Slashdot Mirror
DNSChanger Shut-Down Means Internet Blackout Coming For Hundreds of Thousands
Since you're reading this here, you're probably already aware that in the early hours of Monday, lots of DNS calls are going to fail as the FBI turns off servers from which Windows machines infected with DNSChanger have been served. New submitter SuperCharlie adds a reminder of the impending shutdown, and adds:
"The FBI has a step-by-step method for you to see if you are infected in this PDF document, or you can go to dcwg.org for an automated check if you are so inclined."
Zzzz, when will the ignorant Apple trolls get bored of these things?
http://techland.time.com/2012/04/23/dnschanger-fbi-warns-infected-computers-will-lose-web-email-access-in-july/
"DNSChanger targets Windows or Mac systems (Linux, iOS and Android users are in the clear) by manipulating Domain Name Servers (DNS), which translate syntax-based URLs into IP addresses. "
Is anyone else sick of hearing about this?
Just shut the servers down already and be done with it.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
They'll be getting lots of calls from all of the inept n00bs who got infected soon.
Is disconnecting hundreds of thousands of infected machines really a problem?
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
What was ignorant about my comment?
It is fact that DNSChanger does not infect OSX. It doesn't infect iOS. It doesn't infect Linux, or BSD, or Amiga, or Android, or BeOS, or Plan 9, or Chromium, or OS2, or Solaris, or EMACS. I happen to be running one of the many OSs it does not infect.
Seriously? https://www.google.com/search?q=dnschanger+osx
Never ask for directions from a two-headed tourist! -Big Bird
iNo, iBut iYou iAre iNfected iWith iThe iFanboi iTroll iVirus, iWhich iS iNfinitely iMore iAnnoying...
IMO not informing them of what happened is. Believe it or not disconecting people, does not solve the problem, they buy a new computer take it to geek squad who nukes and paves it and sells them a rediculously overpriced unreliable antivirus. What could help would be to redirect the DNS servers to an informational page on how to clean off the current infection (IE hosting some cleanup tools), with tips of how to avoid infection again. No it won't educate 100% of them, some will take it to geeksquad anyway, some will find the download button and not read anything etc... but SOME will, and some is always better than none.
.. instead of shutting it down redirect all DNS requests to a page that says "Hey, butthead, your computer is infected. Fix it!"
Are you sure? You may not be infected by this particular one, but it doesn't mean you aren't infected
"dcwg.org"? seriously?
.org website to run a security check on their computer?
Let me get this straight: the FBI is recommending people go to a nondescript
Can I next invite them to go to submit their information at fswrxt.net to check that their credit card wasn't hacked?
Simply false. DNSChanger can infect Windows, MacOS, and many consumer-grade routers that provide DNS or DHCP.
What's special about MacOS infections is that the user has to be an ignorant pollyanna to get infected. If I were you, I'd check my DNS config.
Wait, which OS does this malware run on?
You seem to be assuming the FBI kept them running all this time because they gave a crap about the affected people.
How delightfully quaint...
By the way - this message may come as a surprise but it turns out, I have a Nigerian Prince in my family who is struggling to make an overseas transfer. Please send me your Name, Address, Telephone Number, SSN, CC numbers (with PINs and CVV's) and bank account details (with web login passwords) and I'll cut you in for a $ couple of million.
Lawful Intercept, aka your friendly neighborhood backdoor. As used by law enforcement officials and black hats alike.
The term "lawful intercept" describes the process by which law enforcement agencies conduct electronic surveillance of circuit and packet-mode communications as authorized by judicial or administrative order.
http://www.cisco.com/en/US/tech/tk583/tk799/tsd_technology_support_protocol_home.html
"I've got more toys than Teruhisa Kitahara."
Did they serve up a web page that says, "You're infected, please go to xyz.fbi.gov to clean up your machine."
When I forget to pay my ISP, they redirect all my web pages to their own saying, "Sorry!" (And as an aside, they are idiots because they don't provide a link to pay from that disabled-page. It seems so obvious there's probably somebody with a patent demanding money to do that.)
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
You don't want to redirect them to a page which tells them how to get rid of a virus. Believing pages that tell them that their system has malware and they need to follow the instructions on the page to get rid of it, is one of the common means of *spreading* malware.
1) It's a bad idea to train users that they should actually believe a web page that tells them they have a virus and how to remove it. This is typically used to spread malware, not remove it.
2) The FBI wanted this to go on as long as possible, because it allows them to spy on the traffic sent to the now FBI-controlled servers.
Believe it or not disconecting people, does not solve the problem, they buy a new computer take it to geek squad who nukes and paves it and sells them a rediculously overpriced unreliable antivirus.
Actually that scenario does solve the problem. Infected machines need to be formatted and reinstalled.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
"DSNChanger"?
And this is yet another dupe of this tedious "story", last just two days ago.
FBI To Shut Down DNSChanger Servers Monday -- But Should It Cut Off 300k PCs?
Posted by Soulskill on Thu Jul 05, '12 04:18 AM
And a thousand Microsoft Access fat clients lose access to their back-end databases.
It's a massive win to me, because many of those people will probably sell their computer outright and buy another one, and then I can buy some of them (the nicer ones, anyway) at yard sales. A year or two ago (two I think) I got an Athlon 64 X2 4000+ system with a 20" LCD for $125 because the owner forgot the Admin password and couldn't figure out how to run recovery. The LCD also has S-Video, component and composite inputs and I'm using it for my PS2 right now...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
No, in this case, the malware is installed between the keyboard and the chair.
