I understand that sharing video, photos, documents etc. is relatively safe because the data is not executed in the processor as instructions. How come people are willing to download and install pirated software though? How can one be confident that it does not contain malicious addons? Are people just don’t know the risks? Or are there protection mechanisms that I am missing? I mean since the software is usually cracked there is not much use in comparing checksums with the originals, is it?

  • pre@feddit.uk
    link
    fedilink
    English
    arrow-up
    141
    arrow-down
    2
    ·
    1 year ago

    Worth noting that paying for a license for software doesn’t stop it being spying malware either. In fact the pirate versions often take out the spying and the reporting-to-homebase that proprietary software does.

    The photoshop that phones home to check a license is arguably more malicious than the pirate version that has been cracked so it doesn’t do that.

    • alexg_k@discuss.tchncs.deOP
      link
      fedilink
      English
      arrow-up
      14
      ·
      1 year ago

      Good and valid point. I use opensource software wherever I can.

      Though paid software is not going to encrypt your data for ransom or use a keylogger to steal bitcoin (yet).

      • NullGator@lemmy.ca
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        There was an antivirus that was caught running a bitcoin miner in the background tbf. If memory serves it was Norton?

  • b1ab@lem.monster
    link
    fedilink
    English
    arrow-up
    99
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Long story short.

    1. Be prepared for disaster.
    2. Scan it. Sandbox it if concerned.
    3. Firewall inspect/block/allow every outbound comm.
    4. Get it from a trusted source.

    Basically the same stuff you should be doing with all software.

    Edit for firewall clarification.

      • b1ab@lem.monster
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        I don’t really use Windows except for playing games, so someone else may have a better answer.

        For me, I want 3 types of protection, priority order.

        1. Rootkit and ransomware protection. Lock down and protect system files.

        2. Firewall. Stop software from calling home (and possibly invalidating my forged license) and to stop malware from reaching out to command and control systems.

        3. Malware scanning and suspect execution detection. Most antivirus software detections will be in only one of a couple categories: keygen, generic trojan, or obfuscated executable. If I encounter this, I go to VirusTotal.com and drop the offending file(s) for it to scan. If I’m still concerned I will use an online sandbox execution recorder that tells you what the exe does such as outbound comms, file modifications, registry read/writes, etc.

        Windows Defender accomplishes these requirements. Although it is a bit clunky and other mainstream antivirus (paid or free) accomplish the same in a much cleaner interface.

        I cannot stress enough the importance of downloading pirated software from a trusted source.

        • MrPoopyButthole@lemmy.dbzer0.com
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          We are seeing on our corporate network lots of browser hikackers that connect to c&c and are used in botnet DDOS as a service. Once you install x software it sets up a persistent service that keeps modding chrome.exe etc

          Firewalling the .exe that you installed does nothing to stop the calls to c&c

          • b1ab@lem.monster
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Fair point. Malware can tunnel through existing comms, thus firewalling the exe would do little to protect you.

            That’s why I recommended a multilayered defense and practicing good opsec.

            An exe that installs a service, modifies unrelated executables, and sends comms through an unrelated application would be a catastrophic failure in any good defense.

            If your system is this wide open then you’ll be likely to have all sorts of problems from non pirated software. Such as freeware that installs adware.

            I have tried to find these in the wild to no avail.

            • MrPoopyButthole@lemmy.dbzer0.com
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              Unfortunately the machines that get infected are not fully controlled by us but they get networking and internet from us (space rental in the building), so we isolate them as much as possible and we black hole all the bad traffic on the router level.

              Our machines all have EDR and strict security policies. Not much gets past that.

      • b1ab@lem.monster
        link
        fedilink
        English
        arrow-up
        20
        ·
        1 year ago

        I don’t.

        But I take many precautions.

        I’ve been pirating software since the C64. About 40 years. Never stopped. Never will.

        I buy the good software I encounter. As a developer, i know it’s important to keep funding further development. Unfortunately most is overpriced garbage.

        • Micromot@feddit.de
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          I’m pretty new and extremely cautious with pirated software, i still need to find the precautions i have to take, luckily pirating games is much safer and easier than pirating software

          • 7Sea_Sailor@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            6
            ·
            1 year ago

            Could you elaborate how pirating games is “safer” than pirating software? Both are executables that could run whatever code they wish on your system, and since pirated games are so desirable, in my experience they are far more often spread around bundled with malware than software is. Oftentimes, you’ll find people take legitimate repacks, add malware, then share the repack under the same repackers name.

            • wolfshadowheart@kbin.social
              link
              fedilink
              arrow-up
              5
              ·
              1 year ago

              I think their idea is that if you know a specific repacker like an athletic woman, compared to downloading softwares that could be uploaded by any elitists trying to fuck with you.

              In practice both are the same, but the reputation of the athletic woman makes her more trustworthy.

              However outside of that specific repacker I actually agree with you, it’s exactly the same lol.

              • alexg_k@discuss.tchncs.deOP
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 year ago

                Interesting. If there are reputable packers / crackers, why do they not uses GPG to sign the software? That way, no one can manipulate and reupload the software.

