Hiding malware in Windows: The basics of code injection • Hacker News Board

Re: Hiding malware in Windows: The basics of code injection

#21

Post by blincoln » Fri, Sep 21, 2018, 7:12 PM UTC

saagarjha wrote: post #20

blincoln wrote: post #16

Earlier quoted context omitted.

> Xcode works just fine on non-root accounts Are you sure that attaching to a process (for debugging/memory-modification) in general does on modern versions of Mac OS? "In order to guarantee support for debugging on the Mac, you need to log in on the Developer Tools Access dialog box using the administrator or root user password" [1] "DTrace requires admin privileges" [2] [1] http://docwiki.embarcadero.com/RADStudio/…

That's consistent with I'm saying. You do not need to be root to attach to a process on macOS; you merely need to be part of the _developer group. I believe admins are added to this group by default, but you can do it manually if you wish. If you don't, you'll need to type the password of an admin user before you can debug anything.

Unfortunately, I don't have access to a machine to test with - my statement was based on a lengthy discussion from a few months ago at a previous job - but I'll assume you're correct, and amend my original statement to "Mac OS is the only mainstream OS I know of that disallows debugging by non-privileged user accounts entirely." Thanks :).

Re: Hiding malware in Windows: The basics of code injection

#22

Post by rasz » Fri, Sep 21, 2018, 7:14 PM UTC

Someone1234 wrote: post #5

This might be the wrong venue but with the popularity of randomware and more complex malware attacks, I'm saddened that one of Microsoft's premiere safety technologies, AppLocker, is license restricted. AppLocker is system-wide whitelisting for those unaware. You can restrict which executables can execute based on a number of criteria of your choosing. At work I have access to AppLocker thanks to our Enterprise editi…

The second best thing you can do is Egress whitelisting. This can be done on stock W10 after disabling dnsmasq (dnsmasq acts as a hole thru windows firewall).

Re: Hiding malware in Windows: The basics of code injection

#23

Post by atesti » Sat, Sep 22, 2018, 12:16 PM UTC

rasz wrote: post #22

Someone1234 wrote: post #5

This might be the wrong venue but with the popularity of randomware and more complex malware attacks, I'm saddened that one of Microsoft's premiere safety technologies, AppLocker, is license restricted. AppLocker is system-wide whitelisting for those unaware. You can restrict which executables can execute based on a number of criteria of your choosing. At work I have access to AppLocker thanks to our Enterprise editi…

The second best thing you can do is Egress whitelisting. This can be done on stock W10 after disabling dnsmasq (dnsmasq acts as a hole thru windows firewall).

Do you have more information about this dnsmasq? Is it really a part of windows?

Re: Hiding malware in Windows: The basics of code injection

#24

Post by rasz » Sat, Sep 22, 2018, 6:15 PM UTC

atesti wrote: post #23

rasz wrote: post #22

Earlier quoted context omitted.

The second best thing you can do is Egress whitelisting. This can be done on stock W10 after disabling dnsmasq (dnsmasq acts as a hole thru windows firewall).

Do you have more information about this dnsmasq? Is it really a part of windows?

eh, I meant dnscache service.