A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
1–10 of 56 posts
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#2Seems like just another regular anti-virus tool. Surely state-sponsored hackers have been getting around these for years?
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#3Looking at the code (https://github.com/botherder/detekt), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#4The tool's website is being EFF'd. (hah!)
NB: I haven't read about the technical features of the tool.
It probably uses some kind of signature mechanism to identify malware.
...Surely the authors realize that they've just drawn a line in the sand against an APT. The biggest one ever.
Their tool and signature updates are presumably freely available online.
Have fun keeping those sigs up to date, tool authors!
You'd have been better off passing it around to journalists only via sneakernet and simply not talking about it.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#5"Detekt is a free tool that scans your Windows computer..."
This is awesome, just not for me as a non-Windows user. I don't want this to perpetuate the myth that using Mac or Linux makes you impervious though.
I still think the best solution to this, and other problems, is outbound filtering at the gateway.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#6The tool's website is being EFF'd. (hah!) NB: I haven't read about the technical features of the tool. It probably uses some kind of signature mechanism to identify malware. ...Surely the authors realize that they've just drawn a line in the sand against an APT. The biggest one ever. Their tool and signature updates are presumably freely available online. Have fun keeping those sigs up to date, tool authors! You'd ha…
Security through obscurity? 70% of the time, it works every time...
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#7Looking at the code ( https://github.com/botherder/detekt ), it's just looking for patterns of known malware. Isn't this just a subset of what anti-virus software does?
Probably, but the suspicion is that some antivirus software "looks the other way" for some signatures. Hard to say if that it true or not.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#8Oh cool, I (indirectly) have code in this, since the Volatility memory analysis framework is used to scan memory for the malware signatures.
As others have noted, this is unlikely to protect against new infections, since governments will surely just check to make sure their malware isn't detected by the scanner. On the other hand, since we don't really trust corporate AV to detect state-sponsored malware, it seems like this fills a need right now, and will likely result in some organizations discovering they've been compromised by this kind of surveillance malware. So this still seems very useful right now.
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#9The tool's website is being EFF'd. (hah!) NB: I haven't read about the technical features of the tool. It probably uses some kind of signature mechanism to identify malware. ...Surely the authors realize that they've just drawn a line in the sand against an APT. The biggest one ever. Their tool and signature updates are presumably freely available online. Have fun keeping those sigs up to date, tool authors! You'd ha…
Security through obscurity? 70% of the time, it works every time...
Yeah! :) "better off" != "best off". I don't know what "best off" might be...
Oh, user moyix brings up an excellent point that I had not considered re: "right now".
Re: A New Malware Detection Tool That Can Expose Illegitimate State Surveillance
#10[deleted]