You know that whole .desktop file security scare?

It goes something like this:
1) Open a malicious email attachment or go to a website with malicious javascript or whatever...
2) A program is downloaded and executed with your permissions
3) It edits ~/.local/applications/synaptic.desktop or whatever other popular program.
4) In the new .desktop file it adds to the run command some nasty key logger, so now when you launch Synaptic (or pacman if someone were to attack Archers) it logs your keystrokes.
5) Now it has your root password and can do whatever it wants.
I just want to know: How likely is this, really??
Can a website seriously just download and run a file without me knowing? I doubt Firefox would let that happen... Or could an email attachment be executed without me being able to read it first? I'm pretty sure it can't...
I don't understand why people seem to be concerned about .desktop files...
I'm not even worried about my Windows machine on my home network. My router is set to reject as much stuff as it can and all computers have remote log-ins disabled. The only security problem I worry about is that my Fiancee's online courses actually send .doc's through the net, which I've heard is bad practice.

What I've read about it has a nasty tweak, a properly crafted .desktop file could launch a dialog asking for your/root password, at that time it wrecks havoc in the system and open the add/remove software, updates or whatever is it disguised to do and the user doesn't realize what just happened.
Of course there is always the other option of running as user and do whatever it can, if the creator is smart and lucky enough he/she will be able to put a nasty payload on the autostart list and the user can have a zombie machine without even knowing.
It doesn't need to break the system to do a lot of damage, wiping or stealing data from the user account is enough. Of course, this has a higher probability of happening if you run and/or install everything you find in untrusted places without proper review first.
The thing is that there are so many distros and so many versions of each distro, each with slightly different settings, DEs, browsers and whatnot that I guess it still isn't worth the bother unlike with platforms where everyone uses the same browser, possibly the default settings that come with a clean system install and worse, no security updates/patches.
Add to this the complete lack of good sense and the common (and somewhat accepted I guess) practice of using cracks and keygens for you know what and you start to understand how come at least some users keep getting the same problems over and over again.
These days with linux it is extremely easy to keep the system up to date with the latest security fixes, users tend to look free alternatives to payed programs and look first in the package manager to see if it is already available, this alone helps a lot, add a dose of good sense and you should be good to go.

Similar Messages

Did you know that your Internet Explorer is out of date?

Hello there,
when i access this site http://www.sickkids.ca/ , I am getting this error message, please advice.
Did you know that your Internet Explorer is out of date?
To get the best possible experience using our website we recommend that you upgrade to a newer version or other web browser. A list of the most popular web browsers can be found below"

It's probably giving you that warning because your Firefox is very out of date. Please read [http://www.getfirefox.com www.getfirefox.com] to see how to update to the latest version of Firefox (14.0.1 right now)

Did you know that Verizonwireless is saving your checking account information when you pay your bill by check and then making it part of your "MyVerizon"? This means of course if they get hacked that information could be compromised. What do you think of

Did you know that Verizonwireless is saving your checking account information when you pay your bill by check and then making it part of your "MyVerizon" without you adding it? This means of course if they get hacked that information could be compromised. What do you think of this?

Credit card and debit card and checking and savings information is encrypted so it is possible to be hacked, but the odds are greater to get hit by the Love Boat then to have a wide scale hack.
Oh yes they do happen, Bank of America, Chase, Citibank, Target and quite a few others. But in all the years I have paid my invoice with saved card information I never been hacked.
You use good passwords and the risk is minimal.
Good Luck

Did you know that the carrier Verizon offer the merge conference call or internet while on call on the iphone? Only AT

Did you know that you can't use the merge function on a iPhone 4s with Verizon Wireless? They blocked the function only AT&T has it, also Verizon doesn't allow browsing the Internet while on a call like AT&T, huge mistake Verizon. For people that conference call, don't get tricked into changing carriers until Verizon changes this feature.

Not sure about the merging of calls, but being able to browse the internet while on a call can't be done with CDMA technology -- so it's not that Verizon doesn't allow it, it just can't be done on their network. This is old news ...