DNSChanger infections by AS
Top infected ISPs:
source
Yeah, I find it amusing when people talk about using enterprise networking gear when they've had legislatively-mandated backdoors installed for many years.
(Not that the hardware isn't better, just not for that particular reason)
Redirect all queries from the malicious servers to a page explaining that they have malicious DNS servers configured and they need to fix the issue.
Some will check the problem themselves, others will call their ISP's,tech support,etc
Someone using the net should have a clue what DNS is about anyways
What a great idea! I'll just write a similar wallpaper-based antivirus in MSPaint right now.
How do I know the FBI posted a PDF?
Because it doesn't have any logos or official headings!
I What could help would be to redirect the DNS servers to an informational page on how to clean off the current infection (IE hosting some cleanup tools), with tips of how to avoid infection again.
That describes most of the techniques Trojans use I come across on the web
What they could have done was to set the DNS:es to point to the same web page regardless of what address that was requested.
That would have been a lot more informative.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
> Is disconnecting hundreds of thousands of infected machines really a problem?
It doesn't disconnect the machines, as many people have already pointed out. It simply causes their DNS lookups to fail.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
Not sure why it was so important to mod this off-topic—there's a typo in the submission title!
Bio questions? Ask me to start a Q&A journal. Computer analogies available for most topics!
Why did this get flamebait? working in a PC shop 6 days a week i can tell you that since Vista damned near every bug I've seen has been a PEBKAC related infection.
What you see is the infections taking certain obvious routes over and over:: 1.- "ZOMG U got teh viruz! Run "Iz not viruz iz cleanerz!.exe" to kill teh bug ZOMG!" 2.-"want teh hot lezboz? U 2 can have teh hot lezboz! Just run "Iz not bug iz codecz.exe" and U can be watching teh hot lezboz right now!" 3.-"Want teh latest (insert Hollywood movie or song) for free? U 2 can have teh (insert Hollywood movie or song) for free! Just run "Iz not bug iz new limewirez" and U can have (insert Hollywood movie or song) right now!" 4.- "Hey my BFF on FB LOL! Look at my funny video! Just run "Iz Not Bug iz video.exe" and be sure to say yes to UAC so U can see teh funny!"
Notice how EVERY DAMNED ONE is a PEBKAC problem? That damned "New Limewire" one I even had an ID10T that I had to throw out of the shop because when the AV practically threw itself onto the screen screaming "ITS A BUG! DON'T DO IT!" what did he do? he uninstalled the AV and then wanted ME to fix it because "It says right there its the New Limewire so make it work dammit!"
So I'm sorry but as XP dies the days of the easy driveby are dying with it, replaced by an even easier target, lazy and or greedy and or stupid users.
ACs don't waste your time replying, your posts are never seen by me.
but if they are running on enterprise gear often is also flash-able so you could load a custom Linux or BSD distro and use it as a router without a back door and a good deal of control and customization
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
Translation: cracking (hacking for the media) is 95% social engineering. Always was. Always has been.
Don't fight for your country, if your country does not fight for you.
Keeping the server up for so long was a mistake. Not warning users was a huge mistake too.
What I would have done:
Keep the server up for 10 days. ... blah blah blah. Your internet connection will stop working in N days. Click here to continue to the site you where visiting".
Redirect all requests to a page that says "Your computer has been compromised
Simple yet effective.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
They don't need to tell them how to fix it, but they could have at least made a transition period where they're redirected to a page notifying them that they're infected with the virus, some basic information about the virus, and then tell them to contact their tech support representative with the information. The tech of choice (family/friend/repair shop) should be able to clean things up pretty easily then.
But it wouldn't be FBI that redirected the traffic. It would be the malware that redirected it, FBI would just be in control of where it got redirected to. And actually I read somewhere that FBI wasn't even doing this themselves, they left the technical part to ISC.
Do you care about the security of your wireless mouse?
Until malware seriously impacts those who are affected by it, interest by people to defend against it will remain minimal. Spammers thrive in this environment, because people don't care and can get away with it.
I am still for a forced disconnect of any spamming botnet member until he has cleaned up his machine. When you drive your car on a public road, you have responsibility for it being roadworthy. Same logic applies to computers on the Internet. If you don't connect it to anything, I don't care how many kinds of malware your machine contains. If you go online, and you don't have working headlights, so to speak, you need to be taken off the road.
I've had this argument inside ISPs. I am disgusted to this day by their cowardice. They fear customers would leave for competitors. Yeah, they probably would. That's why we need laws and regulations here, so everyone is in the same boat, at least within the same jurisdiction.
So I applaud this move, though I think it should've come much earlier.
Assorted stuff I do sometimes: Lemuria.org
Notice how EVERY DAMNED ONE is a PEBKAC problem?
No, I don't. And I've given speeches about this very subject.
The problem is a user interface design problem. The computer lies to the user, a user untrained in computers and thus unable to spot the lie. I'm not talking about the "hot lesbians inside" lie, I am talking about the lie where the user intends to do one thing, instructs the computer to do it, and the machine does something entirely different without telling the user.
The computer displays an icon indicating that something is a video. User clicks on it, intending to watch a video. Instead, a program is executed and installs malware on the machine. There are so many design failures here, it is painful:
* false information about the nature of the object
* bad interface design not allowing the user to express his action clearly (clicking on an action has context-specific meanings)
* bad ACL allowing an unintended action to have even more unintended consequences
* bad feedback to the user as to what is actually happening
To abuse a car analogy - malware is like a CD that you put into your CD player in your car and it makes a copy of your car keys and when you're driving past the next post office, mails it to someone in Poland.
