You’re infected—if you want to see your data again, pay us $300 in Bitcoins

Re:You’re infected—if you want to see your data again, pay u... by Pxtl on Thursday October 17, 2013 @09:48PM (#6569307)

Installing into %AppData% is, iirc, Microsoft's intended approach with ClickOnce installers (which Chrome uses). The difference is that ClickOnce installers have a far more restrictive permissions model than old MSIs.

ClickOnce-installed applications are limited to "Internet Zone" permissions. This can make them immensely frustrating to develop with, actually, since many of MS's own development frameworks fail miserably in Internet Zone even when they have no reason to do so (mostly they generate temporary files in places they aren't allowed).

I'm not sure how Google Chrome gets permissions to save files into your documents and whatnot from there - I don't recall Chrome requesting a permissions escalation during install or anything.

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by Silhouette on Thursday October 17, 2013 @11:01PM (#6569526)

Fascinating. Thanks for sharing this information. I had no idea this was actually a sanctioned installation option, but clearly it is if you know what to look for[1]. That's actually rather disturbing, from a security point of view...

[1] http://msdn.microsoft.com/en-us/library/142dbbz4%28v=vs.90%2...

[ Parent | on HN ]

Re:You’re infected—if you want to see your data again, pay u... by FedRegister on Friday October 18, 2013 @08:52AM (#6571061)

Signed ClickOnce deployments can request elevated (above Internet Zone) permissions. We do that with the ClickOnce app we deploy.

[ Parent | on HN ]