Slashdot Mirror
How To Hijack Your Own Windows System With Bundled Downloads
How-To Geek has tested and described something that you probably shouldn't do on your own computer -- unless, as they did, you do it on a virtual machine just for this purpose. Namely, they downloaded 10 of the most popular software titles from download.com, clicking through as a naive user might, accepting the defaults or the most obvious Next buttons, as most users surely do. They note that download.com's stated policies certainly look good on-screen; it says that the site comprehensively screens for, and disallows, malware of all kinds. But malware of various kinds, even if much of it is in a grey zone rather than actually malicious, is a fair description of what the authors encountered as they clicked through. Bundled software, some pieces of it at odds with others, was attached to each of the downloads, and from download to installation the process by design foisted more and more junk on their system, even if some of the bundled junk could have been avoided by a user jaded by previous hijackings. The conclusion:
[N]o matter how technical you might be, most of the installers are so confusing that there's no way a non-geek could figure out how to avoid the awful. So if you recommend a piece of software to somebody, you are basically asking them to infect their computer. And it doesn’t matter which antivirus you have installed — we've actually done this experiment a number of times with different antivirus vendors, and most of them completely ignored all of the bundled crapware. Avast did a pretty good job this time compared to some of the other vendors, but it didn't block all of it for sure. There are also no safe freeware download sites because as you can clearly see in the screenshots in this article, it isn't just CNET Downloads that is doing the bundling it's EVERYBODY. The freeware authors are bundling crapware, and then lousy download sources are bundling even more on top of it. It's a cavalcade of crapware.
If it's one thing I've learned after playing with OS X and Linux, it's that no matter what the OS is, an install script is an awful UX.
This isn't a problem in OS X because most software installs via app bundles. Yes, there are .pkg installers that could bundle god knows what, but they're not the norm for Mac software.
Also this isn't a problem in Linux because either you're usually installing from a repo or source, of which the requirement for any repo package or code base isn't going to be libtrackingmalwarelolpwn(64 bit; of course).
Why does Windows keep this antiquated process around?
Non impediti ratione cogitationus.
Download.com installs crapware news at 11
Time for bed, said Zebedee - boing
Download.com is crap.
Sadly open source isn't immune to this crap with SourceForge now doing this stupid shit of bundling malware, adware, toolbar hijacks, etc. Especially when you have yahoo's like FileZilla's admin approving(!) of this irresponsibility !?
At least Git hasn't been effected (yet)
Need SCP? Download it from winscp.net. Need VLC? Download it form videolan.org. Teach your non-geek how to think outside the box (just a little and be gentle). Teach them about digital trust. To locate website of the vendor that makes the software that they want. If that vendor redirects them to cnet, then that is where they should download the software from.
For all driver needs tell them to download only from the original equipment manufactures website. If the driver doesn't exist anymore there is a reasonable chance the driver found on some third party website won't work anyways.
There is or can be built a machine that can simulate any physical object. -Church-Turing principle
When Oracle bundles the ask.com shitware with Java, and you have to conscientiously know it's there and un-check it, is it any surprise pretty much everyone else does this stuff?
Some ass is always trying to monetize your clicks, and 'free' comes with strings.
I've noticed over the years CNET is doing this, so much so that I don't typically trust them as a source.
The marketing assholes have pretty much wrecked the internet, and they pretty much use the same tactics as the malware people -- putting stuff on you don't want.
Lost at C:>. Found at C.
The process goes something like this:
"Help. My computer is slow."
"You need to clean up the malware."
"Okay, I did a Google for malware cleaner. That only made it worse."
"Oh, you have to install Malwarebytes. That software's a fake."
"Okay, I don't know how I was supposed to know it was fake, but now I've installed Malwarebytes. Things got worse."
"That's because the first search result in Google is actually an ad for somebody else distributing Malwarebytes with its own malware. You have to go to this page instead."
"Okay, I don't know I was supposed to know that too, but now I've installed it. Why is it still not working?"
"Because the malware on your computer redirects attempts to remove the malware on your computer."
"Fuck this. I'm buying a tablet."
(one month later)
"How do I delete all this crap on my tablet?"
"You can't unless you root it. Here's a guide that a five year old child could follow, with only a 10% chance of bricking your unit."
"Then fetch me a fucking five year old child because I'm paralyzed by learned helplessness by this point."
I think we forget how overwhelming and stacked against the user the entire process is.
I classify adware/junkware as malware, as - at the very least - the extra use of resources (memory, disk) is a drain on the PC. Even browser toolbars tend to reduce the performance of a computer.
these days they dropped the sourceforge crap for their own crap built-in into the main installer, silently downloaded in the background from sites such as coapr14pool _DOT_ com AND THEN executed while having elevated full admin rights. This is typical trojan dropper / infector / keylogger behavior.
source: http://www.pdfforge.org/blog/p...
(in comments)
root@127.0.0.1
I'm pretty sure you're mistaken there. I've done installers with both RPMs and MSIs. Not my specialty, but I have some experience.
In Windows, you don't need elevated privileges to install an application to a user-specific location. You only need it to install system-wide. The registry keys to track Windows Installer components can be referenced from either location in the registry (the administrative access part, or the user-only part).
It's not all that different from RPM, though really it's a little easier to do user-only installs with Windows Installer. You need administrative privileges to install system wide w/ RPM. You can also do a bunch of RPM hacking to install to a user-only RPM database and installation folder without root, so long as you specify that you're running RPM against a non-default RPM database location, and someone went to a lot of trouble to permit user only installs in your RPM spec file. There's a bit of work to enable this in regular MSIs, too, but it's actually better supported that under RPM.