Did you know that verizon charges ¢50 for calls from the US to Canada? Just dialing an area code like 604 (Vancouver, CA), will create charges at a rate of ¢50/minute. Amazing that they can charge this much for a call to Canada. I know they have it som

Did you know that verizon charges ¢50 for calls from the US to Canada? Just dialing an area code like 604 (Vancouver, CA), will create charges at a rate of ¢50/minute. Amazing that they can charge this much for a call to Canada. I know they have it somewhere in their contract/website.

Did you know that verizon charges ¢50 for calls from the US to Canada? Just dialing an area code like 604 (Vancouver, CA), will create charges at a rate of ¢50/minute. Amazing that they can charge this much for a call to Canada. I know they have it somewhere in their contract/website.

Hello, do you know that when you play a song skips or returns and does not play properly?

Hello, do you know that when you play a song skips or returns and does not play properly?

I can not fix this problem and it happens with songs purchased or imported from a CD

I just wanted to let you know that you have lost ANOTHER customer and more to c

Nothing you can do at this point will EVER make me want to purchase your products. I have ripped out the cards in my other computers and trashed them. I have forwarded this community abuse stupidity you have instigated?to all of my friends and they are as irritated as I am. Your questionable approach to business practices will continue to dri've you out of business. You have left a bad taste in many mouths with your driver support fiasco.
Whoever approved the stance you took on community based support for technology that WE the consumer purchased and own, should be fired. Your approach to business is the definition of evil. It isn't over. Your company is history to many.

Apple sent email to all our customers using our business account email address. Our customers received email below from our email address:
Dear member,
This is a message by the system to let you know that you have to confirm your account information. Your account has been frozen temporarily in order to protect it.
Once you have updated your account records, your information will be confirmed and your account will start to work as normal once again.
-Please make sure to link your credit card to your account just to confirm your identity.
Sign in to your Apple ID
unsubscribe | Support | Privacy Policy
Copyright © 2014 All Rights Reserved.

So, you know that hidden window?

The one that you are using to block REAL "desktop" developers from usurping all of your scandalous money making schemes, with 8 and 10?
I am gonna SHATTER it and put all that work you spent trying to stifle end user and developer evolution to waste.
I allowed it to stay, on 8, cause 8 sucked so much ass and decided to let it be. But then you had to go and do all of this. Your tactics have changed, due to backlash from 8 But the resulting stifling of the world's progression so that you can turn a buck,
has remained.
No need to reply, I wont be here. Have no interest in your response. Would be wise to begin thinking about being "about" end user and developer evolution, first and foremost, not your pocketbook. Cause this line that you currently are on is only
going to end up as a bust.

What I've read about it has a nasty tweak, a properly crafted .desktop file could launch a dialog asking for your/root password, at that time it wrecks havoc in the system and open the add/remove software, updates or whatever is it disguised to do and the user doesn't realize what just happened.
Of course there is always the other option of running as user and do whatever it can, if the creator is smart and lucky enough he/she will be able to put a nasty payload on the autostart list and the user can have a zombie machine without even knowing.
It doesn't need to break the system to do a lot of damage, wiping or stealing data from the user account is enough. Of course, this has a higher probability of happening if you run and/or install everything you find in untrusted places without proper review first.
The thing is that there are so many distros and so many versions of each distro, each with slightly different settings, DEs, browsers and whatnot that I guess it still isn't worth the bother unlike with platforms where everyone uses the same browser, possibly the default settings that come with a clean system install and worse, no security updates/patches.
Add to this the complete lack of good sense and the common (and somewhat accepted I guess) practice of using cracks and keygens for you know what and you start to understand how come at least some users keep getting the same problems over and over again.
These days with linux it is extremely easy to keep the system up to date with the latest security fixes, users tend to look free alternatives to payed programs and look first in the package manager to see if it is already available, this alone helps a lot, add a dose of good sense and you should be good to go.

