Live data from Hacker News

Netflix Is Dumping Anti-Virus, Presages Death of an Industry

forbes.com

71–75 of 75 posts

Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry

#71

Earlier quoted context omitted.

Encoders and compactors are not good actually they usually leave too many patterns that are easy to detect. The might work on some binaries in some cases but if you want to avoid evasion refactor the malware yourself. Encoders and compactors are intended to modify existing binaries only :)

That's what I'm seeing people doing (modify existing binaries): https://www.google.com/#q=shikata+ga+nai+antivirus Seems like it's pretty effective for bypassing AV according to how everyone is using it.

Well if you actually read the search results you'll see :)

1st result 2012: "If you want to avoid detection, a 60% success rate is not good enough. Remember, our implant was caught by 40% of the products, not 40% of the targets. Assuming the better anti-virus products have a larger market share, our 40% product failure rate could look more like an 80 or 90% detection rate on target machines. - See more at: http://www.digitalthreat.net/2012/02/anti-virus-evasion-choo...

4th result 2014: "There are a couple of built in encoders in Metasploit (shikata ga nai is the most popular one), but these signatures have been updated in many Antivirus solutions, resulting in detection."

Every decent AV out there today has signatures of packers and encoders they are very easy to find since the artifacts of things like PE headers and binary cave of the encoded binaries will be identical every time you use them.

Most people who claim it works are simply rehashing the same old metasploit guides that are not really relevant in the real world anything that is wide used will be singnatured in a second by every AV company.

Yes if you encode it and upload it to VirusTotal even today you might get 50% or more evasion but those 50% of products will have maybe 5% of the market, and pretty much zero enterprise users.

Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry

#72
post #9

In general anti-virus is more useful for less educated users. For example, I'd never escalate (sudo, UAC, etc.) a process that I wouldn't expect to need the escalation. This severely limits the control a virus can take (stopping most in their tracks). The only people who really need AV are the type of idiots who run as root, or turn off UAC. The real concern are advanced worms. Most of these would likely infect a mac…

Some time ago, I went and grabbed all the quarantined executable attachments from our mail system. I was shocked there were so many, given how long it's been that blocking zip files containing .exe files has been a standard.

I uploaded 30 to virustotal to see what would happen, and I can't recall exact numbers, but I believe we'd be looking at about 25 that has detection rates of 0/51.

Since then, I'd been a staunch advocate of the argument AV just wasn't worth the effort.

Meanwhile, I walk into organisations and every single person has 15 different toolbars clouding up half there screen real estate, and popups hitting them constantly. And you scan with an antivirus and the majority of players end up claiming this sort of thing is legitimate software.

Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry

#73

Earlier quoted context omitted.

That's what I'm seeing people doing (modify existing binaries): https://www.google.com/#q=shikata+ga+nai+antivirus Seems like it's pretty effective for bypassing AV according to how everyone is using it.

Well if you actually read the search results you'll see :) 1st result 2012: "If you want to avoid detection, a 60% success rate is not good enough. Remember, our implant was caught by 40% of the products, not 40% of the targets. Assuming the better anti-virus products have a larger market share, our 40% product failure rate could look more like an 80 or 90% detection rate on target machines . - See more at: http://ww…

Thanks for the detailed reply!

Re: Netflix Is Dumping Anti-Virus, Presages Death of an Industry

#74

I guess we're going to debate the merits of statements in a thinly-veiled bit of PR now? There's almost no news about this company until about a month ago ( http://www.networkworld.com/article/2955017/security/endpoin... ). They recently hired a new PR company ( http://www.mgpr.info/ ) who's been spamming articles to Reuters on SentinelOne's behalf ( https://www.google.com/?gws_rd=ssl#q=site:reuters.com+sentin... ),…

post AV means you are not blacklisting by signature/iocs. since it poor method to detect a virus. sentinelone are using behavioural engine for malware detection, assuming a malware will do malicious things which can be detected.

0-days aren't a problem for sentinelone EPP.

Post reply on HN