And you are blaming the driver. Seriously?
The real solutions are a little less convenient than simply blaming the user. They require thoughts, intelligence, lots of testing inside and outside the lab, to find better user interface paradigms. One that, for example, allows the user to make a difference between "show me this document" and "run this program". And a change in mindset that moves away from the "users are stupid, let's not bother them with the difference between documents and programs" to "actually, it turns out that with a bit of training, people do understand the difference between the switch that controls the lights and the one that controls the windshield wipers".
It also requires smarter technology that can really undo actions. When software installs follow the change set concept, then we are getting somewhere.
There's a lot more, and I don't claim to have even the majority of the answers, much less all of them. But I do know that we've been asking the wrong questions for way too long. I have about a dozen pieces of the puzzle that I've researched in depth, and in all cases it turns out that stupid users is not the root cause.
In fact, IT security would be a lot better off if it were to simply accept stupid users as a fact, just like limited memory and damaged network packages and find ways to work with them without falling over. You know, the Ping of Death was really, really embarassing. Most of IT Security is much like it.
And yes, I know what I'm talking about, I do this for a living, I give speeches about it, I've been doing research on this for over a decade. If you're in Europe, you can hire me on this.
Assorted stuff I do sometimes: Lemuria.org
Considering he was talking to a Mac user, I believe he meant "Friend of Dorothy."
No one sees the ".exe" extention except those of us who turn extension-hiding off. IzNotBugIzVideo.exe uses a video icon, and the same action (double clicking) plays videos and runs executables.
I remember jive and swedish chef, but it seems such "utilities" have fallen out of fashion.
So I hereby present, the iWank filter:
http://87.119.183.129/perl/rdf.pl
Also FatPhil on SoylentNews, id 863
Someone using the net should have a clue what DNS is about anyways
We're at least a decade beyond that point.
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
they buy a new computer take it to geek squad who nukes and paves it and sells them a rediculously overpriced unreliable antivirus.
That does solve the problem of getting a vulnerable machine off the network and a user off a vulnerable machine. Even Geek Squad will make sure a machine is patched before it goes out the door again. Its still a win.
What it does not do is educate the user about how to prevent this from happening again, but the cost of a new computer and our insanely priced Geek Squad services might just motivate them to learn on their own.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I remember jive and swedish chef...
I plugged a quote from the movie Airplane! into a Swedish Chef translator:
"thet hunky moost be-a messeeng veet my oold lady"
What would someone in Poland do with my car keys?
Take off every 'sig' !!
Since you're reading this here, you're probably already aware...
Yes, yes we are. So why are you telling us again?
systemd is Roko's Basilisk.
Probably have better luck with hoping for better security.
It's a much MUCH smaller deal than has been suggested.
At this point, the only way you have much chance of being impacted, is if someone's been totally negligent in the maintenance of the computer, and just does simply no security work at all for the computer and their LAN, or you are in a position of providing support for such a user, for network connectivity.
And I say that, because by now any DNSChanger impacted user has had a year to recognize the problem, and it's been a well-publicized threat.
Which - when run through GP's i-filter - yields:
iThet iHunky iMoost iBe-a iMesseeng iVeet iMy iOold iLady
"need banned"? We don't use the verb "to be" anymore?
You're not from Europe and it shows.
Over here in Europe, the Polish are famous for stealing cars. There's a bit of truth to it - quite a few stolen cars end up in Poland. In fact, I once had a polish girl friend, and she told me that she and her parents didn't leave anything of value inside the car when they were going back home to visit relatives, and were quite concerned with having their car stolen there.
Assorted stuff I do sometimes: Lemuria.org
I like and agree with most of what you said, but one small part jumped out at me.
"actually, it turns out that with a bit of training, people do understand the difference between the switch that controls the lights and the one that controls the windshield wipers".
See, it isn't that hard, even for non expert users to understand the difference between a program and a document. Is it so hard to turn on file extensions and see that despite the movie file icon, it is an exe and so a program?
You can only blame the paradigm so much. When users don't care about getting even simple thigns right, then it seems less of an issue with the paradigm and more an issue with users being willfully stupid.
If you ignore ACs because they are anonymous - you're an idiot.
The first step is actually the easiest if MS would get off their stinking ass and change a single default behavior as the OS Should Never - I say Never Hide any file extensions by default. This is the first setting I change on any window box I touch. It's not much but by god it helps the user detect that something is lying about what it is. Of course the PEBKAC still exists if the user doesn't pay any attention to the extensions - Seems that many americans now have less attention span then a damn Gnat. God help the internet.
Mod me up/Mod me down: I wont frown as I've no crown
Is it so hard to turn on file extensions and see that despite the movie file icon, it is an exe and so a program?
Who is the irresponsible idiot that hid the extensions in the first place, maybe it was the same that had by default auto start enabled on .inf files?
Yes MS I'm blaming you for bringing up a generation of clueless, at least in the DOS days we still knew what an extension stood for!
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Every few months or so, I see a post that deserves to be modded higher than the system allows because of the truths and insights presented. *sigh*
You nailed it. Hard. Respect to you kind sir.
"Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
Grr, stupid iPhone.
Toru -> Toru
AC -> FormOfActionBanana, "not from Europe and it shows"
Take off every 'sig' !!
