I'm surprised the number of people on HN that assume Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious.
My application ran away and called home from Redmond
101–110 of 143 posts
Re: My application ran away and called home from Redmond
#102I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…
Also, in the image caption ... > Because of Windows Defender automatic sample submission, Beacon binary was uploaded to Redmond and Beacon called Home from there. ... and below ... > They run the executable in an environment where network connectivity is available. Why would they do that? To see what happens? And it's not just Microsoft. Many anti-malware apps (now, probably most) upload binaries. And I'm guessing th…
Consider: Malware that doesn't do anything suspicious unless it can first fetch a plausible benign file from what looks like a CDN. If the goal is to properly inspect the behaviour of potentially-malicious code, what it does after successfully fetching a set of ads is as, if not more important than what it does when the connection is blocked. Perhaps a multiplayer game with a backdoor triggered by the MotD service, through intentionally-vulnerable-to-buffer-overflows string processing code.
Re: My application ran away and called home from Redmond
#103I'm surprised the number of people on HN that assume Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious.
Microsoft does not exactly have the best track record with this.
https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
Re: My application ran away and called home from Redmond
#104Cool, is kind of like STUN but for networks with almost no connectivity. Create a binary that sends info when started, submit it and wait for it to send the info from Redmond to your server. Too bad there is no return channel or you could make IP over windows update.
Can you return a bit by deciding whether the executable gets flagged as malicious in response to the network activity? Can you set up a timing difference to send more than one bit per executable?
Re: My application ran away and called home from Redmond
#105Earlier quoted context omitted.
Also, in the image caption ... > Because of Windows Defender automatic sample submission, Beacon binary was uploaded to Redmond and Beacon called Home from there. ... and below ... > They run the executable in an environment where network connectivity is available. Why would they do that? To see what happens? And it's not just Microsoft. Many anti-malware apps (now, probably most) upload binaries. And I'm guessing th…
Consider: Malware that doesn't do anything suspicious unless it can first fetch a plausible benign file from what looks like a CDN. If the goal is to properly inspect the behaviour of potentially-malicious code, what it does after successfully fetching a set of ads is as, if not more important than what it does when the connection is blocked. Perhaps a multiplayer game with a backdoor triggered by the MotD service, t…
OK, that makes sense.
So how would one block this exploit? You can't test the malware properly without letting it reach its servers. So then you're also letting it upload its exfiltrated data. Which would likely be encrypted.
Re: My application ran away and called home from Redmond
#106I'm surprised the number of people on HN that assume Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious.
Microsoft does not exactly have the best track record with this. https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
In what way is "had a RCE CVE" a track record that "Microsoft's security group involved in actively trying to find malware by running unknown programs has absolutely 0 precautions that one of the programs they run would be malicious."
I'm not talking about invulnerable software I'm talking about the comments assuming Microsoft doesn't expect __malware testing servers__ to run scanning or DDOS malware.
Re: My application ran away and called home from Redmond
#107Re: My application ran away and called home from Redmond
#108I think the key quote here is "This opens interesting data leak vector for attacker and also includes some privacy concerns. It is quite common that even in isolated environments, many of the Microsoft IP address ranges are whitelisted to make sure systems will stay up to date. This enables adversary to leak data via Microsoft services which is extremely juicy covert channel." As a user, you can just disable automati…
> you can use Microsoft as a mule to exfiltrate data from otherwise firewalled victims This is actually a smart idea. Make your spyware collect & encrypt data into a (new and unknown) binary and execute it, relying on the fact that Microsoft will exfiltrate it for you. When that binary itself is run (within MS' premises) it will then reach out to you with its embedded data.
Seems nuts that they'd just randomly run every binary that comes to them in a crash report.
Re: My application ran away and called home from Redmond
#109Earlier quoted context omitted.
Yet another reason I'm reluctant to upgrade to Windows 10. Too many buttons and toggles to turn off to arrive at a PC that functions the way I expect it to, and an update mechanism that's likely turning new ones on faster than I can spot them.
This is a Windows Defender thing, not a Windows 10 thing. Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason. Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment. I am so tired of seeing communal ignorance on this topic.…
I'm a Windows 10 user— I switched back after a decade of MacOS, and I've been really satisfied with it. It's a huge step forward from Windows 7/8.
Re: My application ran away and called home from Redmond
#110Earlier quoted context omitted.
Yet another reason I'm reluctant to upgrade to Windows 10. Too many buttons and toggles to turn off to arrive at a PC that functions the way I expect it to, and an update mechanism that's likely turning new ones on faster than I can spot them.
This is a Windows Defender thing, not a Windows 10 thing. Windows Defender on Windows 7 also submits previously unobserved binaries to Microsoft for the same reason. Go ahead, blame Win10, though. A non-zero number of people will take your comment to heart and believe that you knew what you were talking about with their entire soul, without seeing my comment. I am so tired of seeing communal ignorance on this topic.…
>This is a Windows Defender thing, not a Windows 10 thing.
So Windows Defender isn't bundled as a part of Windows 10?