Your Operating System has Poor Operational Security

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Haus of Tech Support > Your Operating System has Poor Operational Security

«‹›42 »

omeg: Sep 3, 2012

hackbunny posted:

Honestly? I wouldn't trust any code.

There. And yeah, writing ~~kernel~~ code is hard. Security API in Windows is atrocious. I could say some things about various sandboxes as well. Speaking of which, there was talk about Win10 having some sort of app container support, anything came out of it?

# ? Nov 12, 2015 10:59

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 11:54

hooah: Feb 6, 2006; WTF?

hackbunny posted:

So, anyone? It's not strictly a security tool, but it keeps all software up to date and it requires almost zero maintenance or human intervention. I was wondering if anyone else used it and if it's secretly terrible

I don't know about security, but I stopped using it because it was slow as hell (i.e. tens of minutes to update a handful of programs). I've been using PatchMyPC instead and have been much happier with it.

# ? Nov 12, 2015 13:11

spankmeister: Jun 15, 2008

hackbunny posted:

So, anyone? It's not strictly a security tool, but it keeps all software up to date and it requires almost zero maintenance or human intervention. I was wondering if anyone else used it and if it's secretly terrible

Like hooah said it's very very slow. But other than that it works pretty good. Sometimes it comes up with things like ancient MSXML core services or whatever that are part of some program or something, or random old versions of programs you have laying around but not installed, but you can ignore those.

# ? Nov 12, 2015 18:08

doctorfrog: Mar 14, 2007; Great.

My experience with Secunia PSI was that it was so slow it wasn't worth using. It would take forever to respond to just clicking around on the interface.

PatchMyPC worked pretty well for me for a while, but anyone feel free to shoot it down immediately if it's not really good. These days I just use Ninite and avoid apps that aren't integrated with it, or try to find ones in the PortableApps catalog, since those'll update as well.

Grumble time, since MS started its "let's make it difficult not to upgrade to 10" campaign, I find that I now have to check each new patch they roll out to make sure it isn't installing something I didn't ask for and don't want. So I'm checking ghacks.net and windowssecrets.com every patch Tuesday. I don't think I've read a tech blog since the early aughts. I've been using WSUS Offline to install patches in the hopes that their administrative focus steers them away from this kind of nonsense. (edit: yes I am a cane-waving luddite running Win7)

I guess if the OS provider is rolling out stuff you don't like it's technically not a security risk, but it somehow feels the same to me: actions beyond your control, without your leave.

doctorfrog fucked around with this message at 21:48 on Nov 12, 2015

# ? Nov 12, 2015 21:45

spankmeister: Jun 15, 2008

My Win 7 is fine because it seems to think my PC doesn't support 10 due to some missing drivers (bullshit) but it's fine by me because it doesn't bother me now.

# ? Nov 12, 2015 21:50

Khablam: Mar 29, 2012

doctorfrog posted:

Grumble time, since MS started its "let's make it difficult not to upgrade to 10" campaign, I find that I now have to check each new patch they roll out to make sure it isn't installing something I didn't ask for and don't want. So I'm checking ghacks.net and windowssecrets.com every patch Tuesday. I don't think I've read a tech blog since the early aughts. I've been using WSUS Offline to install patches in the hopes that their administrative focus steers them away from this kind of nonsense. (edit: yes I am a cane-waving luddite running Win7)

Your worst-case scenario is you get a taskbar icon saying you are compatible. There's no forced updates. A small number of people auto-updated on launch day who had reserved their copy, but this was a bug. Maybe this is enough to make your ludditeness rage you out but there's no real cause for concern.

I hit the button to upgrade a couple of weeks ago. It's markedly quicker than Win 7 at booting and resuming, and there's no compatibility issues, even on the one machine where it says it isn't. Synthetic benchmarks put it on-par with 7 in nearly all things, better in others, give it a slight edge in gaming performance and is generally quicker at disk access.

