Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

eff.org

Post reply on HN
Print view View original

51–56 of 56 posts

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#51

Post by [deleted] »

im3w1l wrote: post #27
Someone1234 wrote: post #21

Earlier quoted context omitted.

Microsoft AV, Norton, McAfee, etc. We know this, how? Because we can look at Google's virustotal and see when a sample was first submitted and when it was "detected." With typical malware there is a fairly short window between A and B, with US G malware there is a HUGE window (months, sometimes years). Either the US G just gets very lucky that their samples aren't ever looked at deeper or more likely they have nation…

This is a very interesting claim, and I want to check for myself. Could you give more details? Name of usg malware? How to check time of submission and detection?

[deleted]

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#52

Post by jmnicolas »

userbinator wrote: post #41

I think AV software, despite all the benefits that it provides, also has a very dangerous dark side - it encourages more-or-less blind trust by its users, and thus can be used as a very powerful means of control to further an agenda. The most common example of this is the detection of keygens/cracks/patches as being malicious, many of which are clearly not (at least back when I was still into that stuff around a deca…

It depends on the AV. I have recent experience with 3 of them : Sophos and Avira tends to classify every keygen as a malware (Sophos is the worst) but Kaspersky is OK with them (or don't detect any malware at all for what I know ;-)

And yes I do use cracks : I wish I was able to reward my fellow devs but I don't have a start-up salary (even for my country my salary is pretty low) and open source softwares are usually (and I insist on usually, not always) not up to par.

So sue me.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#53

Post by edwintorok »

niels_olson wrote: post #33
atmosx wrote: post #19

Isn't clamAV[1] very good at this already and free of charge AND not keen to close an eye on specific signatures . [1] http://www.clamav.net/doc/install.html [2] http://www.clamxav.com for OSX

I believe Cisco now owns clamAV.

You don't have to use/trust the official database (or its whitelist). You could create a custom database with just the signatures you are interested in and run a scan with just that.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#54

Post by gadfly »

userbinator wrote: post #48
gadfly wrote: post #47

I observed some suspicious spy-like activity by Detekt v.1.1 and added an issue to the Detekt github site: https://github.com/botherder/detekt/issues/20 The developer immediately closed my report, without discussion and all he could say is: "Trust me. Detekt definitely isn't spyware." Somehow, this does not make me feel secure.

detekt.exe imports from WS2_32.DLL "ntohl" function, which shouldn't be a cause for concern, but then shortly after startup it does spawn another instance of itself, which listens... debugging into the child process, I set a breakpoint on all of ws2_32.dll's functions and resume, leading to this: 0350F024 012D4110 /CALL to socket from _socket.012D410A 0350F028 00000002 |Family = AF_INET 0350F02C 00000001 |Type = SOCK…

Thanks for your great analysis.

The developer has re-opened my report now, which will probably never be addressed anyway, since the UI is so convoluted.

Funny thing is that this 'anti-spyware' app creates more confusion than most of the spyware I've seen. Sadly, most people will just run this thing and think they're safe, since they believe the authorities (eff.org, amnesty) but don't even use a firewall.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#55

Post by Perdition »

munin wrote: post #44
Perdition wrote: post #38

Earlier quoted context omitted.

Got a link to this consumer OS whose implementation is mathematically proven secure?

this is the entire point of defenses like ASLR and stack canaries. the attacker knows they are there, but knowing the form of the defenses doesn't inherently aid the attacker...

Knowing a defense has weaknesses doesn't make it worthless when it takes extra effort for an attacker to exploit that weakness. There is no proven secure consumer OS (I'm including common userland apps in that) so things like ASLR and stack canaries are just extra obstacles to get around.

Real security needs to be layered.

Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance

#56

Post by libertyboy2007 »

userbinator wrote: post #48
gadfly wrote: post #47

I observed some suspicious spy-like activity by Detekt v.1.1 and added an issue to the Detekt github site: https://github.com/botherder/detekt/issues/20 The developer immediately closed my report, without discussion and all he could say is: "Trust me. Detekt definitely isn't spyware." Somehow, this does not make me feel secure.

detekt.exe imports from WS2_32.DLL "ntohl" function, which shouldn't be a cause for concern, but then shortly after startup it does spawn another instance of itself, which listens... debugging into the child process, I set a breakpoint on all of ws2_32.dll's functions and resume, leading to this: 0350F024 012D4110 /CALL to socket from _socket.012D410A 0350F028 00000002 |Family = AF_INET 0350F02C 00000001 |Type = SOCK…

I do think it's intended to be malicious!!!

consider that the majority of the people who aim to download and use this THING are those who do something against their government's red lines. This is quiet enough to make this THING a good Trojan horse for hiding anything than can track/detect(detekt!?) an activist. serving the main dialog of the application may be merely a camouflage for other uses of Python inside the file.

any idea?

Post reply on HN