Not sure if this fits here…
An OPSEC community would probably say no, so I probably don’t need to ask in those communities. But I’m curious about a (digital) pirate’s perspective on this issue…
I mean, the sources listed here are supposedly “safe” right? But honestly, how much would you trust these “safe” sources?
When doing sensitive tasks like banking or filing taxes, do you:
- Use a different OS on the same machine? (Dualboot)
- Or put the pirated content inside a virtual machine?
- Or just use a completely separate computer?
And since PC is much different than a Smartphone:
- Would the extra sandboxing on Smartphones make pirating games on a Smartphone much safer compared to on a PC? (Not that there are much mobile games worth playing, just curious)
(PC in this context referring to all personal computers, regardless of OS)
And last question:
- Non-installed/non-executable files such as .mp4 .mkv .mp3 .pdf .epub, are mostly safe right? I mean, you are using another program to opening it, not executing a file, there aren’t much attack vectors as long as the video player / ebook viewer is up to date right? (Or am I understanding it wrong?)
I run a few games posted by johncena141 on 1337x, so I consider it secure enough :p
If that dude hacked into your machine, you wouldn’t see him anyway 🤷🏻♂️
deleted by creator
vine boom sound plays
He’d probably just upgrade your drivers to the latest stable version for your distro and fix all those W: prints you see whenever a guide tells you to “sudo apt update”.
You know who you are and you’re me.
I don’t know if the malware that could be in these games work on Linux, but I take my time in picking torrents and pick ones through uploaders I know
That’s likely safe. But…
Most malware isn’t trying to make your computer unusable anymore. That was the old days when people just wanted their “hacking” acknowledged.
You can definitely still be running a crypto miner if you sudo’d something stupid you downloaded on Linux.
I’ve never run it because I have had zero evidence to tell me it would be safe. I do run older games in emulators up to PS2. I see no issue with that.
Honestly I don’t run pirated software at all anymore. The risk is too high. If it’s a game then I’m happy to pay for it, and open source software covers pretty much everything else for me.
The only exception is switch games but they run through an emulator which is quite safe.
Most media files are safe but I’ve heard that PDFs of all files can be vectors.
I hadn’t really thought about it until reading this comment but I am definitely the same. I use to pirate so much software back in the day. But, I really just find myself looking for projects on GitHub that fit my needs.
I pirated a video upscaling program just to test it out. Topaz I think it was. But it was mostly just curiosity because it was very niche in it’s performance improvement over it’s open source alternative video2x.
That’s literally the only software I can remember pirating in the last 10 years.
If it’s good and requires a one time purchase. I buy it. Unraid is obviously going to be an example of that for a lot of people here.
I think I’ve spent more money donating “coffee” to good open source projects though. And going windows free for over 3 years now has been a big part of that. I can’t stand when I have to use Windows now. Work still forces it on me. But I literally only use it to SSH into my redhat VM.
All my piracy is media these days. And that’s only because the streaming services have basically reached the point that cable did back in the late 2000s.
Piracy has always been based on convenience rather than cost for me. “Piracy is a service issue” is the famous quote. Additionally it’s about services not giving you ownership over the thing you purchased. Which is what a lot of software has become.
Yeah, Gabe Newell definitely was quite forward thinking when he came to that conclusion, and I can definitely say it works well for my Steam Library.
Honestly at this point the main force that brings me to hunt for media is subscription services, since it always feels like a rug pull compared to alternatives. I paid for things on GOG, I get to keep the installers and back them up. I bought things on Steam, I’m not charged to reinstall or use them on other devices, and I can still download games that are delisted now (RIP poker night at the inventory).
Now that Blu-rays are going the way of Google Stadia, getting phased out, all I can really do is just rip any media I already have and download what I may need. FOSS tools have already replaced any subscription software I would use for my engineering work.
Yep. And I don’t have to use 10 different video player UIs. I can just use Plex. That lifetime pass from years ago has been worth it. Even if I know people are critical of Plex.
Yeah I used to pirate Adobe software religiously. Every version. Now I just use inkscape and suffer through the occasional GIMP session.
Same but photopea usually replaces Gimp for me now. Works in the browser and is basically Photoshop but without all the automated tools.
Yeah photopea is sick
Seems like most pirated software does a good job of trying to cut software off from internet communication so that it doesn’t get sniffed out on an add-on or update query. I don’t trust most software companies anymore as far as security goes either. So the short answer is at least personally, after scanning everything before and after installation and check network monitor for anything that looks weird while running, yes I consider my system secure still.
Curious what “safe” list you are referring to?
deleted by creator
I mostly just avoid running pirated software. If I have to, I run the executable bits through stuff like virustotal first. And I keep my system updated.
