"It's early days, were only in Alpha." -> It's early days, we're only in Alpha.
Cyber Scarecrow
211–220 of 253 posts
Re: Cyber Scarecrow
#212Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. A shady concept overall, cause if you occasionally run malware on your pc, it’s already over. Downloading a random exe from a noname site/author to scare malware sounds like another crazy security recipe from your layman tech friend who installs registry cleaners and toggles random settings for “speed up”.
Even back in my script kiddy days, 10 years ago, I remember RATs and cryptors would all have a kill switch option if it detected it was running on a VM.
Re: Cyber Scarecrow
#213Earlier quoted context omitted.
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure w…
Concerning code signing: Azure has a somewhat new offering that allows you to sign code for Windows (SmartScreen compatible) without having an EV cert. It is called "Trusted Signing" [1], non-marketing docs [2]. The major gotcha is that currently you need to have a company or similar entity 3 years or older to get public trust. I tried it with a company younger than 3 years and was denied. You might have a company th…
So $10+$5 per month versus $195 per year?
That's not a big discount.
Re: Cyber Scarecrow
#214Earlier quoted context omitted.
Can you have someone else go through the process of getting it, like a Craigslist rando to whom you pay cash?
If said Craigslist rando likes getting police visits and potentially being criminally liable for helping you commit a felony ... All code signing promises to give you the name of a real person or company that signed the binary. From there it's the end user's responsibility to decide if they trust that entity. In practice the threat of the justice system makes any signed executable unlikely to be malicious. But that d…
> In practice the threat of the justice system makes any signed executable unlikely to be malicious.
What threats are those? Where are all the people going to jail for falsely signed software? The stuxnet authors seem to be in the wind.
Re: Cyber Scarecrow
#215Earlier quoted context omitted.
If said Craigslist rando likes getting police visits and potentially being criminally liable for helping you commit a felony ... All code signing promises to give you the name of a real person or company that signed the binary. From there it's the end user's responsibility to decide if they trust that entity. In practice the threat of the justice system makes any signed executable unlikely to be malicious. But that d…
> In practice the threat of the justice system makes any signed executable unlikely to be malicious. What threats are those? Where are all the people going to jail for falsely signed software? The stuxnet authors seem to be in the wind.
The threat is that if you sign malware with your name you will be quickly connected with said malware. If you don't live in a country that turns a blind eye to cyber crime that is a quick ticket to jail.
Of course people stealing other people's signing keys is an issue. But EV code signing certificates are pretty well protected (requiring either a hardware dongle or 2FA). It's not impossible for a highly sophisticated attacker, but it's a pretty high bar.
Re: Cyber Scarecrow
#216Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. A shady concept overall, cause if you occasionally run malware on your pc, it’s already over. Downloading a random exe from a noname site/author to scare malware sounds like another crazy security recipe from your layman tech friend who installs registry cleaners and toggles random settings for “speed up”.
Take malware that is part of a botnet. Its initial payload is not necessarily damaging to the host, but is awaiting instructions to e.g. DDOS some future victim. The authors will want the malware to spread as far and wide as it can on e.g. a corporate network. So they need to make a risk assessment; if the malware stays on the current computer, is the risk of detection (over time, as the AV software gets updates) hig…
Many pieces of malware are encrypted and obfuscated to prevent analysis. Often, they'll detect virtual machines to make it harder for people to analyse the malware. Plenty of malware hides the juicy bits in a second or third stage download that won't trigger if the dropper is loaded inside of a VM (or with a debugger attached, etc.).
Similarly, there have also been malware that will deactivate itself when it detects signs of the computer being Russian; Russia doesn't really care about Russian hackers attacking foreign countries (but they'll crack down on malware spreading within Russia, when detected) so for Russian malware authors (and malware authors pretending to be Russian) it's a good idea not to spread to Russian computers. This has the funny side effect of simply adding a Russian keyboard layout being enough to prevent infection from some specific strains of malware.
This is less common among the "download trustedsteam.exe to update your whatsapp today" malware and random attack scripts and more likely to happen in targeted attacks at specific targets.
This tactic probably won't do anything against the kind of malware that's in pirated games and drive-by downloads (which is probably what most infections are) as I don't think the VM evasion tactics are necessary for those. It may help protect against the kind of malware human rights activists and journalists can face, though. I don't know if I'd trust this particular piece of software to do it, but it'll work in theory. I'm sure malware authors will update their code to detect this software if this approach ever takes off.
Re: Cyber Scarecrow
#217I don't understand why the software is built how it's built. Why would you want to implement licensing in the future for a software product that only creates fake processes and registry keys from a list: https://pastebin.com/JVZy4U5i . The limitation to 3 processes and license dialog make me feel uncomfortable using the software. All the processes are 14.1MB in size (and basically the scarecrow_process.dll - https://…
They know that if this idea catches on, a dozen completely free imitations will crop up, so ... the time to grab whatever cash can be squeezed out of this is now.
If something like this catches on, attackers will simply start checking the digital signature of the processes, to ensure they are genuine.
Re: Cyber Scarecrow
#218Narrator: and so the arms race continues. I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But on that note, I wondered the same thing at my last workplace where we'd only run windows in virtual machines. Sometimes these were quite outdated regarding system and browser updates, and some non-tech staff used them to browse random websites. They we…
> I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But more sophisticated detection means bigger payload (making the malware easier to detect) and more complexity (making the malware harder to make / maintain), so mission accomplished.
Nope, just check the process executable's digital signature - pretty simple.
Re: Cyber Scarecrow
#219Earlier quoted context omitted.
this +100 I can't just let some random exe run on my machine with nothing but claims from the author. In my head, I'm also wondering why a botnet wouldn't just want to take over such a machine because they know for sure that it's a scarecrow. But security by obscurity is no way to instill trust here
Claims by an unidentified author(s) replying to comments with a 4-hour old HN account.. How did this make it to the front page other than the catchy name?
[deleted]
Re: Cyber Scarecrow
#220Earlier quoted context omitted.
They know that if this idea catches on, a dozen completely free imitations will crop up, so ... the time to grab whatever cash can be squeezed out of this is now.
If something like this catches on, attackers will simply start checking the digital signature of the processes, to ensure they are genuine.
McAfee/Norton/etc. could license signed "scarecrow" versions of their products for use with something like this so that it's impossible for the malware to distinguish a scarecrow version of MacAfee from the real thing (and they would get a cut/kickback).
I would pay a small amount for a scarecrow version of AV software if a) it had zero footprint on my system resources, and b) it really did scare away malware that checks for such things.
Either way, though, it makes malware more onerous to develop since it has to bundle in public keys in order to verify running processes are correctly signed.