Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Scarecrow

cyberscarecrow.com

Post reply on HN
Print view View original

161–170 of 253 posts

Re: Cyber Scarecrow

#161

Post by hunter2_ »

DougN7 wrote: post #122
AnthonyMouse wrote: post #98

Earlier quoted context omitted.

> We also dont have a code signing certificate yet either, they are expensive for windows. When someone is offering you a certificate and the only thing you have to do in order to get it is pay them a significant amount of money, that's a major red flag that it's either a scam or you're being extorted. Or both. In any case you should not pay them and neither should anyone else.

Besides paying money you also go through a (pretty simplistic) audit. It’s about the only way we have to know who published some code, which is important. If you can come up with a better way you should implement it and we’ll all follow. As a side note, I’ve been trying to figure out how to get an EV code signing cert that isn’t tied to me (want to make a tool Microsoft won’t like and don’t want retaliation to hurt m…

Can you have someone else go through the process of getting it, like a Craigslist rando to whom you pay cash?

Re: Cyber Scarecrow

#163

Post by whaleofatw2022 »

Z7YCx5ieof4Std wrote: post #48
CyberScarecrow wrote: post #30

Earlier quoted context omitted.

Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…

Is it possible to fake being from Russia. I heard some malware won't install on computers from Russia or with the Russian language as primary language

Russia has serious penalties for hacking their citizens.

Not for hacking non citizens

Re: Cyber Scarecrow

#165

Post by bglazer »

999900000999 wrote: post #148

Neat. But this literally comes off as probably being malware itself. If your going to ship something like this, it needs to be open source preferably with a GitHub pipeline so I can see the full build process. You also run into the elephant repellent problem. The best defense to malware will always be regular backups and a willingness to wipe your computer if things go wrong.

elephant repellent problem? What is that?

This is literally the first occurrence of that string on the internet.

Re: Cyber Scarecrow

#166

Post by wizzwizz4 »

mdip wrote: post #154

Setting aside the concerns with this specific implementation and thinking more of "the idea" I think the biggest concern is this sort of application causing legitimate software to fail to run[0] and how one would "white-list" an application from seeing these "fake artifacts designed to trick malware." The problem is "the fake components" would have to be prevented from being detected by legitimate software and the on…

> Where's Windows containerization at?

Doesn't exist. Not even UAC is a reliable security boundary. Likely, it will never exist.

> Is there any other approach which would allow for "non-white-listed applications" to run containerized and "see the Scarecrow artifacts",

Sounds a bit like WoW64. It should be easy enough to replicate this behaviour with a rootkit. However, the software would always be able to peek behind the curtain.

> In other words, the attacker is a healthy young cat chasing a tired old mouse.

I always thought of the attackers as the mice, and anti-malware folk as the cats.

Re: Cyber Scarecrow

#167

Post by px43 »

deno wrote: post #23
helsinkiandrew wrote: post #7

I would assume there would be a small intersection of people that would download and install a windows program from an unknown web page and those that are worried about malware. But perhaps I'm wrong

I know people /plural/ that will happily download cracked antivirus software from a torrent site.

Many torrent sites have stronger reputation vetting than Microsoft code signing certs.

Re: Cyber Scarecrow

#169

Post by px43 »

CyberScarecrow wrote: post #30
scosman wrote: post #4

Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.

Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…

Obviously this should be an open source tool that people can build for themselves. If you want to sell premium services or upgrades for it later, you need to have an open/free tier as well.

Also are you aware of the (very awesome) EDR evasion toolkit called scarecrow? Naming stuff is hard, I get that, but this collision is a bit much IMO.

https://github.com/Tylous/ScareCrow

Re: Cyber Scarecrow

#170

Post by jkingsman »

bglazer wrote: post #165
999900000999 wrote: post #148

Neat. But this literally comes off as probably being malware itself. If your going to ship something like this, it needs to be open source preferably with a GitHub pipeline so I can see the full build process. You also run into the elephant repellent problem. The best defense to malware will always be regular backups and a willingness to wipe your computer if things go wrong.

elephant repellent problem? What is that? This is literally the first occurrence of that string on the internet.

Better known as the Elephant Repellant Fallacy — a claim that a preventative is working when, in fact, the thing it prevents rarely or never happens anyway.

"Hey you better buy my elephant repellant so you don't get attacked!"

'Okay.'

...

"So were you attacked?"

'No, I live in San Francisco and there are no wild elephants."

"Well, I guess the repellant is working!"

Post reply on HN