Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior

github.com

Post reply on HN
Print view View original

11–14 of 14 posts

Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior

#11

Post by retsl »

doix wrote: post #7
likeabatterycar wrote: post #3

Probably Windows checking certificate revocation on a signed binary (or linked library).

Yeah, I'm inclined to agree. The binaries were probably built by mingw and I've seen "hello world" get flagged by virus total when built by mingw. If it is the binary itself making those calls (and not the OS), then anyone with a little bit of reverse engineering experience should be able to prove it and post the assembly. Edit: I was wrong about the build toolchain, they were built by visual studio, see comment belo…

the virustotal report shows the output from detectiteasy in "Details" -> "Basic properties": DetectItEasy PE64 Compiler: Microsoft Visual C/C++ (19.14.26715) [C++] Linker: Microsoft Linker (14.00.24241) Tool: Visual Studio (2015)

this is not meant to imply anything about whether the binary is malicious or not.

Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior

#12

Post by somat »

funcDropShadow wrote: post #8

Is tee.exe supposed to be the normal tee unix tool?

yes, there is also a "cat" executable that is being looked at. In this case it is probably harmless, but I am not sure why they have no source for it. someone suggested it came from gvim.

A proposal in the attached issue suggests just building it from openbsd sources which is probably not the worst place to get source for tee.

Re: Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior

#13

Post by j16sdiz »

likeabatterycar wrote: post #6
karlgkk wrote: post #5

Earlier quoted context omitted.

[flagged]

> It is absolutely not that. To suggest this, considering the evidence posted, goes beyond idiocy into potential maliciousness The scary IPs are part of DigiCert's CDN for OCSP responder (probably depending where you are and their anycast): https://github.com/hoshsadiq/adblock-nocoin-list/issues/452 The "evidence" is the system made some network calls and DNS lookups. Which you know, you would do when validating a ce…

Thanks for your research.

Random googling shows lots of people have similar question, and most of time the tread just die out without answer.

phicdn.net as a privacy-protected domain from godaddy sure make the case more suspicious.

DigiCert (or whatever the owner piecdn is) could have save us lots of time just publishing that information on their website.

Post reply on HN