NFCGate flagged as malware even after multiple followups saying it isn't
1–10 of 17 posts
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#2This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere).
Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#3This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
But the main characteristic of malware is that it works for someone other than the user, no? Research software works for the user themselves.
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#4This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
False detection is a nightmare in the corporate world and this IT worker bashes his head every time he runs across it.
Nirsoft tools? Bam, "virus" and "malware". How dare you!
Tailscale website? Uh-oh, ZScaler thinks that's a "remote access tool" so you're being given a click-through formal warning!
The Framework website? Uh-oh, .work is a bad TLD! Can't browse to that, it could be evil!
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#5Malware scanners are such trash.
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#6This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
False detection is a nightmare in the corporate world and this IT worker bashes his head every time he runs across it. Nirsoft tools? Bam, "virus" and "malware". How dare you! Tailscale website? Uh-oh, ZScaler thinks that's a "remote access tool" so you're being given a click-through formal warning! The Framework website? Uh-oh, .work is a bad TLD! Can't browse to that, it could be evil!
My favourite one of these has to be Outlook Online blocking nearly all Python, Bash and exe files sent via email...at the Faculty of computer science. Who would ever need to send code to others at the computer faculty? And it's not like it prevents you from sending it, it just prevents the recipient from downloading it, so there's no indication of anything wrong until it might be too late. Oh, and it doesn't even say "hey, that's malware". It just shows a little red X and removes the download button. No tooltip or popup, it just looks like a generic error. Had to go to Reddit to find out it's an antimalware thing.
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#7This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
False detection is a nightmare in the corporate world and this IT worker bashes his head every time he runs across it. Nirsoft tools? Bam, "virus" and "malware". How dare you! Tailscale website? Uh-oh, ZScaler thinks that's a "remote access tool" so you're being given a click-through formal warning! The Framework website? Uh-oh, .work is a bad TLD! Can't browse to that, it could be evil!
I mean - Tailscale is a remote access tool...
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#8This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
More likely/precisely, it's flagged as malware because it's bypassing protections build into windows credential guard- eg, impersonating(or injecting code into) outlook.exe.
making an exception for such a heuristic is, in all cases, wrong since it will always be abused.
The actual answer is: Defender needs a PUP category.
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#9This reminds me of may of one of my favourite piece of software, Mail PassView, which is (AFAIK) considered Malware bei Windows/Defender because it shows you the passwords you entered yourself in Outlook (but forgot to write down somehwere). Flagging Malware is hard, and research/dev tools are always behaving at least similar to Malware (because we want to get data/do stuff regular users won't do).
But the main characteristic of malware is that it works for someone other than the user, no? Research software works for the user themselves.
And something using keystroke injection to abuse the exception?
Re: NFCGate flagged as malware even after multiple followups saying it isn't
#10Earlier quoted context omitted.
But the main characteristic of malware is that it works for someone other than the user, no? Research software works for the user themselves.
And something using keystroke injection to abuse the exception?
Is called an automation tool.
Like Powershell, or Microsoft Automate or Tosca, who can all run keystroke injection, but aren't flagged.