"Untrained in computers?" How many *nix admins do you know who either always run sudo from an absolute path, or who enforce "write xor execute" on all filesystems for any user accounts authorized to run with elevated privileges?
What the FBI SHOULD have done is re-dirrect the web browsers of infected machines to an fbi.gov site informing them of the problems and providing instructions on how to re-install windows. Then mabey a link to add a cookie to bypass and keep browsing.
Then we have the issue that the malware is still live, but the FBI is controlling it. Does anyone else see a massive oppertunity for the FBI to use this to spy on people like the malware's original authors did.
For most people its going to be a slight headache to re-install, but nothing more. It should have been months ago.
That's a solution requiring technically informed users.
I propose something different: Icon markings. Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files. A designer will have to work out the best option there. For this example, assume that it is a glow - executables glow, nothing else can ever glow, there is no way to make other symbols glow.
Users could be trained to look for that cue, that something that glows is a program, no matter what it otherwise seems to be, and that if an alleged image glows then it isn't an image.
Of course, that's a workaround. The real fix would be to realize that the metaphor is wrong that opening a program and opening a document are the same thing, because they aren't.
Imagine that nobody had ever thought of making a click do two different things. Imagine that from day one, we would have agreed that left click opens a document file, while right-click runs a program. All of those stupid e-mail attached trojans would fail, because the users would left-click them, expecting a picture or word document, and they would get their picture viewer open or word, showing them that the file is corrupted. They'd be none the wiser that it is a trojan, but a) they would not have been infected and b) it is highly unlikely that they would try to right-click it.
Assorted stuff I do sometimes: Lemuria.org
I have to agree with hiding the file extensions is a stupid idea, and yes, I turn that off as one of the very first things I do when I touch a computer.
Less attention span has very little to do with Americans and just people in general. It comes from the multitasking that the younger generation gets thrown into. They just can't pay attention to any single one thing for a decent amount of time. They are so used to juggling 5 things at once, and the human brain just doesn't multitask well for 98% of the people out there; I did read that around 2% (numbers aren't accurate, but it was indeed a small percentage) of people can actually multitask 2 things at once with little degradation of performance in either task, but it didn't say how good they were doing those tasks to start with.
Are you really this stupid? They actually pay you to make speeches about technology and this is what you give them. Here's a clue - *EVERY* action on a computer involves running some code. Even the "Show me the document" involves running code. The bad guys will use whatever they can to hide themselves and lie to the user. You're stupid suggestions do nothing to make this better. Making the user aware that they run a program to view a document will change nothing. They will simply drop context that they have to run a program and they will merely view is as they are viewing a document. You don't know how many times I have to inquire again and again as to what program they are actually running - even when they have to first run the program to view the document. They still don't know and they don't care. Viewing the document is all they think of. There will always be stupid users and they will always outnumber smart ones - just like there will always but stupid Europeans trolling the net looking for work selling their ill-formed opinions.
Windows and OS/X -- or roughly 99.8% of the PCs out there.
I know that we don't see eye-to-eye on many topics hairy, but I'm definitely with you on this one -- mostly.
Computers have gotten easy enough to use that most people think they can operate one. These types of things didn't happen 25 years ago when people using computers actually knew what they were doing. It's not that users are stupid, because most of them aren't. It's just they don't know enough about their computer to keep themselves out of trouble, and they have no real incentive to learn before trying breaking stuff. Of course it's guys like you in your line of business that have to clean up after them as they learn the hard way.
I'm wondering why the fsck it took so long. One of my previous job was at an ISP, and I had no problem cutting off customers if their machine was spewing off crap. (I probably enjoyed it too much)
Any of you repaired a 10-toolbar machine (where nothing was installed of course, and they never opened unknown emails)?
I fixed my sister's laptop last week, and it probably had more malware than software installed on it.
So yes, cut them off... Internet access isn't a right, if you can't manage your network you shouldn't have intertubes access.
(If my ISP cut me off because one of my machines was creating havoc on their network, I would gladly take it off and thank them for warning me about it)
I've got better things to do tonight than die.
I'm sorry but he's full of shit because he is still pretending everyone has WinXP when in Vista and Win 7 there is UAC WARNINGS before you launch executables but NO warning before you just play a video.
And perhaps you both better read what I wrote again because in damned near every case the AV TRIED to stop them, did everything but yank the damned keyboard away, but they simply refused to listen (or in the case of the "New Limewire" guy) actively REMOVED THE ANTIVIRUS TO ALLOW THE MALWARE IN.. Now you tell ME friend, short of an Apple style "You may do nothing without corporate approval" style iOS can you stop that in ANY way by changing any part of a UI?
The answer is you can't, because its NOT a UI problem, despite the "ZOMG HAIRY WORKS FOR M$" troll we had in this thread, its a dancing bunnies problem where the user KNOWS what they are doing is risky, they KNOW there is a more than average chance at infection, but for free movies/music/porn/stuff they simply DO NOT CARE and will happily help the malware writer remove any and all roadblocks that get between them and the prize. so I'm sorry, but you can't fix a user problem with a tech solution, it just doesn't work unless you take away all the rights and give them thin clients.
ACs don't waste your time replying, your posts are never seen by me.
You are missing the point friend in that they do not NEED to see the extension because while it is an executable the AV will be SCREAMING at them "Don't run that!" and they will DO IT ANYWAY because they want the porn/music/video/kitty screensaver.