Extract Embedded Images-did you know that-

there is actually a feature in Illustrator to do this even though it is not called Extract Images?
Not only that once you extract the image you can update it as well you do not have to lace it again and reposition it.
When I saw this and realize it was there I could not believe it as it has been asked so many times and there have been numerous work arounds.
The reason I think it has passed everyone by is that it is not located in the links panel.
So to the chase.
Edit>Edit Image
and then
Edit>Update Image
The former opens the embedded image in Photoshop
edit it there and then save it
then back in Illustrator go to the latter and it will be updated.
Never noticed this before.
The only draw back is that it seems to only work on one image at a time.
I wonder how many users here knew about this little feature?

Monika Gause wrote:
rijackson741 wrote:
Copy and paste doesn't retrieve the original image.
Why not?
You will have trouble getting the original resolution in case the image has been scaled in Illustrator.
Yes you're right about that, and it is the best way if you have the original Illustrator file with the embedded image.
In my defense, I'm mostly having to do this sort of thing with PDFs that are sent to me. Most cases I have to change something in the PDF or pull artwork out for another project we are working on. After opening the PDF in Illustrator, we then just copy the image and even paste it straight into an email (Mac) and request the original file. If the original is not to be had, we then paste the image into a new Photoshop file and relink it. If need be, we'll replace it with another image later.
@rijackson --- you most surely can "Relink"... well that's what the button you choose in Illustrator is called... even if the image is embedded. This will place the image in the exact same place and size as the embedded image, thus "linking" it if you checked the Link box when placing.
Also, you can always choose Link Information and see what transformations the image has went through regarding size and rotation. This is also with a native Illustrator file only. The information can be used to calculate what you need to do to the image to revert to it's original size and rotation. Rather unfortunate, because something intuitive like Freehand used to have, like changing the percentage and angle in the Appearance panel was far better and easier to revert images, embedded or linked.
@rijackson --- considering all of the features and functions that Illustrator still does not have or are incomplete... yes, Illustrator as a whole is pathetic as the only pro vector alternative on the market. Not just this one omission, which is easily worked around. That's what I was trying to say to wazi9909.
* I just thought it should be mentioned again, that Monika's correct answer only applies to a native Illustrator file if you have it, AND if you save with PDF Compatibility or as an Illustrator native PDF. With any and all other PDFs saved with a preset like for prepress... the images have been compressed, and will be as we call them "baked". No matter how you copy, paste, export or open, the resolution, size and quality is "finished".

Did you know that HP has a channel on YouTube?

Did you know HP has a YouTube channel containing various videos covering common questions and PC tasks? This includes desktops, notebooks, and printers.
The channel can be found here. Under Browser videos, the right side of the page will have three other channels for specific product lines.
↙-----------How do I give Kudos?| How do I mark a post as Solved? ----------------↓
This question was solved.
View Solution.

I do hope others find the videos useful.
↙-----------How do I give Kudos?| How do I mark a post as Solved? ----------------↓

You know where to find a security lock for a Macbook Air?

Exist or not?

You don't specify the level of portability you require.
Kensington makes a lockdown dock that would be a bit cumbersome for travel.
http://www.kensington.com/kensington/us/us/p/2811/K67759AM/safedock%E2%84%A2-for -macbook%C2%AE-air-13-security-dock-keyed-lock.aspx
I've seen some other types of brakets that feed through the gap between keyboard and screen, but they are a bit scary inasmuch as the screen will crack if the Air is closed accidentally, or the Air will be ruined if a potential thief tugs at the cable. Makes me more nervous than secure.
Like it or not, the Air itself was made to be nothing but portable in this regard. You take it with you, or lock it in a case that itself can be secured.

Copying files from Zip Disks that have desktop files?

I'd like to copy files from a bunch of old zip disks to my external HD. Many of the disks have desktop files. How do I copy over the entire contents of the zip disc? When I last tried this awhile back it seemed cumbersome to deal with those desktop files. Was I missing a simple solution?

Hi Lee,
Open the Zip Disk in the Finder, Select ALL, then while holding the Command key down, click on the Desktop file to deselect it, then drag the bunch over to where you want to copy them to.