Windows 10 is the new Windows 7 in the "it's just quick and works" factor.

# ? Nov 14, 2015 13:47

doctorfrog: Mar 14, 2007; Great.

Khablam posted:

Your worst-case scenario is you get a taskbar icon saying you are compatible. There's no forced updates. A small number of people auto-updated on launch day who had reserved their copy, but this was a bug. Maybe this is enough to make your ludditeness rage you out but there's no real cause for concern.

I hit the button to upgrade a couple of weeks ago. It's markedly quicker than Win 7 at booting and resuming, and there's no compatibility issues, even on the one machine where it says it isn't. Synthetic benchmarks put it on-par with 7 in nearly all things, better in others, give it a slight edge in gaming performance and is generally quicker at disk access.

Windows 10 is the new Windows 7 in the "it's just quick and works" factor.

I'm not really angry about it, I just don't like it. So I grumble. That icon's done more than sit there, and some users have had it, and its attending services, come back even after removal. This, plus telemetry--something "harmless" but still, something I didn't ask for and don't want--and a rumored future push to make the Windows 10 upgrade a higher level update, means I feel like I have to comb through all their patches just in case.

There may be a difference in philosophy here also. I view the PC as a sort of digital house that I own. All my stuff is on there, work, play, family photos, stuff I've written, etc. I do all my work on PC. I prefer to have a level of control over this house of stuff that maybe you don't feel you need.

I also have an HP Stream laptop running Win 8.1, a cheap but decent machine, with a tiny SSD. I haven't a clue what W10's storage demands will be, or how it will perform on it. This is all stuff that's my problem, but I view these as practical concerns.

# ? Nov 14, 2015 20:32

Carbon dioxide: Oct 9, 2012

I'm glad they're putting Windows 10 upgrade to a more important update level. This is their way of preventing the thing that happened with Windows XP, where millions of computers were still running on this old system, even after support completely dropped, leading to security problems everywhere. And they're doing it for free too. While their Windows 10 data-grabbing from computers is concerning, an 'enforced' upgrade will in the long run be helpful for all those people who don't understand computer security at all.

# ? Nov 14, 2015 22:18

Khablam: Mar 29, 2012

Carbon dioxide posted:

I'm glad they're putting Windows 10 upgrade to a more important update level. This is their way of preventing the thing that happened with Windows XP, where millions of computers were still running on this old system, even after support completely dropped, leading to security problems everywhere. And they're doing it for free too. While their Windows 10 data-grabbing from computers is concerning, an 'enforced' upgrade will in the long run be helpful for all those people who don't understand computer security at all.

Right, and this is the heart of the reason for the push. Supporting 6-year old software, twice superseded, is a drain on resources keenly felt by a company struggling to bring their books back to where they want them to be, and 99% of the issue is people simply not wanting to for *reasons*. People, who could put the same effort they're putting into avoiding the update (being active in it is just bizarre) into researching their current compatibility and would end up with something that was a win-win for all. My desktop upgraded in about 25minutes with zero issues. I've had java patches take longer. This is the most seamless upgrade of an OS I've seen.

To their credit, MS have largely seen the problem with optional, paid, effort-laden upgrades, and have adopted the "buy once, keep forever" model. Win 10 might then kill OS luddites, but sadly not soon, as 7 goes EOL in 2020.

# ? Nov 14, 2015 23:05

sneakymango: Apr 28, 2004; BLAMMO

Thanks for all the info, I'm paranoid now and going to take a bunch of this advice.

I have a question about password managers, though. I need to log into stuff from all sorts of different computers in my daily life. How does that work with KeePass? You mention that it can be sync'd with dropbox or other services but do I then have to carry a USB drive with the KeePass program/vault file with me wherever I go, and can only log into poo poo if I can get to that computer's USB ports? Or do I have to download it on every new computer, and then connect it to my vault file from dropbox? Sometimes that's not possible or practical (wall-mounted presentation boxes in conference rooms at work etc.). Would I just put it on my phone (iphone, sorry) and pull it up in plaintext and type it in manually when I'm at a new computer, or what?