Publisher matters. Some random website advertising a disk cleaning utility could be malware while a Fitgirl repack most definitely isn’t. Installing something from an official Ubuntu software repository is also pretty safe, while something from a 3rd party repository or community development library could be malware. I also generally trust PDFs from Anna’s Archive and Libgen or Internet Archive, because of the reputation loss to them if it were. You can minimize your risk to a tolerable level this way.
what about z-library?
Clean copies of GOG games can be hash-checked. The only pirated games I really fuck with are GOG.
Although I wouldn’t be too worried even if I did because I’m in Linux, and anything I did would be sandboxed and closed off from the rest of the system since it’s running in a compatibility layer.
A compatibility layer like Wine is not a replacement for a true sandbox. Although Wine may have some basic sandboxing capabilities, the default wine configuration grants access to your home directory, which something like ransomware could take advantage of.
and even if you remove the Z: drive letter, in my understanding the software can still access your filesystem if it was prepared to call linux specific kernel functions, or if it has a copy of its own glibc or musl and is prepared to use it
Is that still the case if you use it in a flatpak e.g., Bottles?
You can configure launchers such as Lutris to run your games inside a proper sandboxing application such as “firejail”.
Just look into “Command Prefix” under Global Options in Lutris: a sandboxing app like firejail is used by really just running the sandbox app with the original command as a parameter of it, so that means you “prefix” the original command with the sandbox app and its parameters.
You can go as crazy as you want if you do sandboxing like that (down to only allowing access to whitelisted directories). In my case I’ve actually limited networking inside the sandbox to localhost-only.
that should patch it up, mostly. flatpak gives real isolation. It’s not 100% though, things can leak, like I think X11 access is unlimited, so wine programs can read other window contents, capture and inject keystrokes and mouse events if they are prepared to do it. but wayland windows they can’t see or even know if they are open. but they may still be able to mess with your bottles config and other things installed for the bottles flatpak container
An OPSEC community would probably say no, so I probably don’t need to ask in those communities. But I’m curious about a (digital) pirate’s perspective on this issue…
Still committing OPSEC crimes, but I’m not as bad as I could be :P
I mean, the sources listed here are supposedly “safe” right? But honestly, how much would you trust these “safe” sources?
I think we’re talking about different sets of standards. Even with that in mind, my own “trusted” list is a much smaller handful of any list posted online. Trust in pirate spaces shouldn’t mean at face value and should be constantly tested with stuff like virustotal. It just means I haven’t been compromised or seen anyone else report back with an infection for a long stretch of time on a specific website. There’s always occasional breaches as malware enthusiasts test the waters now and then, usually not with a big/popular release. Stuff that could fly under the radar. Usually it comes down to whether or not that website has an active comment section or forum with active mods/admins who stamp it out continuously. I tend to prefer traditional bulletin board forums. rutracker.org or cs.rin.ru. I still don’t touch any file right away. I let other people be the “brave” lab rats. See if any squeal first. I tend to avoid niche application piracy entirely. Those seem (and have been in my youth) to be the virus hotbeds cracked by total unknown entities. Plus I don’t mind paying for independent / small company niche software. Often enough in those cases I can find a free open source alternative anyways.
It’s worked out so far. I haven’t been compromised in my adult years. But this isn’t some “do as I do” thing, it’s basically internet street smarts. Comes with experience and infections. I minimize risk and can trust my gut now, but I acknowledge it’ll never be risk free.
When doing sensitive tasks like banking or filing taxes, do you:
>Use a different OS on the same machine? (Dualboot) >Or put the pirated content inside a virtual machine? >Or just use a completely separate computer?Separate computer. An otherwise useless old laptop running Fedora. OPSEC would probably say it’s not good enough because it’s on the same network as computers which installed pirated software.
And since PC is much different than a Smartphone:
Would the extra sandboxing on Smartphones make pirating games on a Smartphone much safer compared to on a PC? (Not that there are much mobile games worth playing, just curious)
GrapheneOS here which does sandbox better than most, but I don’t use my smartphone for anything sensitive. That’s really without trying to, it’s just not something I ever felt the need to use a smartphone for. I’m not as familiar with Android/Linux as I am with Windows. I know exactly where to periodically check for telltale signs of infection on Windows. I can still bend that OS to my will even as it gets worse for most end users. I’m less sure of myself on anything else. Working on that, HTPC is Fedora KDE spin now. Like you say, not much mobile games to play. I think I’ve bought like…3 ever. So, never felt much need to sideload. I usually stick to F-Droid and NDS emulators anyways. I have a Picross / Picross 3D addiction.
Non-installed/non-executable files such as .mp4 .mkv .mp3 .pdf .epub, are mostly safe right? I mean, you are using another program to opening it, not executing a file, there aren’t much attack vectors as long as the video player / ebook viewer is up to date right? (Or am I understanding it wrong?)