Did you know that: Virus or unwanted program 'TR/Crypt.ULPM.Gen [trojan]' detected in file 'C:\Users\*\Downloads\Firefox Setup 6.0.exe.part.

trying to download updated FF 6.x and got this:
Virus or unwanted program 'TR/Crypt.ULPM.Gen [trojan]'
detected in file 'C:\Users\storm\Downloads\Firefox Setup 6.0.exe.part.

I have not downloaded Firefox 6 yet, but the university here in Tempe, AZ, is telling its thousands of users that Firefox 6 contains a virus.

Dear Apple Customer, This is an automatic message sent by our Security System to let you know that you have 48 hours to confirm your account information. Your Apple account has been frozen because we are unable to validate your account information

Email scam on my iPhone

Welcome to Apple Support Communities
Delete the mail. If you are using iCloud as the mail provider, see > http://support.apple.com/kb/ts4019

Did you know that TM's browser will NOT back up your sent E-mail messages?

In Apple Mail anyway.
Since Verizon Yahoo! password fiasco, I decided just re-do my Verizon E-mail account. Figuring if I lost messages that I could bring the messages back in TM's browser.
I lost all my sent messages. I thought okay I'm going to enter my TM's browser and bring them back. However you can't do it for strange reason, the browser only has the NOW going. The pass is greyed out.
I know I should try the hard backup with Leopard's CD, but that's a pain in the butt. Besides I've saved a few E-mails since then too.
My main point is that I thought that TM's browser could restore EVERYTHING on my Mac. I've gotten a little sloppy since TM figuring that I had a good and fast backup system.
If TM's browser doesn't backup everything then Apple needs to tell us what it doesn't back up.

Here is a list of things TM excludes by default:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>ContentsExcluded</key>
<array>
<string>/Volumes</string>
<string>/Network</string>
<string>/automount</string>
<string>/.vol</string>
<string>/tmp</string>
<string>/cores</string>
<string>/private/tmp</string>
<string>/private/Network</string>
<string>/private/tftpboot</string>
<string>/private/var/automount</string>
<string>/private/var/log</string>
<string>/private/var/folders</string>
<string>/private/var/log/apache2</string>
<string>/private/var/log/cups</string>
<string>/private/var/log/fax</string>
<string>/private/var/log/ppp</string>
<string>/private/var/log/sa</string>
<string>/private/var/log/samba</string>
<string>/private/var/log/uucp</string>
<string>/private/var/run</string>
<string>/private/var/spool</string>
<string>/private/var/tmp</string>
<string>/private/var/vm</string>
<string>/private/var/db/dhcpclient</string>
<string>/private/var/db/fseventsd</string>
<string>/Library/Caches</string>
<string>/Library/Logs</string>
<string>/System/Library/Caches</string>
<string>/System/Library/Extensions/Caches</string>
</array>
<key>PathsExcluded</key>
<array>
<string>/.Spotlight-V100</string>
<string>/.Trashes</string>
<string>/.fseventsd</string>
<string>/.hotfiles.btree</string>
<string>/Backups.backupdb</string>
<string>/Desktop DB</string>
<string>/Desktop DF</string>
<string>/Network/Servers</string>
<string>/Previous Systems</string>
<string>/Users/Shared/SC Info</string>
<string>/Users/Guest</string>
<string>/dev</string>
<string>/home</string>
<string>/net</string>
<string>/private/var/db/Spotlight</string>
<string>/private/var/db/Spotlight-V100</string>
</array>
<key>UserPathsExcluded</key>
<array>
<string>Library/Application Support/SyncServices</string>
<string>Library/Caches</string>
<string>Library/Logs</string>
<string>Library/Mail/Envelope Index</string>
<string>Library/Mail/AvailableFeeds</string>
<string>Library/Mirrors</string>
<string>Library/PubSub/Database</string>
<string>Library/PubSub/Downloads</string>
<string>Library/PubSub/Feeds</string>
<string>Library/Safari/Icons.db</string>
<string>Library/Safari/HistoryIndex.sk</string>
</array>
</dict>
</plist>

You know that whole .desktop file security scare?

Similar Messages

Maybe you are looking for