Sorry if this is dumb.

# ? Nov 15, 2015 17:32

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

sneakymango posted:

Thanks for all the info, I'm paranoid now and going to take a bunch of this advice.

I have a question about password managers, though. I need to log into stuff from all sorts of different computers in my daily life. How does that work with KeePass? You mention that it can be sync'd with dropbox or other services but do I then have to carry a USB drive with the KeePass program/vault file with me wherever I go, and can only log into poo poo if I can get to that computer's USB ports? Or do I have to download it on every new computer, and then connect it to my vault file from dropbox? Sometimes that's not possible or practical (wall-mounted presentation boxes in conference rooms at work etc.). Would I just put it on my phone (iphone, sorry) and pull it up in plaintext and type it in manually when I'm at a new computer, or what?

Sorry if this is dumb.

So you have a couple of options but in the case of a machine where downloading the password file to the machine is not an option, sending the file to your mobile device is definitely one way you can go about doing it. You'll need a copy of KeePass on any machine that you want to read the password database itself. KeePass themselves provide links to portable versions however.

# ? Nov 15, 2015 18:54

Loving Africa Chaps: Dec 3, 2007; We had not left it yet, but when I would wake in the night, I would lie, listening, homesick for it already.

As someone who looks at hella PDF's, what should I be using instead of adobe reader?

# ? Nov 18, 2015 11:22

Fruit Smoothies: Mar 28, 2004; The bat with a ZING

Loving Africa Chaps posted:

As someone who looks at hella PDF's, what should I be using instead of adobe reader?

Depends if you're looking, or searching / manipulating. I use whichever browser is default. Firefox, Chrome and Edge can all open PDFs, and they're all kept up-to-date more often than anything Adobe shits out.

# ? Nov 18, 2015 13:28

Carbon dioxide: Oct 9, 2012

I really like Foxit Reader myself.

# ? Nov 18, 2015 15:43

univbee: Jun 3, 2004

Loving Africa Chaps posted:

As someone who looks at hella PDF's, what should I be using instead of adobe reader?

If you must use Adobe Reader (Canadian government :argh:

), you should disable the auto-approval of Javascript, as well as the trust of external links, assuming your PDF sources aren't broken enough to require those things. But there are a ton of "not Adobe" options and they're all pretty solid by virtue of not being Adobe.

# ? Nov 18, 2015 15:48

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

Fruit Smoothies posted:

Depends if you're looking, or searching / manipulating. I use whichever browser is default. Firefox, Chrome and Edge can all open PDFs, and they're all kept up-to-date more often than anything Adobe shits out.

Re Firefox PDF.js: https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/

OP should use chrome's because it's sandboxed

# ? Nov 18, 2015 16:55

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

univbee posted:

If you must use Adobe Reader (Canadian government ), you should disable the auto-approval of Javascript, as well as the trust of external links

Also you should be running EMET (not that it can't be circumvented)

# ? Nov 18, 2015 16:57

univbee: Jun 3, 2004

Rufus Ping posted:

Also you should be running EMET (not that it can't be circumvented)

OK, let's check the link to it.

# ? Nov 18, 2015 17:01

spankmeister: Jun 15, 2008

Carbon dioxide posted:

I really like Foxit Reader myself.

It's bloatware. Use chrome imo.

SumatraPDF works and is nice and lightweight, but looks like rear end.

# ? Nov 18, 2015 17:36

Crankit: Feb 7, 2011; HE WATCHES

spankmeister posted:

SumatraPDF works and is nice and lightweight, but looks like rear end.

And that's why I like it :colbert:

# ? Nov 18, 2015 17:55

Melian Dialogue: Jan 9, 2015; NOT A RACIST

I bought a new laptop recently, but never bothered to migrate old files off of my old one. I'm interested in using some type of Remote desktop software or something so that I basically use my old laptop like an external HD (i.e. just go into Explorer, open up the folders and such from the other laptop and control it from my new laptop).