Usually, but sometimes there can be a flaw in a specific application exploited. I don’t think I know of any from media formats outside of maliciously edited ROM files smc or v/z64 for cartridge based system emulators like extremely outdated ZSNES or Project64 1.6 specifically.
I run such games on Linux now, mostly with wine/proton. There is some risk, sure, but I’d largely say that system is still secure. If something comes by and wipes out the system, I have snapshots of anything important, including root and home. If those are gone, I have versioned backups offsite and maybe offline. I don’t expect to receive any malware targeting my somewhat esoteric software choices from windows games, so I feel okay logging into a secure sevice, for example, but I may have to adjust this in the future.
With regards to smartphones, I think there are so many holes that it’s not much more secure, if any, than a paranoid desktop setup. From time to time I have installed random APKs and had extreme anxiety each time. I am massively more paranoid about my phone as I don’t have real control over what’s running on it. Hoping for more competitive open source solutions in the future.
Generally speaking, opening non-executable files is fine. There are and have been specific exploits which allow arbitrary code execution, but it’s dependent on the application/library loading them. The bigger danger is files disguised as other things. This is especially bad on Windows as it likes to hide that information from users, or just execute random embedded vbscripts, or whatever. Also see the recent whatsapp mimetype bug/exploit. Certain things pose more of a risk than others. PDFs (thanks adobe) can embed arbitrary javascript which is meant to be executed. Same as web pages, of course, but browsers have a lot more attention to sandboxing.
Edit: I don’t really run cracked software anymore, but I have VMs ready to go if need be. Would recommend others do the same.
pdf files can contain javascript code that can run when it is opened. but when using complex formats (I think almost all video files, pdfs), it can happen that the software that understands it makes mistakes when reading it and making sense of it, and an attacker tries to make use of this to trick your software into doing something that wasn’t intended by its creator. this is how it can happen that an mp4 file (or mkv, others, …) cannot contain executable code (according to specification), and yet it can
in the case of pdf files, bundled fonts may be another source of problems
I’m on Linux, using Bottles to run pirated games. It adds a little bit of sandboxing, compatdata is usually a weird environment for malware to effectively work in (unless the malware is written specifically for it), if the game is really sketchy then I’d just disable network access for bottles flatpak too just to make sure.
All in all, I do sometimes have a little bit of paranoia and look through processes to see if there’s anything running and periodically go through some folders to see if there’s anything weird or unusual there, I’d still consider my machine to be safe.
As for the last question, PDF’s are an attack vector and should be used with caution. As for other file types, it depends on the software you use to run them - if it’s something pretty barebones that just plays it then it’s usually fine, but if its something more complex and reads some custom data embeded into those files, then it can be a vulnerability. Not a security expert though, but it’s the gist I got from looking at some historical vulnerabilities.
First thing a malware would do is to replace top/ps and related utilities, to mask itself. Or directly replace kernel calls. You will not notice by just checking running processes
No, I try to treat that machine like a quarantine zone, I have a two PC setup and that’s part of the reason for it. So basically I don’t log into online accounts on that one (except relatively unimportant accounts for convenience, like Steam), and I don’t do important stuff on it
Any questionable software I have is coming up on 4 years old now, most of it is older than that. I move them to a new machine every time I upgrade, simply because I don’t trust torrents anymore.
Honestly, I don’t trust PDFs anymore unless they’re from places I know are “safe” which kind of sucks because I’ve been getting back into RC as a hobby and it’s hard to find non-pdf plans. I prefer vector files, but I’m having to try my luck with jpg and png files.
A lot of the programs I used to use have been surpassed by current FOSS projects, and I’ve been replacing them as I can. Finding an open source laser engraver program that isn’t shit is proving difficult.
Most PDF attacks target Adobe Acrobat and Reader. A few probably target Foxit or other minor players. If your PDF reader doesn’t support stuff like macros, you’re probably safe.
You might also be able to use something like ghostscript to manipulate PDFs and strip the fancy features.
Ah. Well that’s a relief, I removed foxit, and never had anything Adobe.
I open the pdfs in inkscape to pull the vector files and save them as an svg. There’s probably a simpler way, but this allows me to open the vector in a lot more programs like my laser software and my CAD programs.
The only pdfs that get printed like a normal person are small rc planes and the files are from trusted sources.
It’s nice to know I can do a little extra to protect myself from pdf based attacks though, thanks for the info!
the games I pirate are all in my Lutris app which I installed as a flatpak on Linux, so they don’t have the necessary permissions to change important files.
also I install them in the virtual C: drive, and they normally shouldn’t thouch the virtual Z: drive. I don’t think a hack would do that because installing malware on the windows drive should be enough for most people pirating games
Thanks for the new rabbit hole 😂
