Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phantom Malware: Conceal malicious actions by imitating user activity

ieeexplore.ieee.org

Post reply on HN
Print view View original

21–26 of 26 posts

Re: Phantom Malware: Conceal malicious actions by imitating user activity

#21

Post by unnouinceput »

alisonkisk wrote: post #16
unnouinceput wrote: post #5

All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door". Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way s…

The idea that a single user can outsmart thousands of motivated professional criminals with powerful computers is a complete nonstarter.

"Don't trust anything on internet"

"Don't click on links you don't trust"

See? 2 simple rules, that's all it takes.

Re: Phantom Malware: Conceal malicious actions by imitating user activity

#22

Post by dogma1138 »

sb23 wrote: post #17
dogma1138 wrote: post #15

Earlier quoted context omitted.

To add to how simplistic their heuristics are we had a demo of one of the mentioned above ransomware detection. Their demo was about 2 hours long, during it I’ve written my own ransomware in a few lines. It used cipher.exe a command line utility that allows you to encrypt files, with about 5 lines of a batch script (well it was pinvoke in my case) I had a ransomware that would encrypt all document files in the user’s…

Seems like if it were feasible it would already be being used by malware authors. Why would they not already be using cipher.exe?

Some do, at least according to Sophos https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...

And why would not re-inventing the wheel be a problem that malware developers have solved? ;)

Re: Phantom Malware: Conceal malicious actions by imitating user activity

#23

Post by hoseja »

unnouinceput wrote: post #5

All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door". Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way s…

That "airtight door" phrase of his has always irked me very much. The audacity, when a new air leak springs about every fortnight.

Re: Phantom Malware: Conceal malicious actions by imitating user activity

#24

Post by paulie_a »

unnouinceput wrote: post #21
alisonkisk wrote: post #16

Earlier quoted context omitted.

The idea that a single user can outsmart thousands of motivated professional criminals with powerful computers is a complete nonstarter.

"Don't trust anything on internet" "Don't click on links you don't trust" See? 2 simple rules, that's all it takes.

So you shouldn't trust the new york times or other major websites that have served malicious javascript?

That advice didn't work in the 90s let alone nowadays

Re: Phantom Malware: Conceal malicious actions by imitating user activity

#26

Post by unnouinceput »

hoseja wrote: post #23
unnouinceput wrote: post #5

All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door". Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way s…

That "airtight door" phrase of his has always irked me very much. The audacity, when a new air leak springs about every fortnight.

Yep, air leaks do happen. Not his fault though, but his blog is a gold mine of information, definitely top 5 to read religiously every day, don't you agree?
Post reply on HN