All the stuff with remote desktop and all of that has me paranoid. What's the safest and easiest way to do this without installing some hokey software that has a thousand exploits?

# ? Nov 18, 2015 20:48

Khablam: Mar 29, 2012

Melian Dialogue posted:

I bought a new laptop recently, but never bothered to migrate old files off of my old one. I'm interested in using some type of Remote desktop software or something so that I basically use my old laptop like an external HD (i.e. just go into Explorer, open up the folders and such from the other laptop and control it from my new laptop).

All the stuff with remote desktop and all of that has me paranoid. What's the safest and easiest way to do this without installing some hokey software that has a thousand exploits?

Migrate the files.

# ? Nov 18, 2015 21:43

spankmeister: Jun 15, 2008

Khablam posted:

Migrate the files.

# ? Nov 18, 2015 22:00

Melian Dialogue: Jan 9, 2015; NOT A RACIST

Khablam posted:

Migrate the files.

There's too many. I have an SSD on my new laptop that while is much faster, doesn't have a lot of storage. Do I need to just bite the bullet an buy an External HD? It just feels like an unnecessary expense given that my old laptop is just acting like an external HD right now, collecting dust.

# ? Nov 18, 2015 23:00

hooah: Feb 6, 2006; WTF?

You can get an enclosure and slap your old drive in it.

# ? Nov 18, 2015 23:03

Khablam: Mar 29, 2012

Melian Dialogue posted:

There's too many. I have an SSD on my new laptop that while is much faster, doesn't have a lot of storage. Do I need to just bite the bullet an buy an External HD? It just feels like an unnecessary expense given that my old laptop is just acting like an external HD right now, collecting dust.

You have lovely transfer speed and have to power a whole laptop just to run it as a HDD, it's also an ageing 2.5" which isn't a great bedrock of reliability.
How much storage do you need? External drives are cheap. All storage basically is.

# ? Nov 18, 2015 23:32

Fuschia tude: Dec 26, 2004; THUNDERDOME LOSER 2019

Khablam posted:

Right, and this is the heart of the reason for the push. Supporting 6-year old software, twice superseded, is a drain on resources keenly felt by a company struggling to bring their books back to where they want them to be, and 99% of the issue is people simply not wanting to for *reasons*. People, who could put the same effort they're putting into avoiding the update (being active in it is just bizarre) into researching their current compatibility and would end up with something that was a win-win for all. My desktop upgraded in about 25minutes with zero issues. I've had java patches take longer. This is the most seamless upgrade of an OS I've seen.

To their credit, MS have largely seen the problem with optional, paid, effort-laden upgrades, and have adopted the "buy once, keep forever" model. Win 10 might then kill OS luddites, but sadly not soon, as 7 goes EOL in 2020.

I've tried to upgrade my laptop twice, waited 8+ hours and got nowhere.

The first time it at least reached the install and reboot stage... and then booted into 7. :psyduck:

Second time it never got past the spinny 'preparing your computer' screen. I guess I should try again.

Seamless isn't the word I'd use.

Khablam posted:

You have lovely transfer speed and have to power a whole laptop just to run it as a HDD, it's also an ageing 2.5" which isn't a great bedrock of reliability.

This. The likelihood of a drive dying ticks up slightly every year, crossing over 'more likely than not' around year five--and that's assuming you had a high-quality drive to begin with. Your files are becoming less and less likely to survive the longer you keep them on an old drive.

# ? Nov 19, 2015 00:29

MF_James: May 8, 2008; I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

Melian Dialogue posted:

I bought a new laptop recently, but never bothered to migrate old files off of my old one. I'm interested in using some type of Remote desktop software or something so that I basically use my old laptop like an external HD (i.e. just go into Explorer, open up the folders and such from the other laptop and control it from my new laptop).

