I guess the indicators used largely overlap with the ones used by anti-cheat software, so you probably want to think twice before using that on your gaming pc :)
Or you could just choose to not play games that require you to install malware.
Cyber Scarecrow
131–140 of 253 posts
Re: Cyber Scarecrow
#132One of the reference in "How does it work" [1] mentioned that some hackers will not mess with computers with Russian keyboard, so you can add one to reduce your chance of getting hacked. Hilarious aside, it would only work if you don't actually use multiple keyboard -- otherwise an additional one would make switching between multiple keyboards very annoying [*]. It also mentions some other changes like adding RU keyw…
> A little rant: as someone who use three virtual keyboards (English, Chinese, Japanese), it is already a pain in ass to switch them since MS does not follow "last used" switching order (like alt+tab). Instead, it just switches in one direction. Actually, I much prefer this order. Depending on what keyboard I currently use, I know exactly how often to switch instead of having to remember what I used previously. In fa…
Yeah, I get your point, it's indeed a trade off.
Having "last used" order makes quickly switch between two windows very easy, which is something I personally use more. It's easier than pressing alt+tab/shift+alt+tab alternately.
To switch to the third window, you can use alt+tab+tab.
Re: Cyber Scarecrow
#133As much as I'd love to see something like this everywhere, the problem is it's useless for everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population... because DRM, anticheat and malware all fear the same set of tools/indicators.
> everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population...
It is sad to hear that. In my view DRM = malware.
Re: Cyber Scarecrow
#134"Fake Processes. Scarecrow will create a number of background processes that don't do anything, but look like security research tools.
Fake registry entries. Scarecrow creates registry entries to make it look like security tools are installed on your computer."
I'd be interested to see this tested, there's tons of good malware repos out there like vx-underground's collections that can be used to test it.
If you dont wanna share the source, somewhat logical. Perhaps run a test versus gigabytes of malware samples and let us know which ones actually query these process names / values you create and disable themselves as a result??
Re: Cyber Scarecrow
#135I decided to use Bitdefender a few months ago becouse i suspected my Mac had malware. I was right, there was a adware in the firefox files so it did it’s job.
But, my experience with the antivirus was horrible. When i first opened the app there were popus everywhere advertising for their other products, and the overall ui didn’t look trustworthy.
I am no security expert, so I’m asking: is this the best way to deal with malware?
Re: Cyber Scarecrow
#136Re: Cyber Scarecrow
#137Earlier quoted context omitted.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
> We also dont have a code signing certificate yet either, they are expensive for windows. When someone is offering you a certificate and the only thing you have to do in order to get it is pay them a significant amount of money, that's a major red flag that it's either a scam or you're being extorted. Or both. In any case you should not pay them and neither should anyone else.
There's a reason it costs money and it's because the CAs have to undergo costly audits. Microsoft publishes a list of trusted CAs:
https://ccadb.my.salesforce-sites.com/microsoft/IncludedCACe...
Re: Cyber Scarecrow
#138One of the reference in "How does it work" [1] mentioned that some hackers will not mess with computers with Russian keyboard, so you can add one to reduce your chance of getting hacked. Hilarious aside, it would only work if you don't actually use multiple keyboard -- otherwise an additional one would make switching between multiple keyboards very annoying [*]. It also mentions some other changes like adding RU keyw…
> MS does not follow "last used" switching order Furthermore: 1. The Shift+Alt chord is obnoxiously unreliable, sensitive to which key comes down first, or something. 2. Japanese is always comeing up in A mode even though you last had it in あ mode. 3. Bad performance: sllllow language switching at times: you hit some keyboard sequence for changing languages or modes within a language, and nothing happens. This intera…
I have to use a 3rd party Japanese IME precisely because of 2. No idea why they haven't add an option for it to be default to あ mode.
Also, in ANY modern Chinese IME (Microsoft or 3rd party), switching between English/中文 mode is simply pressing shift once. You still have to use alt+` for that in JP IME, which I find unbearable.
Re: Cyber Scarecrow
#139That is a very fun logo.
Re: Cyber Scarecrow
#140Narrator: and so the arms race continues. I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But on that note, I wondered the same thing at my last workplace where we'd only run windows in virtual machines. Sometimes these were quite outdated regarding system and browser updates, and some non-tech staff used them to browse random websites. They we…
This works, I can confirm. Majority of malware threat running in a VM as a sign of researcher doing the malware analysis. I am recommending doing this for over 10 years now.
That's where I wonder about a tool like this interfering with legitimate software.
For example, I believe the anti-cheat software used by games like Fortnite looks for similar things -- my understanding is that it, too, will refuse to start when it is executing in a VM[0]. As a teenager (90s), I remember several applications/games refusing to start when I'd attached a tracing process to them. They did this to stop exactly what I was doing: trying to figure out how to defeat the software licensing code. I haven't had a need to do that since the turn of the century but I'd put $10 on that still being a thing.
So you end up with a "false positive", and like anti-virus software, it results in "denial of service." But does anti-virus's solution of "white list it" apply here? At least with their specific implementation, it's "on or off", but I wonder if it's even possible to alter the application in a way that could "white list a process so it doesn't see the 'malware defeat tricks' this exposes." If not, you'd just have to "turn off protection" when you were using that program. That might not be practical depending on the program. It's also not likely the vendor of that program will care that "an application which pretends it's doing things we don't like" breaks their application unless it represents a lot of their install base.
[0] I looked into it a few years ago b/c I run Tumbleweed and it's a game the kids enjoy (I'm not a huge fan but my gaming days have been behind me for a while, now) ... I had hoped to be able to expose my GPU to the VM enough to be able to play it but didn't bother trying after reading others' experiences.