Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

vice.com

Post reply on HN
Print view View original

31–40 of 60 posts

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#31

Post by userbinator »

jonathanstrange wrote: post #26
eps wrote: post #17

And to "trick" it into thinking something is malware when it's not you just need to pack it with UPX.

It's a shame. People have even stopped using certain niche programming languages because their non-standard compilers create executables that are often flagged by antivirus software.

Basically everything from the demoscene...

AVs have also turned into moral police with their detection of cracks/keygens/"potentially unwanted software". Detecting worms, ransomware, and the like is one thing, but I think going beyond that crosses a line.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#33

Post by djflutt3rshy »

"That is, until they discovered that Cylance also had whitelisted certain families of executable files to avoid triggering false positives on legitimate software."

Surprised to see this way down in the article. No wonder that when they manually whitelisted false positives, researchers could just append code from those to malware and it'd rank it harmless. Isn't the proper answer to not have manual whitelisting of entire programs, but to train it better to exclude them?

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#36

Post by some_random »

The actual research: https://skylightcyber.com/2019/07/18/cylance-i-kill-you/

Actual summary, Cylance has a model that uses strings as a feature, and by taking all the strings from the whitelisted files and catting them onto the malware sample one can subvert the ensemble model completely.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#37

Post by gruez »

userbinator wrote: post #31
jonathanstrange wrote: post #26

Earlier quoted context omitted.

It's a shame. People have even stopped using certain niche programming languages because their non-standard compilers create executables that are often flagged by antivirus software.

Basically everything from the demoscene... AVs have also turned into moral police with their detection of cracks/keygens/"potentially unwanted software". Detecting worms, ransomware, and the like is one thing, but I think going beyond that crosses a line.

That might work for technical users like yourself, but non-technical people need an opinionated detection engine. If the computer has some sort of software that hijacks search queries, should that be removed? Chances are the user didn't want the software there, but you can't know for sure. What about a RAT? Maybe they wanted it there to monitor their kids.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#38

Post by jm4 »

Trias11 wrote: post #3

I literally make customers disable cylance on their servers or we are not guaranteeing servers operations. Too many buggy conflicts.

How does that usually work out? Personally, I would throw out a vendor who asked me to disable my AV. I don't mind whitelisting a directory or making certain adjustments, but it's hard to take them seriously if they can't work with AV.

Cylance isn't that bad. I ran it for 3 years. The false positives were annoying, but it also stopped a lot of nasty stuff that our traditional AV wasn't detecting. I'm in an environment where there's very little appetite for risk and highly standardized endpoints so it generally worked out.

We ran it alongside Bit9 (now Carbon Black). They were both catching the same things and CB has more features. Once CB got to the point where it could be the only AV we ditched Cylance.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#39

Post by jm4 »

unsignedint wrote: post #19

I have used their home offering Cylance Smart Antivirus, and I essentially concluded that machine learning is just not enough to detect malware. It's nice signature is small and works even when you do not have latest signature, but there are a lot of false positives. (and it's generally identify the threat just by class of its threat, and not by specific identify of a threat, so there's no way to assess its impact.)…

You're in for a bad time trying to run Cylance or something similar at home. I generally have a positive opinion of Cylance having run it for 3 years. I think where those types of products shine is in larger environments where the end user is your biggest risk, you have layers of security and it's worthwhile to invest the effort in getting your AV config right.

I would never put that thing on my home machine. I know what I'm doing and I know what's on my own machine. My usage patterns at home are much different than at work so I'm not worried about phishing emails, fileless malware, PDF and .doc exploits or whatever. I'm more concerned about my webcam, known malware, casual drive by stuff, some basic parental controls and something low maintenance that will stay out of the way. I keep my machine patched, installed BitDefender and called it a day.

Re: Researchers easily trick Cylance's AI Antivirus to think Malware is 'Goodware'

#40

Post by tptacek »

I'm a little baffled by how this could be news. It's an antivirus system. Someone bypassed it. That's what people do with antivirus systems. Was there a widespread belief that Cylance had somehow cracked the code on reliable antivirus?
Post reply on HN