Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

eff.org

Post reply on HN
Print view View original

41–50 of 56 posts

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#41

Post by userbinator »

I think AV software, despite all the benefits that it provides, also has a very dangerous dark side - it encourages more-or-less blind trust by its users, and thus can be used as a very powerful means of control to further an agenda. The most common example of this is the detection of keygens/cracks/patches as being malicious, many of which are clearly not (at least back when I was still into that stuff around a decade ago - not sure about now); I'm a reverse-engineer so I can inspect the files manually and see the truth, but the average user will be far more likely to believe their AV and assume it's malicious --- helping to spread the FUD. Seeing how things as simple as completely innocent "Hello World" programs can get detected as false positives[1][2][3][4][5][6][7] while state-sponsored spyware gets let through is very deeply disturbing.

IMHO signature/heuristic-based detection techniques are always prone to error, and should be replaced with behaviour-based detection (and blocking). At the moment, I think a good firewall (on another known-clean machine - ideally running 100% open-source software) should be enough to detect any suspicious network traffic.

[1] http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&i...

[2] http://stackoverflow.com/questions/22926360/malwarebytes-giv...

[3] http://forum.bitdefender.com/index.php?showtopic=45169

[4] http://board.flatassembler.net/topic.php?t=8154

[5] https://forum.avast.com/index.php?topic=152926.0

[6] https://forum.avast.com/index.php?topic=120578.0

[7] http://itsacleanmachine.blogspot.ca/2012/01/antivirus-anger....

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#42

Post by pencilo »

unclesaamm wrote: post #3

Looking at the code ( https://github.com/botherder/detekt ), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?

Yes but worse, this is basically a 1990s anti virus + hype.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#43

Post by malandrew »

What I really would like to see in this area is something like an open source LittleSnitch that gets rules from a DHT, where you choose who to trust and everyone using such software publishes their trust list with the certificates they know to be good. For example, I would trust rules published by orgs like OpenBSD, Mozilla and the EFF.

Is there any FOSS equivalent to Little Snitch?

Obviously there are issues that need to be addressed further, but some system where people collectively share who is trustworthy and who is not would be valuable.

It would be something like http://winhelp2002.mvps.org/hosts.htm but for more than just ads.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#44

Post by munin »

Perdition wrote: post #38
munin wrote: post #35

Earlier quoted context omitted.

or, gosh, incorporate a security system that doesn't rely on obscurity of defenses or ignorance on the part of your attacker..?

Got a link to this consumer OS whose implementation is mathematically proven secure?

this is the entire point of defenses like ASLR and stack canaries. the attacker knows they are there, but knowing the form of the defenses doesn't inherently aid the attacker...

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#47

Post by gadfly »

I observed some suspicious spy-like activity by Detekt v.1.1 and added an issue to the Detekt github site:

https://github.com/botherder/detekt/issues/20

The developer immediately closed my report, without discussion and all he could say is: "Trust me. Detekt definitely isn't spyware."

Somehow, this does not make me feel secure.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#48

Post by userbinator »

gadfly wrote: post #47

I observed some suspicious spy-like activity by Detekt v.1.1 and added an issue to the Detekt github site: https://github.com/botherder/detekt/issues/20 The developer immediately closed my report, without discussion and all he could say is: "Trust me. Detekt definitely isn't spyware." Somehow, this does not make me feel secure.

detekt.exe imports from WS2_32.DLL "ntohl" function, which shouldn't be a cause for concern, but then shortly after startup it does spawn another instance of itself, which listens... debugging into the child process, I set a breakpoint on all of ws2_32.dll's functions and resume, leading to this:

    0350F024   012D4110  /CALL to socket from _socket.012D410A
    0350F028   00000002  |Family = AF_INET
    0350F02C   00000001  |Type = SOCK_STREAM
    0350F030   00000000  \Protocol = IPPROTO_IP
    0350F034   012DBAD8  _socket.012DBAD8
    0350F038   02D93610
    0350F03C   00000000
    0350F040   00000001
    0350F044   00000002
    0350F048   1E0C18A8  RETURN to python27.1E0C18A8
This leads back to _socket.pyd , sip.pyd, and eventually QtCore4.dll. Tracing a bit further, I see what's happening:

It starts a local Python web server in order to serve the main dialog of the application, the one with the language selector, which is an HTML page embedded in a browser control. No wonder it hung when you denied the connection and showed a blank frame. If you let it continue and figure out where it's listening, you can actually visit the page in your web browser and see the program's dialog. One of the most convoluted ways to display a dialog I've ever seen, and probably worth a "WTF?", but I don't think it's intended to be malicious. The developer could've handled this a bit better, that's for sure.

Post reply on HN