A New Malware Detection Tool That Can Expose Illegitimate State Surveillance • Hacker News Board

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#21

Post by Someone1234 » Thu, Nov 20, 2014, 10:54 PM UTC

_nullandnull_ wrote: post #13

ChuckMcM wrote: post #7

Earlier quoted context omitted.

Probably, but the suspicion is that some antivirus software "looks the other way" for some signatures. Hard to say if that it true or not.

Name one AV company that "looks the other way"?

Microsoft AV, Norton, McAfee, etc. We know this, how? Because we can look at Google's virustotal and see when a sample was first submitted and when it was "detected." With typical malware there is a fairly short window between A and B, with US G malware there is a HUGE window (months, sometimes years).

Either the US G just gets very lucky that their samples aren't ever looked at deeper or more likely they have national security agreements with most of the large US based anti-virus firms to hush hush.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#22

Post by lucb1e » Thu, Nov 20, 2014, 11:08 PM UTC

Varcht wrote: post #11

Before going through the trouble, it does not run on Windows 8.1 64bit.

Nor Linux. We know they have exploits for all operating systems, so it's pretty useless... For the EFF, this is a pretty useless action.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#23

Post by _nullandnull_ » Thu, Nov 20, 2014, 11:31 PM UTC

Someone1234 wrote: post #21

_nullandnull_ wrote: post #13

Earlier quoted context omitted.

Name one AV company that "looks the other way"?

Microsoft AV, Norton, McAfee, etc. We know this, how? Because we can look at Google's virustotal and see when a sample was first submitted and when it was "detected." With typical malware there is a fairly short window between A and B, with US G malware there is a HUGE window (months, sometimes years). Either the US G just gets very lucky that their samples aren't ever looked at deeper or more likely they have nation…

"looks the other way" and poor detection are two separate things. I'm sorry but you don't know what you are talking about.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#24

Post by jameshart » Thu, Nov 20, 2014, 11:45 PM UTC

How does it avoid false positives and not alert on legitimate state surveillance?

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#25

Post by hackuser » Thu, Nov 20, 2014, 11:51 PM UTC

Someone1234 wrote: post #20

I love the EFF (and have donated money) but I am going to disagree with them on this one. As they themselves fully admit, the first thing the big g is going to do is test that their malware v2 isn't detected by this. In the same way that malware authors now check against Microsoft AV because it is the most popular. So my point is that traditional AV in this scenario is a loser and will remain a loser because it is a…

> As they themselves fully admit, the first thing the big g is going to do is test that their malware v2 isn't detected by this ... it is a race AV just cannot win.

This can be said of every security solution. The value of security is to increase the attackers' cost, which will deter attackers who don't want to pay the higher price. There is no absolute security.

Also, the prospect of updates will increase attacker costs more, as some attackers will feel the need to proactively avoid detection by future versions too.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#26

Post by Max_Mustermann » Thu, Nov 20, 2014, 11:53 PM UTC

I find it curious that it available in amharic but not other much more widespread languages.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#27

Post by im3w1l » Fri, Nov 21, 2014, 12:20 AM UTC

Someone1234 wrote: post #21

_nullandnull_ wrote: post #13

Earlier quoted context omitted.

Name one AV company that "looks the other way"?

Microsoft AV, Norton, McAfee, etc. We know this, how? Because we can look at Google's virustotal and see when a sample was first submitted and when it was "detected." With typical malware there is a fairly short window between A and B, with US G malware there is a HUGE window (months, sometimes years). Either the US G just gets very lucky that their samples aren't ever looked at deeper or more likely they have nation…

This is a very interesting claim, and I want to check for myself. Could you give more details? Name of usg malware? How to check time of submission and detection?

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#28

Post by Istof » Fri, Nov 21, 2014, 12:26 AM UTC

Someone1234 wrote: post #20

I love the EFF (and have donated money) but I am going to disagree with them on this one. As they themselves fully admit, the first thing the big g is going to do is test that their malware v2 isn't detected by this. In the same way that malware authors now check against Microsoft AV because it is the most popular. So my point is that traditional AV in this scenario is a loser and will remain a loser because it is a…

Grab a live DVD, but how do you make sure that the hash used to verify the ISO is what it should be? transfer it offline? because if you are trying to avoid being spied on by the government, I don't think CAs/TLS can be used

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#29

Post by zmanian » Fri, Nov 21, 2014, 12:56 AM UTC

Someone1234 wrote: post #20

I love the EFF (and have donated money) but I am going to disagree with them on this one. As they themselves fully admit, the first thing the big g is going to do is test that their malware v2 isn't detected by this. In the same way that malware authors now check against Microsoft AV because it is the most popular. So my point is that traditional AV in this scenario is a loser and will remain a loser because it is a…

All of these memory signature scanning tools have a limited window of opportunity before the malware adapts. The involved organizations probably determined that the value of the current set of signatures was near the end and there was value to getting some parties outside of direct collaborators using the tool during a brief window.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#30

Post by higherpurpose » Fri, Nov 21, 2014, 12:59 AM UTC

Someone1234 wrote: post #21

_nullandnull_ wrote: post #13

Earlier quoted context omitted.

Name one AV company that "looks the other way"?

Microsoft AV, Norton, McAfee, etc. We know this, how? Because we can look at Google's virustotal and see when a sample was first submitted and when it was "detected." With typical malware there is a fairly short window between A and B, with US G malware there is a HUGE window (months, sometimes years). Either the US G just gets very lucky that their samples aren't ever looked at deeper or more likely they have nation…

Don't forget Kaspersky (at least for Russian gov malware). I believe their CEO came out in favor of surveillance in a blog post for a brief period.