Slashdot Mirror
'StrongPity' Malware Infects Users Through Legitimate WinRAR and TrueCrypt Installers (neowin.net)
Kaspersky Labs has revealed a new strain of malware -- named 'StrongPity' which targets users looking for two popular applications - WinRaR and TrueCrypt. The malware contains components that not only has the ability to give attackers complete control on the victim's computer, but also steal disk contents and download other software that the cybercriminals need. From a Neowin report: To be able to gather victims, the attackers have built special fake websites that supposedly host the two programs. One instance that was discovered by the researchers is that the criminals transposed two letters in a domain name, in order to fool the potential victim into thinking that the program was a legitimate WinRAR installer website.
"through legitimate WinRAR and TrueCrypt installers"? By what logic are those installers legitimate?
If it's malware infected, it's not legitimate.
... no. How could the malware being served qualify as a legitimate installer?
someone just downloaded an .exe off a website and ran it.
If I can get someone to do that, you don't need winrar as part of the equation anymore.
Nothing like an ad-infested news page with referral program links to the original source. Here is the actual article, with a sanitized URL:
http://usa.kaspersky.com/about-us/press-center/press-releases/2016/Kaspersky_Lab_Reveals_Advanced_Persistent_Threat_StrongPity
Why are people still using something that the authors of same apparently think is compromised?
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Hasn't this been done 1000 times before? What's new here? Why is this newsworthy?
I'm more surprised that Slashdot passed on the error without thinking how stupid it sounded.
You must be new here.
"The malware contains components that not only has the ability to give attackers complete control on the victim's computer"
Msmash forgot to mention that this malware is only effective on Microsoft Windows. Go here for an alternative to the Microsoft industry standard.
Clickbait is not an error. It is intentional. You clicked...
Are you going to list every possible misspelling of the websites? Enumerating badness does not work. Has not for a long time... http://www.ranum.com/security/...
'StrongPity' Malware Infects Users Through Legitimate WinRAR and TrueCrypt Installers
in order to fool the potential victim into thinking that the program was a legitimate WinRAR installer website.
It certainly fooled whoever submitted the story.
Now, will someone at Slashdot bother to fix it?
systemd is Roko's Basilisk.
7zip is open source and I'm pretty sure it handles rar/zip/gzip too.
I'll just leave this here: "The owner of dotslash.org is offering it for sale for an asking price of 10000 USD!"
7-zip decompresses RAR files, and makes 7z (LMZA and LMZA2) files which are smaller, "better"* (support multi threaded compression/decompression and AES encryption) and is multi-platform and open source. Absolutely no reason why it shouldn't be your compression format of choice.
Why do people even download WinRAR? For the odd occasion I need to extract a WinRAR archive, the free and open source 7-zip works fine. It also handles a number of other formats, and is fast. (For example, it is MUCH faster at extracting ZIP archives than Windows Explorer).
Except for the one construction supplies company who sent infected .rars to several of my users. (To be fair that was about 8 years ago. Things may have got better but I wouldn't hold my breathe).
This is supposedly a tech news site.
There is no way that editing can accidentally be that shit. Malware in "Legitimate installer" - wow that is news. Click through to standard bullshit.
Things like this are a good way to drive away the readership. Only reason I still visit is that the community is still large enough to have interesting discussions around the articles (although the trolling etc is getting worse as time goes on)
(Just wish a few other alternatives would get more active communities)
First of all, the headline is misleading. For it to be true, you'd have to get infected somehow by installing genuine WinRAR and TrueCrypt software you downloaded from trusted (and trustworthy), genuine sources. Now THAT definitely WOULD be a story!
But what do we have instead? Malware writers using typosquatting techniques to get people to install genuine looking software. Now, it's been a while that I've left the malware analysis business, but even back then, well over a decade ago, this would not have made the news anymore. Or is it news because that technique is SO ancient that nobody remembers it anymore?
Damn millennials and their goldfish-dimension long term memory!
No, but seriously, what the hell is the news here? That malware authors get nostalgic when it comes to distribution? So Retro isn't just for music and games anymore? Are we going to get file infectors again, too? And hand crafted, self-morphing viruses? That would at least be interesting to analyze again.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Dont't be mean.
"we are all atheists about most of the gods that societies have ever believed in. Some of us just go one god further."
Cheers, I haven't seen disk fragmentation myself, but I'll look out for it from now on.
And yes, I think you're correct, I don't think 7zip has any recovery or repair mode, but it does make a "best effort" and in my experience will partially recover damaged archives. Of course, since it will depend enormously on the exact file structure, archive structure, and level of damage, this should be regarded more as an anecdote than advice.
7-Zip has no recovery options. If you're doing backups, but note testing them (which is a classic home scenario), RAR and it's extra recovery data can save you.