61–70 of 75 posts
SentinelOne, creators of anti-virus software no one has heard of, don't use the term "anti-virus" for their anti-virus software. Somehow that landed a sucker at Forbes to write a shoddy PR article about the death of anti-virus software. End game; If their PR stunt is wildly successful then no one will need to buy SentinelOne's software either... Wat?!!
Earlier quoted context omitted.
Sure. So it turns out Netflix is this really big company, and I met one of their security architects at Black Hat. I thought, hey, I wonder if they're up to anything interesting at Netflix. I'll give them a call. A love letter? You send love letters like this to people? Are you like a post-modern Keats?
OK, so then you talked to someone at Netflix, and they said, what, "umm... well, we just replaced our anti-virus product with this other thing called SentinelOne that isn't really an anti-virus product", and then you looked at their site and called them and decided they totally weren't an anti-virus product? And that the real story here was that this was the death knell for anti-virus, or the beginning of "post-AV an…
Earlier quoted context omitted.
I disagree with the statement that it reads like a love letter, but I very much agree that you should clarify what's meant by "the post-AV anti-malware game".. It comes across as a wannabe-buzzword, and something of a contradiction. Further, I can't find any reference elsewhere.
Oh and post-AV anti-malware game: AV sucks and doesn't really do much to protect you against decent malware. Post-AV anti-malware systems do better.
Calling it post-AV just doesn't seem to offer anything. That's what's making this sound like PR for SentinelOne - maybe they do have a better offering than anybody else, but drawing an arbitrary line (the 'post-AV' line, where everyone else is 'left behind in AV-land') doesn't lend any credibility.
I guess we're going to debate the merits of statements in a thinly-veiled bit of PR now? There's almost no news about this company until about a month ago ( http://www.networkworld.com/article/2955017/security/endpoin... ). They recently hired a new PR company ( http://www.mgpr.info/ ) who's been spamming articles to Reuters on SentinelOne's behalf ( https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentin... ),…
Just wanted to chime in to clarify that I contacted Netflix directly without having ever spoken to SentinelOne. When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract. Much love, Sucker at Forbes.
In 2014, Lastline Labs discovered only 51 per cent of AV scanners were able to detect new malware samples.
First, consider that for some definition of "new" you can get that number up to 100% or down to 0 (stuxnet). Second, the fact that over half of a crowded, very uneven field accomplish something really difficult is remarkable, and yet you use the word "only" as if all antivirus should detect modern threats. Third, you somehow manage to imply that it's rational to dump any AV because 51% of your options fail at doing something hard.
Perhaps I'm old-fashioned but I think reporters should work hard to avoid spin. In this case, removing the "only" and fully explaining what the take-away is (and isn't) would help a lot.
Wait until an employee gets some malware and some data gets leaked or lost. Then they'll be running back.
if you read the linked article the you will notice that they don't dump AV - they just switched to a "AV" product that does away with the signature database completely and replacing it with heuristics - it also sounds like there is some white listing of processes involved as well. This is something AV products have been doing for quite some time now.
Earlier quoted context omitted.
[Comment above]( https://news.ycombinator.com/item?id=10135598 ) says journalist met Netflix guy at Black Hat.
Ok, fair enough. If the writer insists this is a legitimate piece, I'll believe him. You have to admit though, this certainly reads like a native content article. In the current business climate, you can't fault people for assuming this was paid for.
And things like Reason Core are brilliant for nuking any rootkits that somehow get on to a system https://www.reasoncoresecurity.com/
Malware has grown up and is now residing in hardware and can survive entire OS re-installs. I feel sorry for Windows users these days because malware has grown up and it is not as obvious you have malware. In the past there were obvious signs you were infected and the malware made itself known (sort of stupid when you're an attacker really).
Also some of the 'second opinion' tools are interesting too:
Earlier quoted context omitted.
It takes about 5min to refactor the code of existing malware to avoid detection, heck playing around with compiler settings is enough in many cases. I've recompiled Netcat probably 200 times by now, small refactoring playing with compiler flags (compile with x64 profile, debug on, add some symbols etc..) and every time it avoids every AV out there. I usually use Virustotal which means that it will be short lived but…
There's actually tools to automatically do what you're talking about for malware: http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai (Japanese for "it can't be helped")
Earlier quoted context omitted.
There's actually tools to automatically do what you're talking about for malware: http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai (Japanese for "it can't be helped")
That encoder is less for bypassing AV and more for replacing characters which cannot be transmitted in the payload (eg. null bytes)
Earlier quoted context omitted.
There's actually tools to automatically do what you're talking about for malware: http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai (Japanese for "it can't be helped")
Encoders and compactors are not good actually they usually leave too many patterns that are easy to detect. The might work on some binaries in some cases but if you want to avoid evasion refactor the malware yourself. Encoders and compactors are intended to modify existing binaries only :)
Seems like it's pretty effective for bypassing AV according to how everyone is using it.