Here let me give you an example, a real swear to God that happened in a small business I was working at setting up some systems: ME "Do NOT run that! Its a password protected zip with the password in the email! Its a Virus!" Velma "Oh you worry too much, its from my BFF Kim, see her name right there? Oh and it says its kitty pictures, i love kitties!" ME:"It is NOT from your BFF Kim because I KNOW KIM and she wouldn't have a clue about how to set up a Pword protected zip!" Oh you are just paranoid, stop drinking so many colas!" /Velma promptly ignores me, runs contents of zip, next thing here comes the pop ups/ "Velma:oops... ME..........
And NOW do you see why extensions doesn't help? if the AV is saying NO and an honest to goodness human with years of experience is saying HELL NO and they do it anyway, how in the hell are you gonna stop them with extensions? Even the dumbest moron knows there is free AV out there, but that doesn't help if they ignore it if it gets between them and the "goodies" the malware writer is offering, as they will disable or even uninstall the AV if that is what it takes. Its PEBKAC friend, tech can't fix that.
Oh and the ONLY reason I was pointing out the extensions is that IE WILL LET THEM SEE THE FULL NAME including the extension as they download and they STILL ignore it, they just don't care.
ACs don't waste your time replying, your posts are never seen by me.
That's a solution requiring technically informed users.
It's nice to see someone else who doesn't see showing file extensions as some kind of panacea for computer issues. It really wouldn't help at all.
I propose something different: Icon markings. Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files.
I like this idea, but it seems like an unsolveable problem: How do you decide what is "executable" and what isn't? Sure, there are well-defined executable binaries for each operating system, but there are also a myriad of other ways you can run code. Whether it's a Bash script, VB script, embedded macro of some kind, etc. In Windows, the shell (Explorer) runs ShellExecute on the file to invoke the filetype's registered handler -- how would it know ahead of time what that handler might do? I could display an image or it could load embedded bytecode and run it through an interpreter.
And, on Windows at least, this "glow" already exists to some extent. Files downloaded through most (all?) browsers these days are given the "mark of the Internet", and alternate data stream tag that says "this came from the web". When a user runs a program (or certain other file types), a dialog box is displayed that says "Warning! This is an untrusted program that may break your computer!". Users simply ignore this -- will a glow be much different?
Imagine that from day one, we would have agreed that left click opens a document file, while right-click runs a program. [...] it is highly unlikely that they would try to right-click it.
I think I have to disagree with you on both counts here. First, because even if systems had been designed that way at the beginning, they would have evolved to what we have today. The reason is simplicity: We simply want the computer to "open" whatever it is we're interested. I don't want to be bothered every time, trying to decide if the file I'm looking at falls under "document" or "program". Say, for example, an HTML file. It's a "document", sure, but it also may contain various forms of scripting which falls (or should) under "program". Computers are supposed to take care of easy repeated tasks, surely knowing how to display a given type of file falls under that.
Second, and partially because of the first, I think users would very quickly train themselves to start right-clicking anything that didn't work when they left-clicked it. Download a good program and left-click it by habit -- oops, didn't work, hmm, try right clicking -- it works. Now they download an evil cat picture and left-click it -- oops, that didn't work, hmm, try right-clicking -- it works (and they're now infected).
Humans are very good at making deductive steps towards solving a problem -- "I tried left-click and that didn't work, but I know that right-clicking also does things to files I download, I will try right-clicking. It worked, therefore right-clicking is the answer when left-clicking doesn't work. Stupid computers, why are they so hard to use?" -- and then the whole system is void. If you observe users trying to figure something out, you quickly see they come up with all sorts of odd and unusual ways of going about it, just because "that's what works".
Fundamentally it comes down to understanding the separation of the two kinds of files and why it's important to treat them differently. This requires technically informed users -- the very same flaw as simply displaying file extensions.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
The really really popular one.
Jack of all trades,master of none
How many people cried out to take away extensions when using XP? I'm sure this is just another case of corporations pushing 'the users are stupid', either because they think that sells or they desperately want to make it true.
"This is the FBI, your computer has been compromised with a known virus, please contact your Internet service provider for assistance"
Then a nice note to the ISP that user with an IP of xyz is infected.
---- Booth was a patriot ----
And yes, I know what I'm talking about, I do this for a living, I give speeches about it, I've been doing research on this for over a decade. If you're in Europe, you can hire me on this.
Wouldn't life be wonderful if everyone who made speeches knew what they were talking about? What part of dancing bunnies is eluding you? Sure some users are morons, but the rest will do about anything to see those bunnies.
The problem is that your anecdote is not necessarily as representative as you seem to think it is.
Many AV's WILL report P2P programs as malware when this is not the case. McAfee lists TPB as a malicious website. "New Limewire" does indeed sound like malware (despite me being able to find NO references to any software by that name), but are you sure the AV wasn't just blocking non malware p2p software the user wanted to install? Just because the AV says something is malicious does not make it so.
I agree that the problem is more to do with users than UI, although I think both play a part. I think probably the largest problem is people may understand the problem, but not the consequences. Especially these days when malware tends to spy or operate in the background and is no longer inherently destructive. A user may want their PC to work the way they want it to, and may accept being spied on or being part of a botnet as acceptable, because they don't understand the consequences.
If you ignore ACs because they are anonymous - you're an idiot.
HOWEVER, there is a difference in attitude between "losers are stupid and should never be informed of the facts of life" and something at least aimed toward making the users more informed.
If you have a deadly disease, there is a difference between the doctor knows the name and refuses to tell you that name and the doctor tells you the name but you are not competent to understand the terms. Me I prefer the latter.
