… and yet some of the same people will readily copy-paste random shell scripts into their terminal without fully understanding them.
Let me open up my Linux bible and see if its malicious
Even if you understand the commands, you need to trust the website because a malicious site can use JavaScript to copy something completely different into your clipboard, with a newline character at the end to automatically execute when pasted. (Is the newline exploit fixed in all shells? It used to fail in zsh but work in many others…)
One can also paste into a text editor to verify before pasting into terminal, but what noob is going to know or bother to?
…so, never put things in the terminal?
In fact, you should delete the terminal altogether. On a related note, powershell access is considered taboo in corporate environments by IT departments. When security audits are done, you lose a point if powershell can be used. It is in fact considered a hacking tool.
This is were WINE comes handy /s
WannaCry: Platinium
https://appdb.winehq.org/objectManager.php?sClass=application&iId=18249
I’m not clicking that link
It’s just an entry in Wine’s AppDB, where they keep track of how well apps run on wine. Like ProtonDB, but for general applications.
Whole bunch of people trying to get me to click this sus link…
You’re never gonna do it.
I cast Millennial Paranoia, BOOMERS.
GO BACK TO YOUR CHAIN EMAILS
Jesus, the downvotes! Well, I thought it was funny! 😂
Well if the exe was in a bottle it would be dangerous.
Wine automatically running:
Remember that time, when it was possible for about 6 years to hack into any Linux system (without drive encryption) which had GRUB by pressing backspace exactly 28 times? Yeah, good old times.
https://www.hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html
That’s hyperbole. Such a system can be “hacked” by simply plugging in a usb-stick and booting from that instead, or dozens of other ways.
The only reason to use GRUB authentication I can think of would be in something like a kiosk.
If the adversary has physical access you are generally pwned either way
Yeah that is not really an “OMG” vulnerability as I can also get into that machine by booting it with a USB drive, or plugging it’s drove into my own machine.
Breh. What? I feel naked right now.
Better replace your keyboard everytime you leave it unattended, someone could put a keylogger in it. Don’t forget to check for hidden pinhole cameras around that capture you inputting your passwords. Etc, etc. Those even work against an encrypted drive…
A friend of mine once downloaded something malicious to his Linux machine and wasn’t worried about it. Then some time later, while browsing his files from a Windows machine, saw it and was like, “hey, what’s this?” Oops.
He’s a tech savvy guy, so I’m guessing the fact he had downloaded it himself really let his guard down.
That’s why you don’t store your stool samples in the same fridge as your chocolate pudding. Malware goes into the vault.
Modern viruses check the os before deciding which type of file to send your way.
This is why you use a user agent switcher to lie about being windows. It’s a form of anti malware!
Except websites can tell what base OS you run using browser fingerprinting. It os impossible to lie aboit your OS because of the differences in platforms.
Generally browser fingerprinting is used to identify individual browser sessions across IP addresses. This mostly takes into account reported features and capabilities of the browser and OS to the website. Fingerprinting isn’t looking for specific info your browser reports, it’s taking it all and hashing it to get a unique id specific to the browser. Because it’s hashed, it can’t be reversed to identify the OS from the hash.
Sure a malicious website could Ignore the user agent and probe for some hardware capabilities that are specific to Linux, but that would be a lot of effort to probe various things which are set differently across all different browsers. I can’t speak for bad actors, but I wouldn’t spend the effort to check if the user agent is spoofed, if 95% of the time it’s accurate to get the OS type.
You can lie about your fingerprint very much in fact it is the default on librewolf
You can lie, but that doesnt mean that a website cant still tell your base OS if they use JS platform fingerprinting. Arkenfox, the base config which Librewolf is based off of says the exact same thing. Go to CreepJS and see it get your platform regardless.
You sweet summer child I use noscript
Firstly there is no need to be condescending.
Secondly, do you block all JS? NoScript is not a silver bullet and doesnt stop fingerprinting, it is itself identified by the CreepJS test site. It may in this case reduce the chance of OS fingerprinting, but pure CSS methods exist as well.
Additionally, NoScript is laregly redundant with uBlock Origin since you can do everything that it offers, such as blocking 3rd party scripts/iframes/all, block fonts, block JS, and it is very granular.
Bottom line, you are fingerpintable.
No script offers more than just is blocking you can block certain elements fonts what all that. It is NOT redundant. And creepjs doesn’t even run without js which I don’t allow on non trusted websites. Also yeah sorry I wasn’t trying to be condescending.