            • Micromot@feddit.de
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              It feels safer as there are a few sites with a good reputation which is just easier to find which makes me feel safer. Idk if it is really safer than with software.

  • InterSynth@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    70
    arrow-down
    1
    ·
    1 year ago

    I trust pirates more than billion or trillion dollar companies. Also, aggressive DRM such as iLok is worse than malware, so eh.

  • merthyr1831@lemmy.world
    link
    fedilink
    English
    arrow-up
    43
    ·
    1 year ago

    It’s partly an honor system but also, anyone distributing malicious cracks are quickly called out whether its on public tracker comments like PirateBay or removed from private trackers.

    Distributors of GOOD and CLEAN cracks often earn good rep in the community too, like Monkrus which I’ve had no issue with before.

    Also, in my experience, installing a malware-packaged adobe app isn’t actually all that bad if you run a malware scan immediately afterwards. With the scale and breadth of software piracy there isn’t much money in making advanced malwares beyond bundling an existing one into an installer. I don’t recommend it, but it’s still easier and cheaper than paying Adobe!

    TLDR the community polices itself pretty well considering.

    • lemming007@lemm.ee
      link
      fedilink
      English
      arrow-up
      15
      arrow-down
      1
      ·
      1 year ago

      Also, I would consider some legitimate licenced software more of a malware than a cracked one. If your software forces always-online license, comes with annoying startup processes, nagging ad screens, etc, it’s malware. And if there’s a cracked version without those things, I’ll take the cracked version any day.

      • merthyr1831@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        I agree with the sentiment, but coin miners and ransomware are of course a lot more obtrusive to the average user’s experience than the malware you’d associate with most proprietary licensed software. I can see why people are less willing to risk it.

    • alexg_k@discuss.tchncs.deOP
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I agree with what you said, but how do I make sure that the cracked software is not further altered by other people and uploaded. Do you just select the torrent with the most peers? Is that enough? When using one-click-hosters it is even harder…

      • President@lemmy.zip
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        No. It isn’t about the torrent with most peers. It is about the source and the uploader. As someone has already mentioned it, it is about the Reputation!

        • alexg_k@discuss.tchncs.deOP
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Sorry, I am not very familiar with torrents. How can I verify that a torrent comes from a certain person? Everyone can make modified copies of the original data and uploadtorrentss that look alike. How can I avoid those?

      • merthyr1831@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        It’s hard! A lot of it is, like I said, reputation. Sources of safe pirated and cracked software are maintained mainly through word-of-mouth - The crappier and dodgy sources will always invest into SEO to get to the top of the results, and are more likely to avoid legal trouble as companies appreciate that malware-infested installers actually help discourage new pirates.

        Also, there’s generally little incentive to go beyond the basic modifications. Most online scams, even outside malware, cast the net as wide as possible and even go out of their way to avoid complexity. They get the most money out of scamming new and uneducated users who pay up quickly. The same logic means they want advanced users to know it’s a scam to avoid wasting time on targets who won’t bother paying anyway.

        I bet there are exceptions to this rule, but since scamming and malware are such low-profit ventures there’s a lot of incentive on quantity over quality.

  • CapnAssHolo@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    40
    ·
    1 year ago

    You’re thinking too technical about this. This is a money thing. Personally speaking pirated software/games were chicken soup for my poverty ridden childhood.

  • Gush@lemmy.ml
    link
    fedilink
    English
    arrow-up
    39
    ·
    1 year ago

    If i were to pay for an AutoCAD license , it would be over 200$ A MONTH

    • Overzeetop@beehaw.org
      link
      fedilink
      English
      arrow-up
      15
      ·
      1 year ago

      What kind of cheap-ass, stripped down AutoDesk suite are you getting for $200/mo. Last I checked, the architectural suite was north of $4500/yr.

    • Mothra@mander.xyz
      link
      fedilink
      English
      arrow-up
      13
      ·
      1 year ago

      That’s why I’m learning Blender, I think I’ll be able to carry on without Maya.

      Adobe isn’t pretty but Autodesk is a scourge

      • ubermeisters@lemmy.world
        link
        fedilink
        English
        arrow-up
        11
        ·
        edit-2
        1 year ago

        Maya is probably the best program to have known before Blender. Blender was definitely geared from day one to be switched to from Maya, 3dsMax and Lightwave (back in the day).

        In other news, Autodesk is constantly accusing the company I work for of stealing licenses even though we over purchase licenses. They can go to hell.

  • Deathcrow@lemmy.ml
    link
    fedilink
    English
    arrow-up
    25
    ·
    edit-2
    1 year ago

    How come people are willing to download and install pirated software though?

    You can just remove “priated” from that statement and come to the same conclusions. Considering the amount of bugs, backdoors and 0-day exploits distributed via official software I sometimes wonder why people execute proprietary, closed source programs at all.

    An no, “reputable” companies mean nothing, just look at Microsoft clowning around with their signing keys.

    • Rivalarrival@lemmy.today
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      1
      ·
      1 year ago

      Exactly. Piracy extends the commercial ecosystem. Every software pirate is a potential user and contributor of FOSS projects who is instead spending their time and talents working on/with commercial offerings.

