Advice Request What would happen if a legimate program, OS, or game somehow had a virus or malware installed on it from the official source?

[struppigel]

How would you know or prevent it before you use it ?

Hello. There is no way to 100% prevent this from happening. There were several instances like that in the past. E.g., a trusted open-source developer got a virus infection on their system (an actual virus that infects other executables). That virus infected the developer's release file which was then deployed for everyone as a new version of their program.

Other variants of include deliberate but hidden modifications of source code after the attackers gained access to the developer's systems. These are especially difficult to prevent for the user downloading their software since this is not a known malware and rather hard to detect it as such.

However, these cases are relatively rare. The reason they make the news is that they are not a common thing to happen. You cannot prevent it very well, but you actually also don't need to do something else than your general security measures to prevent infections.

 

[Moonhorse]

Pale Moon says hackers added malware to older browser versions

Server breach at Pale Moon browser project goes undetected for 18 months.

www.zdnet.com

Comodo Forums Breached, Data of Over 170,000 Users Up for Grabs

Account data belonging to more than half of all Comodo Forums users has been stolen and is now traded online. The breach was possible by exploiting a vulnerability in the software that powers the forum.

www.bleepingcomputer.com

 

[show-Zi]

I have a feeling that if my old or well-known software is tampered with, I will wrongly assume that it is a false positive even if it is detected....

 

[Stopspying]

"....a virus or malware installed on it from the official source.."

Now I wonder if this is where Revil got their idea from for the Kaseya attack?!!!!

 

[cruelsister]

The mechanism is in a way sort of cool as the ransomware is digitally signed (by PB03 TRANSPORT, now revoked), runs a script (certutil pops up again within it, of course) that kinda-sorta disables Defender while at the same time dropping a legitimate Defender Antimalware Application (msmpeng.exe) as well as the malicious mpsvc.dll (knowing that Defender isn't all that swift with regard to side loading attacks).

Although the blame for Kaseya will be placed on the hackers, the real blame lies with those that utilize sub-optimal malware defenses.And not that anyone asked, but CF laughs at this one prior to malware eradication.