151–160 of 211 posts
Earlier quoted context omitted.
So okay, you again assume that software is immutable. But Windows has to store these trusted keys somewhere. What if I emulate the TPM with a key I generated myself, and patch Windows to trust that key?
Then you will discover that Secure Boot will stop your computer from starting until you reinstall something signed by Microsoft.
Earlier quoted context omitted.
The TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer. If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.
So control over all the computers in a country comes down to just a few keys held by "approved" manufacturers; or rather a single key, held by the government, which signs the list of approved manufacturer keys. Then all they need to do is require that ISPs only allow packets to be sent by computers that have passed a Measured/Trusted Boot check, and suddenly all online activity is restricted to "approved" computers,…
Notice that I didn't mention "country" anywhere. There's no country restriction.
> or rather a single key, held by the government, which signs the list of approved manufacturer keys
Hum, no. The single key is held by Microsoft.
And yeah, that's basically what the Trusted Computing Consortium was designing at the early 00. But people pushed back enough that they stopped publishing public documents and delayed the implementation. We are just getting there.
Earlier quoted context omitted.
Deleting both the exe and the source code makes a false positive seem rather unlikely to me.
The source code in question appears to have been obfuscated (possibly just for brevity). I'd guess the Defender signature in question was written around the packer/obfuscator.
Earlier quoted context omitted.
And anywhere with a good IT department would say "bye". From my experience, people with reasonable technical skills are the most likely people to defy IT policies, even without admin rights.
>people with reasonable technical skills are the most likely people to defy IT policies Absolutely true...aka "i know computers since the C64 nothing bad will ever come from my machine...bumm ransomware...but my Antivirus never said anything"
After spending all that time working on it, I was hoping that I could just compile to the various OS/architectures and distribute that, but once someone tried using it I quickly found out that as soon as you downloaded my program, Windows Defender would flag it as malware and quarantine it. Even the builds in my project workspace that I compiled myself would get flagged/quarantined once it caught them.
I tried doing some research and it seems to just be a regular thing with Go apps because I think the runtime code would be common across malware written in Go, so basically all Go programs are automatically assumed to be malware by Windows unless you buy a cert and/or get enough people using it.
Or maybe this is more common than just Go programs. I've never really done anything like this before. But I ended up just abandoning attempting to release it properly and left the source code up on Github so if someone wants to compile it themselves they can. But the whole experience was a bit discouraging. It seems like there's really no cheap/easy way to distribute software. Webapps require hosting, and native code is assumed to be malware by default.
Earlier this year I spent a month or 2 working on a little Go project for a very niche little usecase (it would read a MIDI file and write it to a text file in a format that could be inserted into Super Mario World romhacks [or try to anyway]) After spending all that time working on it, I was hoping that I could just compile to the various OS/architectures and distribute that, but once someone tried using it I quickl…
aggressively scan every .jar, but totally ignores .net executables
no wonder they do something similar with go executables, it's easy to recognize them after all
Earlier quoted context omitted.
That kinda makes sense, thanks. However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow? To me, regex doesn’t seem applicable to static analysis…
antiviruses are composed of multiple systems and techniques. Regexp is just one.
Earlier quoted context omitted.
Can't you just turn that off in the BIOS settings?
Not if BIOS doesn't allow that to be turned off.
Earlier quoted context omitted.
Are they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg returns 390 results. And that’s jpeg alone. It’s fairly common that you see some sort of media file format parsing bug to lead to command execution.