      To a distributor of commercial software, a pirate user is preferable to a user of a competing product. The competing user is already locked into the competition’s product line; the pirate is expanding your own product line’s market share.

      Below the competing user is the FOSS user: it is much easier to monetize a pirate user who likes the system enough to steal it, or a competing user who has demonstrated they are willing to throw money at their problems. FOSS users aren’t willing to tolerate all the artificial limitations imposed on the product to increase profitability.

      I have no moral or ethical qualms with piracy as a general concept, but software piracy inherently promotes commercial alternatives at the expense of FOSS products. The only software I have pirated in decades has been rare, niche software for very specific uses.

    • b1ab@lem.monster
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      I sorta agree with @darcy. The quality of FOSS (nowadays) is pretty damn good. If I need something I look at FOSS first, dig in github, and then finally look around for a paid program.

      Edit to say “paid” program.

    • mtchristo@lemm.ee
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Unfortunalty most professional Autodesk software have no viable FOSS alternative (except Blender)

        • mtchristo@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          I meant only blender is a solid contender to 3dsmax or Maya. Other Autodesk products like autocat. Civil 3d. And Revit don’t have any solid Open source alternative.

  • rambos@lemm.ee
    link
    fedilink
    English
    arrow-up
    20
    ·
    edit-2
    1 year ago

    I feel safe, maybe I shouldnt, but my life wouldnt be this good if I didnt have access to everything I cracked lol

  • Gothian@lemmy.world
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    6
    ·
    1 year ago

    Your assumption is wrong mail can contain executables. Picture can hold executable instructions and so do videos. For example videos and pictures in mail can contain virus. You are not safe just because you download movies and pictures

    • whoareu@lemmy.ca
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      Can you explain how can a picture holds a executable in it? Also you have to make the file executable to run it. Something like chmod +x random.mp4

        • alexg_k@discuss.tchncs.deOP
          link
          fedilink
          English
          arrow-up
          12
          ·
          1 year ago

          I think it is very rare to find or even craft a video file that is able to allow for arbitrary code execution on an updated video player software like VLC. The same is true for photos or documents with the exception of office documents using macros.

          • Dr. Jenkem@lemmy.blugatch.tube
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 year ago

            “Updated” is doing a lot of heavy lifting here. Lots of people don’t keep their software up to date.

            But yeah, the likelihood of any of us randomly happening upon 0days in the wild is pretty low.

          • Gothian@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            2
            ·
            1 year ago

            Not at all. I work with development of various kinds and have my desk close to our senior it security specialist he says that we get daily that kind of stuff in our emails so I don’t see why they should exist less on pirated torrents

            • voxel@sopuli.xyz
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              edit-2
              1 year ago

              maybe you mean like exe files disguised as pngs?
              actual malicious image files are extremely uncommon (and target specific image viewers of outdated versions, like imagine an archaic os like windows 7 or xp); libpng/libjpg that are used in most popular image viewers are open source and do not currently have any significant (discovered/publicly known) vulnerabilities

      • Ragerist@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        1 year ago

        One of the techniques is called buffer overflow. Where you target a flaw in some software. Computers are logic, they will do EXACTLY what you tell them. Imagine if an image viewer uses an dll to process jpg. That dll expects a very specific header. If this is not handled correctly and a malicious attacker crafts the header to be slightly larger and the larger part contains executable code. This code spills over in the adjacent memory area. The OS then reads this as code to run… and boom you are in.

        This is oversimplified and proberly not explained correctly, but its something like that; and that kids, is why its important to update your OS and software.

        Sometimes they find bugs like this, that have existed for many years before being discovered.

  • 🐱TheCat@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    20
    arrow-down
    1
    ·
    1 year ago

    Meh, how is surgery a thing? You let people just open you up and dig around your insides?

    it’s a mix of need and belief in a proper vetting process. For computers there’s the additional layer that any one machine is probably low stakes. In early internet days most software was prohibitively expensive but gave you the equivalent of super powers - as a teenager / young adult with ability to take that risk you’re not going to do it?

    • alexg_k@discuss.tchncs.deOP
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Well, I prefer to go the hospital with licensed personnel and not to ask some guy on the internet to perform surgery…

      • nestEggParrot@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        1 year ago

        And where those are illegal or prohibitively expensive you have people either traveling to less regulated countries or even straight up illegal operations.

        Eg., black market transplants.

  • chicken@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    1 year ago

    If I get malware, I can just go reinstall my OS. If I pay for software, I’m never getting that money back.

      • nestEggParrot@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        And have something worth loosing on gheir PC. Many professional software users using cracks may worry of losing their work files which could be easily backed up.

        As long as they dont have their financials or personal information thats worth stealing, the cost saving of the pirated software is worth infection, which at max needs a fresh install.

      • chicken@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        I have a two PC setup, I treat the windows one with the pirated software as always potentially infected so the potential damage is limited. It’s probably not infected though, I do take the most basic precautions and haven’t had issues with malware for many years.