.
If you ignore ACs because they are anonymous - you're an idiot.
Screensavers are run by the OS not by the user.
Dropbox client (and that ilk) are also a service that gets run by the OS. Put a new item in the control panel to setup what gets synced.
Your browser hides - it's documents are web-links.
Your email hides, its documents are emails. They just appear in the inbox folder, you can move them to other folders, to send an email - double click the "Untitled Email" document in the store.
Things like 7zip work on document by left clicking the document.
Printing can be done this way as well, it actually just opens the handling application but it also autoloads the document, triggers a standard print, then closes the document and quits the application