Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Scarecrow

cyberscarecrow.com

Post reply on HN
Print view View original

111–120 of 253 posts

Re: Cyber Scarecrow

#111

Post by davikr »

marcodiego wrote: post #110

I call BS. How it works says: "When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run."; Download asks e-mail and name; Does not seems multiplatform and would never install anything like that on my computer in a dream unless it were open source.

It's very platform-dependent, because for each one there are different ways in which a virus checks for markers that it's being analysed - for instance, if it's being ran in a VM, it might check registry entries, check for Guest-Host drivers or whatever, on Windows. Still, I wouldn't trust something like this if it asks for PII, isn't open-source and leaves traces around on the disk.

Re: Cyber Scarecrow

#112

Post by mafriese »

jart wrote: post #106
mafriese wrote: post #99

Earlier quoted context omitted.

This "thing" is always spawning 3 processes at the time. The processes are always the ones from the virustotal link. I can upload the DLL to a file sharing service of your choice if you don't have a VT premium license. I can also provide an any.run link: https://app.any.run/tasks/bc557b04-5025-46a1-a683-aad3b29b9a... (installer) https://app.any.run/tasks/e257e7f2-7837-4ed1-93c8-5d617d75cc... (zip file containing the…

Is there a way for me to curl their executable into my UNIX terminal so I can read the assembly? Or does Any Run keep the samples to themselves? I know a lot about portable executable but very little about these online services.

https://github.com/mafriese/scarecrow Can upload any files you want there. Direct DL for one of the files: https://github.com/mafriese/scarecrow/raw/main/autoruns.exe

Re: Cyber Scarecrow

#113

Post by poincaredisk »

marcodiego wrote: post #110

I call BS. How it works says: "When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run."; Download asks e-mail and name; Does not seems multiplatform and would never install anything like that on my computer in a dream unless it were open source.

I'm a malware researcher and reverse engineer for a living. This is absolutely true, but oversimplified. Focus on

>They don't want to get caught and avoid computers that have security analysis or anti-malware tools on them.

Malware doesn't want to run in a sandbox environment (or in general when observed), because doing malicious things in the AV sandbox is a straight way to get blocked, and leaks C2 servers and other IoCs immediately. That's why most malware families[1] at least try to check if the machine they're running on is a sandbox/researcher pc/virtual machine.

I assume this is what this tool does. We joke at work that the easiest thing to do to make your windows immune to malware is to create a fake service and call it VBoxSVC.

[1] except, usually, ransomware, because ransomware is very straightforward and doesn't care about stealth anyway.

Re: Cyber Scarecrow

#114

Post by dns_snek »

While this is a really interesting idea, and assuming that it's actually completely safe, the irony is that it looks exactly what I would expect a trojan to look like - somewhat vague promises of security that could be interpreted as snake oil, conveniently packaged as an EXE with scant information about who's behind it, what it does, and no way to verify any of it. No offense to the authors :)

Re: Cyber Scarecrow

#115

Post by poincaredisk »

thrdbndndn wrote: post #63

One of the reference in "How does it work" [1] mentioned that some hackers will not mess with computers with Russian keyboard, so you can add one to reduce your chance of getting hacked. Hilarious aside, it would only work if you don't actually use multiple keyboard -- otherwise an additional one would make switching between multiple keyboards very annoying [*]. It also mentions some other changes like adding RU keyw…

Small correction: not "some hackers", but some malware families (the difference being that the check is automatic). And honestly, not "some" but "most of them" :).

Though I often see this implemented by calling GetKeyboardLayout, so this will only work if you actually use the Russian (or neighbourly) layout when malware detonation happens.

Re: Cyber Scarecrow

#116

Post by twixfel »

CyberScarecrow wrote: post #30
scosman wrote: post #4

Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.

Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…

There are things that you can do that make you seem trustworthy, and you've done none of them.

Re: Cyber Scarecrow

#117

Post by RajT88 »

vmfunction wrote: post #11
scosman wrote: post #4

Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.

It is a cat and mouse game. And security by obscurity practice. Not saying it won't work, but if it is open sourced, how long before the malware will catch on? Here is one on github: https://github.com/NavyTitanium/Fake-Sandbox-Artifacts

Not just that - it only works on smart malware.

There is plenty of dumb malware.

Security folks seem to get overly focused at times on the most sophisticated attackers and forget about the unwashed hordes.

Re: Cyber Scarecrow

#118

Post by hobs »

deno wrote: post #23
helsinkiandrew wrote: post #7

I would assume there would be a small intersection of people that would download and install a windows program from an unknown web page and those that are worried about malware. But perhaps I'm wrong

I know people /plural/ that will happily download cracked antivirus software from a torrent site.

That made sense before cryptocurrency, not after.

Re: Cyber Scarecrow

#119

Post by tr33house »

efilife wrote: post #68

Ok, but why isn't this open source? If it only creates some processes that don't do anything, there's nothing to hide, really

this +100 I can't just let some random exe run on my machine with nothing but claims from the author.

In my head, I'm also wondering why a botnet wouldn't just want to take over such a machine because they know for sure that it's a scarecrow. But security by obscurity is no way to instill trust here

Re: Cyber Scarecrow

#120

Post by DougN7 »

Z7YCx5ieof4Std wrote: post #48
CyberScarecrow wrote: post #30

Earlier quoted context omitted.

Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…

Is it possible to fake being from Russia. I heard some malware won't install on computers from Russia or with the Russian language as primary language

Or has the Russian keyboard installed, even if not used IIRC.
Post reply on HN