Many of the most dangerous threat actors simply don't care about getting caught. They are operated, financed and protected by nation states, and/or operate from geopolitical locations where law enforcement is lacking.
Cyber Scarecrow
181–190 of 253 posts
Re: Cyber Scarecrow
#182Anyone run this through VirusTotal?
Re: Cyber Scarecrow
#183Wow, never ever install this if you plan to play games with cheat detection
Re: Cyber Scarecrow
#184Earlier quoted context omitted.
Besides paying money you also go through a (pretty simplistic) audit. It’s about the only way we have to know who published some code, which is important. If you can come up with a better way you should implement it and we’ll all follow. As a side note, I’ve been trying to figure out how to get an EV code signing cert that isn’t tied to me (want to make a tool Microsoft won’t like and don’t want retaliation to hurt m…
Can you have someone else go through the process of getting it, like a Craigslist rando to whom you pay cash?
If said Craigslist rando likes getting police visits and potentially being criminally liable for helping you commit a felony ...
All code signing promises to give you the name of a real person or company that signed the binary. From there it's the end user's responsibility to decide if they trust that entity.
In practice the threat of the justice system makes any signed executable unlikely to be malicious. But that doesn't mean you have to uncritically trust a binary signed by Joe Hobo
Re: Cyber Scarecrow
#185Earlier quoted context omitted.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
It ceases to be a trust thing once you open source the code
In a world where everybody builds from source or downloads from a trusted build service
Re: Cyber Scarecrow
#186Heh.
The arms race continues.
Re: Cyber Scarecrow
#187Re: Cyber Scarecrow
#188Earlier quoted context omitted.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
It's a neat concept, although I imagine this'll be a cat and mouse endeavor that escalates very quickly. So, a suggestion - apply to the Open Technology Fund's Rapid Response Fund. I'd probably request the following in your position: * code signing certificate funding * consulting/assessment to harden the application or concept itself as well as to make it more robust (they'll probably route through Cure53) * consult…
> consulting/engineering to solve for the "malware detects this executable and decides that the other indicators can be ignored" problem, or consulting more generally on how to do this in a way that's more resilient.
This would be a boon for security folk who analyze/reverse malware: they can add/simulate this tool in their VMs to ensure the malware being analyzed doesn't deactivate itself!
Re: Cyber Scarecrow
#189Fun concept, but this is security by obscurity. Other heuristics: - providing fake manifests to hardware drivers commonly associated with virtual machines - active process inspector handles - presence of any software signed by hexrays (the ini file is usually enough)
> Fun concept, but this is security by obscurity.
Malware uses signals to determine if they are running in a VM. If we can degrade those signals, they will have to play a cat and mouse game trying to avoid VMs.
The less clear it is if a process is running in a VM, the easier time security researchers will have testing exploits found in the wild.
Re: Cyber Scarecrow
#190Earlier quoted context omitted.
Author of cyber scarecrow here. You are right, its a trust thing. Completly understand if people wouldnt want to install it and thats fine. It's the same for any software really. We just havent built up any confidence or trust like a big established company will have.
But why not make it open source? Why not identify who you are as humans? There are ways to establish trust, you aren’t doing any of them.
because they know how to sell software. cloused source. for windows. things gov mandate allows plenty of budget. etc.