Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Scarecrow

cyberscarecrow.com

Post reply on HN
Print view View original

201–210 of 253 posts

Re: Cyber Scarecrow

#201

Post by westmeal »

1992spacemovie wrote: post #146
vmfunction wrote: post #125

Earlier quoted context omitted.

Look into Windows NT source code that was leaked. The if-else/switch statements in there is just another level of string matching hell. Seems like software development just become "let's jerry rig it to just make it work and forget about it." Pretty sure management (without tech clue) have something to do behaviours like this.

> Pretty sure management (without tech clue) have something to do behaviours like this. Always the same bullshit with you people here. Could never possibly someone built a sub-optimal system -- it HAD to be management fucking with our good intentions!

Lemme guess you're a manager.

Re: Cyber Scarecrow

#202

Post by crazygringo »

joshstrange wrote: post #95
wruza wrote: post #85

Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. A shady concept overall, cause if you occasionally run malware on your pc, it’s already over. Downloading a random exe from a noname site/author to scare malware sounds like another crazy security recipe from your layman tech friend who installs registry cleaners and toggles random settings for “speed up”.

> Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. Malware authors add in this feature so that it’s harder for researchers to figure out how it works. They want to make reverse engineering their code more difficult. I agree with everything else you said.

Does it really make it that much more difficult?

If these were laypeople that would then give up, sure.

But I'm surprised that it's even worth malware authors' time to put in these checks. I can't imagine there's even a single case of where it stopped malware researchers in the end. What, so it takes the researchers a few hours or a couple of days longer? Why would malware authors even bother?

(What I can understand is malware that will spread through as many types of systems as possible, but only "activate" the bad behavior on a specific type of system. But that's totally different -- a whitelist related to its intended purpose, not a blacklist to avoid security researchers.)

Re: Cyber Scarecrow

#204

Post by jabroni_salad »

tgv wrote: post #5

Isn't the risk then that they'll first start scanning for "Scarecrow", or is that hidden somehow? Also somewhat surprised the source isn't available. That makes trusting it harder, especially to the people it's aimed at.

ah, so I shall use scarecrow in my analysis machines since the malware will think I'm just pretending to examine it :)

If you start down this path you will end up in mindgame hell.

Re: Cyber Scarecrow

#205

Post by batch12 »

batch12 wrote: post #127
mafriese wrote: post #84

I don't understand why the software is built how it's built. Why would you want to implement licensing in the future for a software product that only creates fake processes and registry keys from a list: https://pastebin.com/JVZy4U5i . The limitation to 3 processes and license dialog make me feel uncomfortable using the software. All the processes are 14.1MB in size (and basically the scarecrow_process.dll - https://…

To your point, I made this a few years ago using powershell. I just created a stub .exe using csc on install and renamed it to match a similar list of binary names. Maybe I will dig it up...

I uploaded it here. I haven't tested it in years though- https://github.com/0xDigest/odoshi

Re: Cyber Scarecrow

#206

Post by firesteelrain »

firesteelrain wrote: post #153
a1o wrote: post #151

Earlier quoted context omitted.

This looks like a random website and not a Microsoft website. How could I trust such list?

Because it came from this site: https://learn.microsoft.com/en-us/security/trusted-root/part... I used Google to search for "list of microsoft trusted CA".

Looks like people have no experience with CA audits or security controls

Re: Cyber Scarecrow

#207

Post by hurutparittya »

mdip wrote: post #140
fancythat wrote: post #38

Earlier quoted context omitted.

This works, I can confirm. Majority of malware threat running in a VM as a sign of researcher doing the malware analysis. I am recommending doing this for over 10 years now.

That's where I wonder about a tool like this interfering with legitimate software. For example, I believe the anti-cheat software used by games like Fortnite looks for similar things -- my understanding is that it, too, will refuse to start when it is executing in a VM[0]. As a teenager (90s), I remember several applications/games refusing to start when I'd attached a tracing process to them. They did this to stop ex…

What do you mean by 'legitimate software' exactly? If you described what a modern anti-cheat solution does to someone without telling them what it is, they'd automatically call it malware. The similarity really is uncanny. It almost feels like the difference between them is more of a technicality.

Re: Cyber Scarecrow

#208

Post by vntok »

khaki54 wrote: post #82

Kind of like instead of buying $10k ADT home security system, just buy the sign for $20 and put it in the front yard.

Good analogy, except putting up the sign actually works because there isn't any other layer around it... whereas putting up IOCs onto your Microsoft Windows OS will trigger Windows Defender, any SIEM, and generally speaking most security-oriented software worth its salt.

Re: Cyber Scarecrow

#209

Post by forty »

rvnx wrote: post #172
account42 wrote: post #131

Earlier quoted context omitted.

Or you could just choose to not play games that require you to install malware.

Once you are banned by the anti-cheat because of false positive, this is going to be an easy decision to make

Yes in a way the problem is self resolving :)

Re: Cyber Scarecrow

#210

Post by vntok »

flerchin wrote: post #158

Krebs said that some malware checks for a cyrillic keyboard to try and geo target outside of the country of operation. This seems to be the same type of thing. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

Other malware check for a cyrillic keyboard to try and geo target inside of the country of opération.
Post reply on HN