this post was submitted on 20 Apr 2024
978 points (97.3% liked)

linuxmemes

20880 readers
6 users here now

I use Arch btw

Sister communities:

Community rules

  1. Follow the site-wide rules and code of conduct
  2. Be civil
  3. Post Linux-related content
  4. No recent reposts

Please report posts and comments that break these rules!

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
978
mv Windows Linux (discuss.tchncs.de)
submitted 7 months ago by [email protected] to c/[email protected]
105 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 4 points 7 months ago* (last edited 7 months ago) (2 children)

Any self-respecting malware writer will download and decompile the Powertools to find out what API calls are being used. Especially if they're calls to an undocumented API.

Having Powertools on your computer is thus not the security hole it might appear to be.

The fact they exist at all - well that's not really a security hole either. Their existence just more quickly dissolves any security-by-obscurity that might have existed. Someone would have found those calls another way.

One might suppose that they contain something special that's not in the stock OS, but then we're back to the malware writer's reverse engineering which would lead them to learn and implement their own versions of whatever it is that Powertools does.

[–] [email protected] 6 points 7 months ago* (last edited 7 months ago)

will download and decompile the Powertools

PowerToys is open-source, so no need to decompile. https://github.com/microsoft/PowerToys.

This is the code that determines which processes are holding on to the specified files (or any files in the specified folders): https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithLibInterop/FileLocksmith.cpp#L18

Called from the UI code here: https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithUI/ViewModels/MainViewModel.cs#L112 which also has the code to kill the processes

[–] [email protected] 2 points 7 months ago

I would not say

any self-respecting malware writer will download [powertools] and…

I’m not as familiar with mass-market malware, but APT-level gear generally doesn’t try to make use of such easily observed events. The more network traffic malware appropriates, the greater the probability that it’s caught.

Simply put, Powertools puts several functions within arms reach for malware looking to stay under the radar. Without it, malware needs to bring more of its own code which increases footprint. Living off the land exploits in particular love the presence of these kinds of programs