Before going through the trouble, it does not run on Windows 8.1 64bit.
A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
11–20 of 56 posts
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#12Looking at the code ( https://github.com/botherder/detekt ), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?
> Isn't this just a subset of what anti-virus software does?
Yes. The signatures are written more generically to detect the samples though. AV software can (or at least shouldn't) write signatures so generically because the potential for false positives. Since the scanner is scanning a non-enterprise environment the signatures can be a little more generic.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#13Looking at the code ( https://github.com/botherder/detekt ), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?
Probably, but the suspicion is that some antivirus software "looks the other way" for some signatures. Hard to say if that it true or not.
Name one AV company that "looks the other way"?
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#14Looking at the code ( https://github.com/botherder/detekt ), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?
> Isn't this just a subset of what anti-virus software does? Yes. The signatures are written more generically to detect the samples though. AV software can (or at least shouldn't) write signatures so generically because the potential for false positives. Since the scanner is scanning a non-enterprise environment the signatures can be a little more generic.
That makes no sense to me. Isn't it important for this to be useful in an enterprise environment too? Gov't may be spying on any number of entities, including businesses.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#15Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#16Before going through the trouble, it does not run on Windows 8.1 64bit.
I got it to run by setting compatibility mode to Windows 7.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#17Doesn't work with Windows 8.1 though :-(
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#18Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#19Isn't clamAV[1] very good at this already and free of charge AND not keen to close an eye on specific signatures.
[1] http://www.clamav.net/doc/install.html
[2] http://www.clamxav.com for OSX
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#20I love the EFF (and have donated money) but I am going to disagree with them on this one.
As they themselves fully admit, the first thing the big g is going to do is test that their malware v2 isn't detected by this. In the same way that malware authors now check against Microsoft AV because it is the most popular.
So my point is that traditional AV in this scenario is a loser and will remain a loser because it is a race AV just cannot win. It will only alert you to an attacker well after the fact.
A far better EFF suggestion to "at risk" individuals (e.g. journalists, activists, etc) is read only systems. For example grab a Live DVD of a Linux distribution, boot it, use it, and then as soon as you turn it off everything is reset to 0.
That won't address the "baseband issue" (e.g. firmware infections, uEFI, etc), but neither does this. Only physical security really addresses the baseband.