Hiding file extensions does not do EVERYTHING to help out the bad guys, but it does draw a line in the sand as to where Microsoft stands regarding informed victims of its software.
What if you can never execute programs directly. You can only open documents, the UI only presents documents. Open a document and it's program is launched. When programs are installed blank documents are also installed in a "stationary store" of some sort, and protected.
Here's a clue
You think that I could study computer science without realizing that? What you don't realize is that there is an important difference in running a known application and having it open a file and running an unknown application. Secondly, that there is a difference between running an application when you want to and know that you are doing so and running an application without realizing that you are doing so.
The bad guys will use whatever they can
That, exactly, is the point. Why do we give them so many ways to use?
You're stupid suggestions do nothing to make this better.
Sorry to burst your babble, but some of "my" suggestions aren't my own inventions but are from peer-reviewed articles that show they do have the desired effect. Unfortunately, much of this has never gone beyond prototype stage, because the major OS vendors aren't accepting the responsibility, either don't give a fuck (MS), are too focused on not breaking the consistency of their design (Apple) or are run by geeks who don't understand user interface design (Linux).
Making the user aware that they run a program to view a document will change nothing.
I see you are one of the people who believe that user awareness is the problem. It isn't. The futility of user awareness trainings, which we in the IT security industry have been running for decades to little effect, should've made clear that this isn't true.
There will always be stupid users and they will always outnumber smart ones
There is no such thing as a stupid user. Every time an IT security person uses the word "stupid user", he is trying to draw attention away from his own failures. I have done root cause analysis on "stupid user" topics, and I can show you a deeper cause for every issue commonly attributed to "stupid users".
Your attitude towards users is one of the reasons that things are as ugly as they are. If car makers would think the same about drivers, our highways would be slaughter houses and people would dread driving, not enjoy it.
Assorted stuff I do sometimes: Lemuria.org
When it found the bad guys in estonia, the FBI had a clean DNS server setup to replace the malicious one. Monday that server is being shut down. Why didn't the FBI have that DNS server re-direct all page queries to a single page that says "You are infected with DNS changer, you need to do this ..."?
How do you decide what is "executable" and what isn't?
Good point, yes. I don't have an answer for that. The reverse would be easier: The system knows what kinds of file types it can handle that are not executables.
Users simply ignore this
Of course they do. We've trained them for a decade that warning dialogs are a nuissance, nothing important is ever in them, they're filled with techno-babble, and interrupt their work at the worst possible moments and the default option is almost always the one they want.
The reason is simplicity: We simply want the computer to "open" whatever it is we're interested.
I believe we've been trained to think that way. I remember times when that wasn't true. Early computers didn't have this metaphors. You did not "open" a document from the command line. You ran a program and then opened the file from that program's open dialog. I still remember that opening a document directly was confusing to me at first.
Download a good program and left-click it by habit
But that's today's habit. My thought experiment was assuming that what we have today never happened, so this habit has never formed.
Fundamentally it comes down to understanding the separation of the two kinds of files and why it's important to treat them differently. This requires technically informed users -- the very same flaw as simply displaying file extensions.
I do believe that users aren't that stupid - you just have to speak their language. File extensions and binary code isn't their language.
What we need are better metaphors. The ones we have suck. Humans are fantastic at applying metaphors. I'm not a linguist except by interest, so I don't think I can come up with the solution. But I've done enough research to believe that the solution lies somewhere in that direction.
It'll be a jump, one we can hardly imagine. Like multitouch - it seems to natural and obvious now that we've had it for a while, but 20 years back it wasn't obvious in the least. Gestures? Please. Go back 30 years and try to explain gestures to the C64 home computer crowd. A mouse was revolutionary in those days.
I believe we will solve this on the user interface design front, and then we'll look back and wonder how we could ever be so stupid.
Assorted stuff I do sometimes: Lemuria.org
Doesn't work because you have quite a few programs that do not work with documents. Screensavers, utility programs (say, Quicksilver, Dropbox, etc.) and others.
Also, you have programs where documents are secondary at best. Most network tools (browser, e-mail, etc.)
Assorted stuff I do sometimes: Lemuria.org
Teaching people to believe a web page when it tells them their computer is infected with a virus? Please, no.
If come Monday, and you have to help a friend regain DNS, Google's public DNS is at 8.8.8.8 and 8.8.4.4.
More here
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
*clap clap cap* This.
But you're not getting it. She's ignoring the warnings BECAUSE she's been conditioned to. Even "dumb" people get conditioned to this.
Using an obviously ill stated car analogy: If your warning light on the car was broken, and every time you started it it came on, but your mechanic told you it was just a faulty warning light, you'd ignore it. You're busy, and it would cost too much to fix.
Then another one does the same, and you check on it, and the mechanic tell's you again to ignore, or pay 2000 to fix it.
And one day, a light comes on, you ignore it, and the engine explodes.
News flash: people in NYC do the same thing. Not because they fear their car will end up in Poland, but because they fear it will be broken into, their possessions will be stolen, and the car might even be taken as well. Whether it ends up in Poland or a Bronx chop shop is irrelevant.
Executable files should have some kind of visual clue that can not be faked and is added by the OS and only to executable files.
Technically any file is executable in the sense that when you double-click it, the OS may launch an associated app. For example, if you double-click a PDF file your OS usually launches a PDF viewer. And if we're talking Adobe Reader, you're potentially asking for a world of hurt if the PDF file contains an exploit. So you either have to warn the user every time they're about to launch an executable (in which case they will ignore the warning since it pops up every time), or only the first time. And then virus writers will program their malware to strike only upon second launch. So your scheme is still useless.
