Phantom Malware: Conceal malicious actions by imitating user activity
ieeexplore.ieee.org
Phantom Malware: Conceal malicious actions by imitating user activity
1–10 of 26 posts
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#2The author also created a video demonstrating a PoC https://youtu.be/uf08omKOoxY
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#3Imitating users to avoid detection isn't really a new technique
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#4Imitating users to avoid detection isn't really a new technique
Submitted title was "New powerful malware obfuscation technique". Submitters: please don't do that. The site guidelines ask: "Please use the original title, unless it is misleading or linkbait; don't editorialize."
https://news.ycombinator.com/newsguidelines.html
We've changed the title above to the article title now (shortened to squeeze into HN's 80 char title limit.)
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#5All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door".
Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way smarter than me)
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#6Unless you're using publicly available malware that is known to be used for crime, AV isn't going to detect anything. That's how it works, and that's how it has to work.
I haven'y fully read through the paper, but it doesn't look much different than what attackers have been doing with compiled AutoIT binaries for decades.
If it's on Github I'd be interested in looking at the code. If not it seems like just another academic paper misunderstanding the real problems faced by both attackers and defenders.
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#7All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door". Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way s…
Or maybe instead of educating the users we should be educating the criminals so they can get paid to work on more productive things. Lots of solutions here.
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#8All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door". Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way s…
Or maybe instead of educating the users we should be educating the criminals so they can get paid to work on more productive things. Lots of solutions here.
I like the basic idea, but at least if educating is to be understood as imparting trade knowledge and/or skills I seriously doubt if that particular deficit is what keeping most of those people off the straight and narrow.
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#9Unless you're using publicly available malware that is known to be used for crime, AV isn't going to detect anything. That's how it works, and that's how it has to work. I haven'y fully read through the paper, but it doesn't look much different than what attackers have been doing with compiled AutoIT binaries for decades. If it's on Github I'd be interested in looking at the code. If not it seems like just another ac…
Next-gen AV does not rely on signatures to detect malware so much as heuristics on steroids. I am especially familiar with SentinelOne. It can detect 0-day ransomeware, for example, as soon as it tries to encrypt files, and stop it in its tracks. Any product that does rely on signatures is useless these days.
Re: Phantom Malware: Conceal malicious actions by imitating user activity
#10Earlier quoted context omitted.
Or maybe instead of educating the users we should be educating the criminals so they can get paid to work on more productive things. Lots of solutions here.
I like the basic idea, but at least if educating is to be understood as imparting trade knowledge and/or skills I seriously doubt if that particular deficit is what keeping most of those people off the straight and narrow.
Then you, like most of society, don't understand what drives criminal behaviour.
Many professional criminals do so out of lack of other options. Others are expressing antisocial sentiment, often a result of trauma or feeling rejected by society. In my case, it was a mixture of both.
Anyone that tells you that a complex societal problem is solely the result of moral failing or "bad people" does not have a good understanding of the problem space.
NB- I'm on the straight and narrow these days :)