Hot answers tagged

270

Installing something without needing admin privileges is no more dangerous than running a no-install program with standard user permissions. This is also less dangerous than installing something WITH admin privileges (or indeed, running anything with admin permissions). Running a random program downloaded off the internet, of course, is potentially ...


83

Well, if it doesn't need admin rights, that means that it can only do what a regular user can. Of course, you won't really know what the installer is doing (but do you ever really know?) but you can be assured that it won't be able to do anything that an unprivileged user can't, so I don't see the problem if you trust the source.


39

It it's about as safe as any other standard1 installation method as long as you: Use HTTPS (and reject certificate errors) Are confident in your certificate trust store Trust the server you're downloading from You can, and should, separate the steps out -- download the script2, inspect it, and see if it's doing anything fishy before running the script you ...


27

On the windows platform, whether an app installer tiggers UAC (User Account Control) is not up to the app and the app cannot circumvent UAC. If the app install requires to do anything that would require admin, UAC will be triggered. This would include writing to system directories or registry settings that are system wide. If an app install doesn't trigger ...


17

There are three major security features you'd want to look at when comparing curl ... | bash installation to a Unix distribution packaging system like apt or yum. The first is ensuring that you are requesting the correct file(s). Apt does this by keeping its own mapping of package names to more complex URLs; the OCaml package manager is just opam offering ...


15

One additional threat for program installations that do not require administrator rights is that the installation can be modified by user level code. This allows for silent (no admin access required) updates, which means that the program behavior can change without warning. This also allows an adversary to insert code and tamper with the program silently (no ...


12

If it's not asking you for approval, you never know what it's going and changing in the background! Wether the installer requires or not admin rights, you don't know what it is doing unless you're tracking/monitoring system changes. What you know however, is that if it doesn't ask for admin rights, it can't make any change that requires admin right (...


6

The application still has to ask for elevation if it needs more privileges, independend of its installer. On the other hand, if an application is maleware, it can run its harmful code in the installer already. So actually it is the other way round, if neither the installer nor the application ask for elevation, it can do less harm, than if one of them ask ...


5

Is it safe? Not completely; just because you're fetching safe code now doesn't mean that link will always point to safe code, and many command-line tools don't verify certificates, which could lead to a MITM attack. Is it safe enough? Yeah, for most use cases, probably. The attack scenario is pretty rare, and an attacker who is positioned to pull it off can ...


5

Initial Analysis I think the most thorough way to test 3rd party apps is to: Download the Android SDK/Tools Create a virtual Android Device with the Android version of your phone. Enable Android Debugging through USB on your device. (Can be turned off later) Check with ADB that your emulator is detected: adb devices Install the 3rd party app with ADB: `adb ...


5

Question 0: Am I correct? Yes you are correct. Installing a package requires root privilege, so installing a malicious package means running malicious code as root. Question 2: What are the ways in which Debian team addresses this threat in the main repositories? First, you are recommended to use only Debian repository, and more precisely Debian stable ...


4

To verify whether an APK is safe, you can upload it to e.g. Virustotal. It will use a bunch of virus scanners to detect whether anything is wrong with the APK. Note that APKs are (at this moment of writing) the #1 file type being scanned by Virustotal.


4

Submitting an answer to my own question. Not sure if this is the best answer, but I'm hoping other answers will address these points. curl {something} | sudo bash - on Linux is equally safe as downloading something on Windows and right-clicking run as administrator. One can argue that this is 'reasonably safe', but as a recent xkcd suggests, nobody really ...


4

What it means If an installer doesn't require admin rights, then it is installing software for the current user only, rather than system-wide. What are the security impacts? The software you are installing can only run under your own user account, so it has no way of modifying or damaging the system at superuser/admin level and affecting other users or ...


4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (...


4

"Reasonably Safe" depends on your goalposts, but curl | bash is well behind state-of-the-art. Let's take a look at the kind of verification one might want: Ensuring that someone malicious at your ISP can't do a man-in-the-middle to feed you arbitrary code. Ensuring that you're getting the same binaries the author published Ensuring you're getting the same ...