Dude I offer to install P2P for them if that is what they want so that is NOT the problem, all they have to do is ask and they'll have BT, Gnuc, eMule, whatever, as long as they don't expect me to support it it is their PC and I'll give it to them and make it clear I will. The "New Limewire" bit was right after they closed the real Limewire and a bunch simply refused to accept that LW was dead and downloaded "New Limewire" which was a Gnuc package loaded with trojans.
And how do you explain the "ZOMG U got teh viruz!" installs of Security Tool and AV20xx? Every single machine that leaves the shop has either Avast or Comodo IS installed which will TRY to warn them but again they ignore it. Or the "porn codec" bug? I actually had to find a bug free porno site just to keep certain customers from constantly falling for that one. Again the AV TRIED to stop them, but they'd rather have the titties so they ignored it.
Finally its not that they they "don't understand the consequences" it is that the "prize' of free music/movies/porn/whatever is worth MORE to them that a clean PC. Its the classic dancing bunnies problem that simply can't be solved with technical means because the users wants the bunnies MORE than they want the clean PC. Believe me friend, i've seen it a million times, all they have to do is offer the right bunny and the users will happily destroy any and all roadblocks you put in to see the bunnies. Every time a new Twilight comes out at least a half a dozen females will get infected by running "Twilight (name of movie) player.exe" and in every damned case the AV practically tried to jump on the keyboard to stop them and they ignored it, not because of any P2P blocks but because they wanted to see the new Twilight for free more than they cared what the AV said.
With all the money spent each year to patch holes and deal with user stupidity, don't you think MSFT and the AV vendors would LIKE to be able to stop this? Imagine the sales of a "user proof" AV, that corp would be richer than God, but there simply isn't a way to ward off a user fighting for the malware unless you stuff them into a walled garden and refuse to let them do anything without permission from an outsider, and most simply won't put up with that.
ACs don't waste your time replying, your posts are never seen by me.
How has she been conditioned to ignore ME, sitting right exactly there, telling her "Its a fucking bug!" and pointing out the person sending her the bug wouldn't have the skills to send a real anything that way?
In the end friend it has NOTHING to do with conditioning and everything to do with the dancing bunnies problem which is as old as the hills. The user WANTS the bunnies, you try to stop them from getting the bunnies she/he WILL IGNORE YOU and do whatever it takes to get the bunnies, simple as that. You can show file names, have the AV show a picture of Goatse with an arrow pointing to it saying "This is you if you run that" and it will not matter because they WANT the bunny dammit!
ACs don't waste your time replying, your posts are never seen by me.
You're talking a lot of sense here. As a user support person, my life gets a million times easier when I remember to see my users not as stupid, but as inexperienced. I remember that I can't do their jobs, so I shouldn't expect them to do mine and have the same level of comfort and education with IT systems. In nearly every case where the user is interested in the "why" something isn't working, they can understand it.
Also, it infected a lot of routers... Most people have no idea they should change the default password on their router (as opposed to their wifi network), or that such a password even exists! So a lot of people will *think* their iPhones, iPads, etc are infected when it's the router.
Tape a copy of the repair bill to the side of their monitor with the total in large font.
in Vista and Win 7 there is UAC WARNINGS
UAC has one and only one actual effect that has been verified by independent researchers: It trains people to ignore warning dialogs. I'm not joking, that is literally the result of studies done on the subject.
So, you were saying?
Now you tell ME friend, [...] can you stop that in ANY way by changing any part of a UI?
Yes, you can. Chameleon was a university prototyp designed specifically to deal with the malware download issue not by technological, but by UI means. That's just one example I can cite right away. If you research the topic a bit, you will find many ideas that have, at least in the lab, been shown to at least improve the situation, sometimes considerably.
If you're looking for a magic bullet, then I'm sorry, all I can offer you is the harsh truth of IT security: There are no magic bullets.
because its NOT a UI problem,
Says who, based on what studies?
HAISA (Human Aspects in Information Security Assurance) is a relatively new field, and as far as sciences go, quite immature (Stanton, "Empirical vs. Non-Empirical Work in Information Systems Security", 2007 - if I ask for studies, I should provide some for my points). As such, there is still a lot where we don't know, are partially or totally guessing, or have incomplete data. One thing we do know, however, is that in a THS triangle, only a small subset of security issues rest strongly in the "technology" corner. Many security issues are partially or strongly influenced by human and/or social factors. It stands to reason - and many studies, experiments and prototypes support the theory, e.g. the one outlined above or a couple of those listed in my keynote "Security & Usability" (DFN-CERT Workshopband, ISBN 9-783844-806885), that user interface improvements do have a measurable impact on those.
I'm sorry, but you can't fix a user problem with a tech solution
It's not a tech solution. It's a user (interface) solution. Just above you complained that it's not a UI problem, now it suddenly is a user problem. I'm sure you know what the "U" in "UI" stands for, so please make up your mind.
Assorted stuff I do sometimes: Lemuria.org
They certainly shouldn't be owning computers.
Welcome the the 21st century, I hope you had a restful cryo sleep. They should have told you in debriefing that this sentiment went out of business 10 years ago.
Assorted stuff I do sometimes: Lemuria.org
The dancing bunnies was an interesting blog idea with a good punchline and made a really good summary for a well-known problem. It is always worth to stop and think about it.
