Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snitch – A friendlier ss/netstat

github.com

Post reply on HN
Print view View original

1–10 of 109 posts

Re: Snitch – A friendlier ss/netstat

#3

Post by coppsilgold »

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

Re: Snitch – A friendlier ss/netstat

#5

Post by tptacek »

coppsilgold wrote: post #3

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

Tools like these aren't really intended for adversarial environments, and pure network tools that are designed for real adversaries have a really spotty track record (good search: [bro vantage point problem]).

Re: Snitch – A friendlier ss/netstat

#6

Post by karol-broda »

themafia wrote: post #4

It looks nice, and I don't see anything wrong with it, but I've been using iptraf-ng since forever and I think it has a slight edge here. Is it possible I've missed something from the demonstration video on that page?

thanks! snitch is closer to an ss/netstat replacement (sockets + processes) than a traffic monitor. traffic monitoring is planned, but not implemented yet.

Re: Snitch – A friendlier ss/netstat

#7

Post by karol-broda »

coppsilgold wrote: post #3

I always wondered how useful such tools are against a competent adversary. If you are a competent engineer designing malware, wouldn't you introduce a dormancy period into your malware executable and if possible only talk to C&C while the user is doing something that talks to other endpoints? Maybe even choose the communication protocol based on what the user is doing to blend in even better.

agreed on the limits. snitch isnt aimed at adversarial detection; its a local debugging/inspection tool. a competent attacker can blend in by design, so this isnt meant to be a standalone security control
Post reply on HN