Hacker News Reader

Comment by forgotusername6 | Hacker News Reader

I double clicked on a js file inside a zip folder before by accident. It ran, did nothing, but I got an email from IT within hours saying I needed to wipe my device. It took a lot of convincing to avoid doing that.

View on HN

God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they see fit.

I can't imagine the paranoia I'd feel with having spyware on my machine constantly calling home.

What why? That’s the typical configuration for very large corporations. Coping steps:

1. Do not use your work computer for personal data.

2. There is no step 2.

Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer.

Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine.

My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.

It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware).

The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.

You can justify arbitrary security theater by only looking at the worst case scenario.

Do you justify constant GPSs surveilance because your work keys/cards might get stolen if you visit a bad neighbourhood? I hope not.

It's always a tradeoff of security vs. actually being able to do your job. Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.

Something isn't security theater because you don't personally have the same threat model or exposure. Attackers can easily avoid traditional antivirus software so people with more aggressive security postures have switched to investigating or blocking any unknown executable following pretty standard advice in the field that it's not sustainable to try to enumerate all of the bad things in the world.

Someone running random JavaScript out of a downloaded ZIP file matches the signature of a lot of attacks, and almost no legitimate activity: that's a super common technique to use something built-in like JScript rather than their own binary which might be blocked, and even web developers never do that intentionally since their code is running in a browser or something else like Node.

> Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.

Some other costs to think about:

1. If you have any sort of cloud credential on your system, how quickly can you spend money before someone revokes it?

2. Can your system be used to attack any internal infrastructure? Deploy something in the cloud for further attacks?

3. Can your system be used to phish other people at your company by, say, sending realistic messages? What about customers?

Now, it's true that you have to consider the impact on daily work but in this case it's pretty low unless your job actually is to run random downloads and at any organization over a certain size the majority of times that alert trips it's probably going to be something where the cost of the malware which people routinely try to run would be non-trivial, too, even if you just measured it in the time it takes to investigate and cleanup.

Thats interesting, my internal custom-designed red team malware does that exact same thing (js file in a zip). Except for the "does nothing" part. Once you click on it, I start a covert command channel in the background, using DNS.

(ohh and it bypasses carbon black too, because .js isn't an executable :) )

How can a js file execute by clicking it? I have never seen that happen. Did you bind the file extension somehow your self?

Yeah probably. I was a little surprised myself, but it is my dev machine so not that surprised

JScript (Microsoft's JavaScript dialect) can be used as a general purpose scripting language (in purpose similar to shell scripts or maybe VBA, but using JavaScript and ActiveX). And until you install your first code editor to map the file extension to, the default action on double click is to execute the script.

Or at least that used to be the case, not sure if this is still a thing in Windows 10/11.

Active Scripting, including JScript, still ships out of the box in Win11. The file extension association is also there, but I don't recall if it's active by default, or you get the "how would you like to open?" dialog first.

This is the default behaviour in Windows. It runs in the Windows Script Host as JScript (Microsoft's version of ECMAScript) and has access to basically anything Win32 the current user has, the same as macros in Office

Reply on news.ycombinator.com