3

I setup MITM for pip to pypi.python.org and it seems that pip does indeed validate the certificate. It fails with SSLError: [SSL: CERTIFICATE_VERIFY_FAILED]. Maybe I will have more luck with other repositories... Pip may not be checking gpg signatures but it's not like you are downloading from untrusted sources. For example, Linux packages are spread across ...


3

I would suggest that you try to reproduce this. Most likely, you already had an authenticated session and your system remembered it due to the keyring. A great way to test would be immediately after a reboot. aditya@20:54:20:~$ nano bash: nano: command not found... Install package 'nano' to provide command 'nano'? [N/y] y * Waiting in queue... * Loading ...


3

Cipher suites are removed or added by Google through software patches or updates. You can blacklist cipher suites by adding a command-line argument to Chrome's startup; as shown in this answer. Hexadecimal values for each cipher suite can be found here. There isn't any functionality for enabling non-default cipher suites. I believe you might be stuck ...


2

Version used MacOS X 10.9.4 Xcode 5.1.1 MacPorts 2.3.1 Ruby 1.9.3 Postgresql 9.3.5 Metasploit 4.9.3 Method To avoid any confusion between system, MacPorts and Metasploit binaries it is fundamental to start to install everything in clearly separate part of the filesystem. Here are the choices I took: /local/...


2

The short answer is, it depends. :) It is definitely a risk, but probably in a slightly different way to what you might expect. A "cracked version" I suppose means somebody was knowledgable enough to modify the OS binaries so that it doesn't need the license key anymore or accepts pirate keys. But how do you know the person who disabled license verification ...


1

I suspect that what you describe is a feature Firefox implements for the HTTP protocol. Whenever a browser downloads a file from a HTTP(S) server, its reply does not contain only the requested file. The reply is augmented by a few "HTTP headers" that provide details about the file. One of the most important headers is called "Content-Type". The easiest view ...


1

It is mainly a question of trust. If you think that you can be more confident in the original site to have more thoroughly tested their own program than what Microsoft does before including it in its store then you should take it from the original site. For example LibreOffice which is a concurrent suite for Microsoft Office is not available from the ...


1

If it's a huge website, well known, then they probably have good enough security, even a hash maybe, and you won't download a compromised version. If it's a not so well known website, then you are at risk. From what I recall, when you upload an application to Microsoft Store, they check it for malware and only the owner could upload a new version (scanned as ...


1

For future Googlers: I was able to confirm that the entries predating the initial unboxing were logged during one of the final steps of Apple's manufacturing process, where the laptop is briefly booted to the macOS installer for the purposes of quality assurance. Adding to the confusion was the fact that in earlier versions of macOS — before unified ...


1

Answering to your question and comment: If you think that the mirror you used could have been compromised, you can download the file from the other 2 mirrors available there and compare the hashes (md5 or sha1) of the downloaded files, the probability of all three sites being hacked is not very high and could help you to feel safer about it. Checking the ...


1

A large number of installers can simply be extracted without administrator rights using third-party tools such as universal extractor and don't actually truly require administrator rights. By giving installers access to administrator mode you give them access to every part of your computer, an installer that runs without those rights only has access to the ...


1

An installer that does not ask for admin rights is safer than one that does ask, … Unless, you have admin rights and granted them to the installer. As an example, I have an installer on my MacBook that is able to install applications in /use/local/bin without asking for my admin password (called ‘brew’ for the curious). The only way that is possible is ...


1

Here is an approach that partially solves the problem: Probabilistic encryption to generate installation keys. When a user wants to install the software, they call you and give you their MAC address. You append the MAC address with the current UTC timestamp and encrypt it with a probabilistic encryption(PCBC or something similar) scheme and send the ...


1

For me, I flashed the full kali image to a large flash drive, then booted. I would recommend doing the same. Also, make sure that you are not using the VM version


Only top voted, non community-wiki answers of a minimum length are eligible