Moving to piefed.lemmy.fan/c/weird_news - Weird News - Things that make you go 'hmmm'

1617 readers

1 users here now

Weird News is moving to https://piefed.lemmy.fan/c/weird_news on Friday June 27th. Please subscribe to the new community before then.

Rules:

News must be from a reliable source. No tabloids or sensationalism, please.
Try to keep it safe for work. Contact a moderator before posting if you have any doubts.
Titles of articles must remain unchanged; however extraneous information like "Watch:" or "Look:" can be removed. Titles with trailing, non-relevant information can also be edited so long as the headline's intent remains intact.
Be nice. If you've got nothing positive to say, don't say it.

Violators will be banned at mod's discretion.

Communities We Like:

-Not the Onion

-And finally...

founded 2 years ago

MODERATORS

lemmyfanadmin@real.lemmy.fan

oleorun@real.lemmy.fan

345

A Windows XP machine's life expectancy in 2024 seems to be about 10 minutes before even just an idle net connection renders it a trojan-riddled zombie PC (www.pcgamer.com)

submitted 1 year ago by oleorun@real.lemmy.fan to c/weirdnews@real.lemmy.fan

55 comments fedilink hide all child comments

Just a fun, somewhat terrifying read

you are viewing a single comment's thread
view the rest of the comments

[–] SoGrumpy@lemmy.ml 13 points 1 year ago (2 children)

I guess you missed the bit about it running on a virtual machine, huh?

[–] steakmeoutt@sh.itjust.works 0 points 1 year ago (1 children)

I guess you have no idea about Virtual Machine escape, huh?

[–] SoGrumpy@lemmy.ml 2 points 1 year ago (1 children)

Actuall, no. If a VM can be broken, how come everyone goes on about things being perfectly safe to run in one?

It gives people like me a false sense of security.

[–] steakmeoutt@sh.itjust.works 1 points 1 year ago (1 children)

Exactly. And you can see by the number of upvotes your comment got vs the number of downvotes earned by mine that a false sense of security is shared by the majority.

[–] SoGrumpy@lemmy.ml 1 points 1 year ago

Well I for one, stand corrected.

[–] slazer2au@lemmy.world -1 points 1 year ago (1 children)

VM does not mean it is safe. There is malware out there that can break the sandbox and infect the hypervisor

[–] extracheese@lemmy.world 20 points 1 year ago (1 children)

Such an exploit would not get wasted on some random xp honeypot

[–] slazer2au@lemmy.world 3 points 1 year ago (1 children)

It's XP, there are likely several unpatched escaping bugs with free POC out there. You don't need anything new.

[–] Zagorath@aussie.zone 20 points 1 year ago (1 children)

Surely breaking out of a VM requires exploiting a vulnerability of the VM, not of the OS running in it?

[–] slazer2au@lemmy.world 4 points 1 year ago (2 children)

I would assume it requires both a hypervisor and guest OS bug to be tripped.

[–] yggdar@lemmy.world 4 points 1 year ago (1 children)

It's pure speculation, but I assume you'll need

Enough access to the guest OS so that you can interact directly with the virtual hardware. That would probably require root access, so you'll probably need to exploit some bug in the guest OS to get there.
To break out of the vm, you'll then need to exploit a bug in the virtual hardware. You would want to get the hypervisor to execute arbitrary code.
If you want to infect the host OS, then you'll need sufficient access on the host. If the hypervisor doesn't run with sufficient privileges, you'll have to exploit a bug in the host as well to perform a privilege escalation. But I'm guessing the hypervisor will usually have sufficient privileges, so exploiting the host is probably not necessary.

Sounds like quite a bit of work, but I don't see why malware couldn't automate it. An up-to-date hypervisor should help reduce the risk though.

[–] extracheese@lemmy.world 5 points 1 year ago (1 children)

Theres no way an hypervisor zero day gets implemented in some random Malware. Those are worth millions and are used in coordinated manual attacks against VIP targets

[–] yggdar@lemmy.world 2 points 1 year ago* (last edited 1 year ago)

Yeah a zero-day would be very unlikely, but a months-old, publically known and patched vulnerability could always be attempted. One of the reasons why the hypervisor should definitely be kept up-to-date. There is always someone who forgets to patch their software, why not give it a try? We're talking about a Windows XP scenario after all!

[–] pivot_root@lemmy.world 1 points 1 year ago

It's XP. There's guaranteed to be a way to go from userland to ring 0 code execution.