It is not, however, absolute truth from on high. It's a simplified aphorism on a real problem. Don't judge actual research against aphorisms. The funny thing about researching humans is that more often than you think, the truth is counter-intuitive, more complicated than everyone thought, or just outright strange.
For example, Miller and Wu ("Fighting Phishing at the User Interface", 2005) made a study where the change of a dialog element from buttons to a short drop-down list dropped the error rate of users from 30% to zero.
Assorted stuff I do sometimes: Lemuria.org
Technically any file is executable in the sense that when you double-click it, the OS may launch an associated app.
You may have noticed in my posting that this is what I consider the root cause issue - the one action (a double-click) can cause different things based on intransparent dependencies.
I'm not trying to solve all security issues with one stroke, that's impossible. I am showing an idea for one specific problem to demonstrate that solutions exist, we don't have to take some stupid idea some idiot once had up the arse for all eternity.
Assorted stuff I do sometimes: Lemuria.org
So what do you do when I add a picture to my files that makes it seem like they glow?
If something is possible on an icon it's possible on every icon.
Nonsense. I can easily add some kind of effect to icons OS-side that is disallowed or technically impossible within the icon itself. For example, something that extends beyond the visual space of the icon itself, or a marker that is displayed next to it.
Assorted stuff I do sometimes: Lemuria.org
I know nothing about you except those few sentences and yet I'm sure that the users you support like you more than they like the geeky guy who tells them they're stupid idiots - even if he is better on the technology.
And I'm sure they are more likely to tell you what they actually did when it broke than give the usual "nothing" excuse.
That's the part the too many security people don't get - that trust is something that is built in mutual respect. Many security people are right in distrusting the user - because the users are in fact distrusting their security people.
Assorted stuff I do sometimes: Lemuria.org
HOW IS THIS NOT A STUPID USER?
What part of his complaints do indicate a low intelligence? I agree with you that he's a PITA and probably whining for no reason, and whatever else you want.
But I don't see indications of stupidity. Maybe you are using that term in an exceptionally broad sense for everything you dislike about users?
Assorted stuff I do sometimes: Lemuria.org
Well you would THINK after me handing them the bill a couple of times they would get a fucking clue and at least call or email me before doing something REALLY stupid, but instead I've found it settles quickly into one of 2 camps. 1.-The ones that listen to me, which run year after year without needing me for more than hardware upgrades. i like these customers a lot, even though I make less money off of them, because they are just so easy to support. I tell them what is bad, point them to what is good, and they listen, its nice.
The other camp simply ignores everything I say, and after clicking ignore enough times on the AV ends up with more viruses than a Bangkok whore on coupon night. The totally gobsmacking batshit part? they will simply KEEP USING THE INFECTED PC until it simply won't run anymore and THEN bring it to me. They of course make me more money but every time you get spam, have your internet slow to a crawl because of the latest worm? you can lay the blame at these bozos, because in the end nobody is gonna keep them from that free movie/music/porn/ screensaver dammit!
Just as a test I gave one of the "must have teh tittiez!" customers Mepis, just to see if the vaunted Linux security would keep Goober from shitting on the PC, did it work? Nope, he made it unbootable in less than a week, how? He decided he didn't like the package manager and just Googled "Linux programs" and got enough crap off of Freshmeat (boy is THAT name perfect) to put the entire system in dependency hell...sigh.
In the end you just can't fix stupid, you just can't. You can try to lessen the damage the average mouth breather can do but in the end you'll end up having to clean up the mess, because some will simply NEVER learn or worse think they are smarter than they are, but in either case shit will be broke and malware will spread, all you can do is clean up the messes.
ACs don't waste your time replying, your posts are never seen by me.
OK, this is a short reply, since you seem to have misunderstood my last reply. Even though you are not actually disagreeing with me.
It isn't a dancing pigs problem(the more common name), because the user is not aware of any breach of security.
It doesn't matter what the AV says. AV's lose credibility when they report non-malicious stuff as malicious. As I said, McAfee counts aircrack and thepiratebay as malicious. If you know enough to know thepiratebay is not malicious then your AV loses credibility.
The reason it isn't a dancing pigs problem is because the user does not understand the consequences. They are not making a choice to choose pigs over security, because security does not come into the equation. They can be part of a botnet, but it doesn't affect them in anyway. They don't notice a slowdown, don't lose access to their documents etc.
The consequences here are that they are participating in DDoS attacks, potentially having their passwords farmed so spam is sent from their accounts, maybe cc numbers, etc. But, most of the time it doesn't affect them directly, so they are not aware of it.
It isn't like 10 years ago where malware would fuck up your documents and programs. These days there is generally little sign to the end user, which is why they are not aware of the consequences, because they don't even know that anything is happening. Regardless of what the AV says, which is not trustworthy anyway.
Oh, and a tip might be to stop giving customers Avast which is overly loud and noisy and tends to freak people out or make them ignore the warnings. Give them MSE instead.
If you ignore ACs because they are anonymous - you're an idiot.
Screensavers are run by the OS not by the user.
Dropbox client (and that ilk) are also a service that gets run by the OS. Put a new item in the control panel to setup what gets synced.
Your browser hides - it's documents are web-links.
Your email hides, its documents are emails. They just appear in the inbox folder, you can move them to other folders, to send an email - double click the "Untitled Email" document in the store.
Things like 7zip work on document by left clicking the document.
Printing can be done this way as well, it actually just opens the handling application but it also autoloads the document, triggers a standard print, then closes the document and quits the application