Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
1–10 of 14 posts
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#2The potentially malicious IP is owned by akamai. Not sure why tee would want to talk out
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#3Probably Windows checking certificate revocation on a signed binary (or linked library).
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#4This looks bad. I'm no expert though, there could be a plausible explanation here. But running it through some common tools all seem to return suspicious behavior.
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#5Probably Windows checking certificate revocation on a signed binary (or linked library).
[flagged]
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#6Probably Windows checking certificate revocation on a signed binary (or linked library).
[flagged]
> It is absolutely not that. To suggest this, considering the evidence posted, goes beyond idiocy into potential maliciousness
The scary IPs are part of DigiCert's CDN for OCSP responder (probably depending where you are and their anycast):
https://github.com/hoshsadiq/adblock-nocoin-list/issues/452
The "evidence" is the system made some network calls and DNS lookups. Which you know, you would do when validating a certificate. He also lists some SMB calls to the localnet which are clearly unrelated. tee.c source contains no network code so this would be truly easy to audit. So tell me again what is the damning evidence?
Also, are we to believe malware gangs are hosting on Akamai now? They must be in the major leagues.
And you call me an idiot?
Have a nice day.
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#7Probably Windows checking certificate revocation on a signed binary (or linked library).
Yeah, I'm inclined to agree. The binaries were probably built by mingw and I've seen "hello world" get flagged by virus total when built by mingw.
If it is the binary itself making those calls (and not the OS), then anyone with a little bit of reverse engineering experience should be able to prove it and post the assembly.
Edit: I was wrong about the build toolchain, they were built by visual studio, see comment below.
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#8Is tee.exe supposed to be the normal tee unix tool?
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#9The potentially malicious IP is owned by akamai. Not sure why tee would want to talk out https://www.whois.com/whois/23.216.147.64
It's not.
This is almost certainly Windows performing certificate validation.
The "evidence" was just copy pasted from VirusTotal. In fact he forgot to copy from below the cut, which would have shown it also called out to www.microsoft.com - depending who you ask, definitely a malicious address!
VirusTotal just notes all network traffic during the time the binary executed in the sandbox. It doesn't mean it emanated from the binary.
Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
#10I forced a refresh of the VirusTotal results. It is only being flagged by a single engine: MaxSecure, an Indian anti-virus vendor that has gone out of business.
https://www.virustotal.com/gui/file/950eea4e17fa3a7e89fa2c55...