I've heard one thing that motivates malware to ignore your computer is having a Russian keyboard installed. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
Cyber Scarecrow
171–180 of 253 posts
Re: Cyber Scarecrow
#172I guess the indicators used largely overlap with the ones used by anti-cheat software, so you probably want to think twice before using that on your gaming pc :)
Or you could just choose to not play games that require you to install malware.
Once you are banned by the anti-cheat because of false positive, this is going to be an easy decision to make
Re: Cyber Scarecrow
#173Neat. But this literally comes off as probably being malware itself. If your going to ship something like this, it needs to be open source preferably with a GitHub pipeline so I can see the full build process. You also run into the elephant repellent problem. The best defense to malware will always be regular backups and a willingness to wipe your computer if things go wrong.
elephant repellent problem? What is that? This is literally the first occurrence of that string on the internet.
https://chatgpt.com/share/16f27556-5766-4728-8245-9909d18037...
We need a chatGPT version of LMGTFY...
Re: Cyber Scarecrow
#174Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.
> It’s a random webpage that wants my personal details, and sends me a “exe”. No different from MacAffee, Trend Micro, Symantec. Oh, but those are brand names you can trust, like Coca-Cola and Kellog's Corn Flakes.
Besides the obvious points made by others, those are odd choices. I don't trust any of those brands.
Re: Cyber Scarecrow
#175Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
It's a neat concept, although I imagine this'll be a cat and mouse endeavor that escalates very quickly. So, a suggestion - apply to the Open Technology Fund's Rapid Response Fund. I'd probably request the following in your position:
* code signing certificate funding
* consulting/assessment to harden the application or concept itself as well as to make it more robust (they'll probably route through Cure53)
* consulting/engineering to solve for the "malware detects this executable and decides that the other indicators can be ignored" problem, or consulting more generally on how to do this in a way that's more resilient.
If you wanted to fund this in some way without necessarily doing the typical founder slog, might make sense to 501c3 in the US and then get funded by or license this to security tooling manufacturers so that it can be embedded into security tools, or to research the model with funding from across the security industry so that the allergic reaction by malware groups to security tooling can be exploited more systemically.
I imagine the final state of this effort might be that security companies could be willing to license decoy versions of their toolkits to everyone that are bitwise identical to actual running versions but then activate production functionality with the right key.
Re: Cyber Scarecrow
#176Hahaha it's such a lovely idea! Turning the opponents detection against them, I very much dig it!
Here's a caveat though: Attackers will at some point notice scarecrows and simply work around them. Now suuure, if you have a better lock than your neighbours, that decreases your chances of getting broken into, but in the end this is a classic "security by obscurity" measure. So if your time and computer/data is valuable, I would rather invest in other security measures (firewall, awareness training, backups etc.)
Re: Cyber Scarecrow
#177I wonder if it would trick the compliance department into thinking my computer is safe and leave it alone.
Re: Cyber Scarecrow
#178Fun concept, but this is security by obscurity. Other heuristics:
- providing fake manifests to hardware drivers commonly associated with virtual machines - active process inspector handles - presence of any software signed by hexrays (the ini file is usually enough)
Re: Cyber Scarecrow
#179Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
Concerning code signing: Azure has a somewhat new offering that allows you to sign code for Windows (SmartScreen compatible) without having an EV cert. It is called "Trusted Signing" [1], non-marketing docs [2]. The major gotcha is that currently you need to have a company or similar entity 3 years or older to get public trust. I tried it with a company younger than 3 years and was denied. You might have a company that fits that criteria or you might get lucky.
The major upside is the pricing: currently "free" [3] during testing, later about 10 USD/month. As there doesn't seem to be a revocation mechanism based on some docs I read, signed binaries might be valid even after a canceled subscription.
[1] https://azure.microsoft.com/en-us/products/trusted-signing
[2] https://learn.microsoft.com/en-us/azure/trusted-signing/quic...
[3] You need a CC and they will likely charge you at some point. Also I had to use some kind of business Azure/MS 365 account which costs about 5 USD/month. Not sure about the exact lingo, not an Azure/MS expert. The docs in [2] was enough for me to get through the process.
Re: Cyber Scarecrow
#180Earlier quoted context omitted.
elephant repellent problem? What is that? This is literally the first occurrence of that string on the internet.
Better known as the Elephant Repellant Fallacy — a claim that a preventative is working when, in fact, the thing it prevents rarely or never happens anyway. "Hey you better buy my elephant repellant so you don't get attacked!" 'Okay.' ... "So were you attacked?" 'No, I live in San Francisco and there are no wild elephants." "Well, I guess the repellant is working!"
Also known as the Anti-Tiger Rock: https://youtu.be/xSVqLHghLpw?si=fRraLZJ9q_rDR-UV