All the stuff with remote desktop and all of that has me paranoid. What's the safest and easiest way to do this without installing some hokey software that has a thousand exploits?

You could buy 3TB of external storage for like 60-100 depending on deals etc, if you need something faster than external USB3.0/2.0 storage will provide, you can buy a 1TB internal for like 40-60, depending on if you have an extra slot for a second drive.

Your other option is to fire up the other laptop and share out whatever folders you need files from, RDP is way overkill for what you're trying to do, you can share the folders/give permission for your new laptop/user to access those files (or the whole file system!)

# ? Nov 19, 2015 01:01

Khablam: Mar 29, 2012

Fuschia tude posted:

I've tried to upgrade my laptop twice, waited 8+ hours and got nowhere.

The first time it at least reached the install and reboot stage... and then booted into 7. Second time it never got past the spinny 'preparing your computer' screen. I guess I should try again.

Seamless isn't the word I'd use.

Not to get too sidetracked (there's a Win thread) but clean installs now work from USB using the Windows 7 CD keys. It should fix the few people who fail the restart-upgrade.

# ? Nov 19, 2015 02:00

Khablam: Mar 29, 2012

So with SSL fuckery (thanks Dell) and manufacturers doing MITM attacks on their own customers, bad AVs self-signing your requests (breaking EV) should we talk about SSL security?

The GRC page probably best outlines the basics and offers a way at testing your results: https://www.grc.com/fingerprints.htm
The perspectives project is available for firefox which seeks to do the same on the fly - http://perspectives-project.org/

There also seems to be a few tools to check your existing stores - http://www.wilderssecurity.com/threads/rcc-check-your-systems-trusted-root-certificate-store.373819/

Does anyone know of a better means of verifying a systems SSL integrity?

# ? Nov 25, 2015 13:26

Pile Of Garbage: May 28, 2007

Khablam posted:

So with SSL fuckery (thanks Dell) and manufacturers doing MITM attacks on their own customers, bad AVs self-signing your requests (breaking EV) should we talk about SSL security?

The GRC page probably best outlines the basics and offers a way at testing your results: https://www.grc.com/fingerprints.htm
The perspectives project is available for firefox which seeks to do the same on the fly - http://perspectives-project.org/

There also seems to be a few tools to check your existing stores - http://www.wilderssecurity.com/threads/rcc-check-your-systems-trusted-root-certificate-store.373819/

Does anyone know of a better means of verifying a systems SSL integrity?

That GRC page is absolutely garbage. SSL Labs is pretty much the go-to for validating the strength of a web-servers TLS implementation/configuration.

Edit: it appears that you are actually talking about PKI and validation of client-side trusted root/intermediate CA certificate stores, not SSL/TLS. Just keep your OS, web browsers and any other applications which maintain their own trusted CA certificate stores up-to-date (e.g. JRE). If you've bought a new machine then it really depends whether or not the OEM is a massive rear end in a top hat so format and reinstall the OS I guess.

Pile Of Garbage fucked around with this message at 14:20 on Nov 25, 2015

# ? Nov 25, 2015 14:02

Khablam: Mar 29, 2012

There are funnier pictures of him to use, but thanks for the 10 carebux spent.

And yes I'm specifically talking about the certificate stores. As more of the web transitions to HTTPS it seems more likely some ad-supported software is going to start loving around with trying to read that traffic by installing their own.

# ? Nov 26, 2015 00:57

Segmentation Fault: Jun 7, 2012

Hey OSI Bean Dip, I faintly remember you writing a post about how you used to work in an anti-virus firm and how anti-virus is just trash. Do you know where I could find that? If you never wrote this, could you write it? My boss refuses to accept that anti-virus is dead and hearing from an expert might change his opinion.

# ? Nov 27, 2015 06:58

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Segmentation Fault posted:

Hey OSI Bean Dip, I faintly remember you writing a post about how you used to work in an anti-virus firm and how anti-virus is just trash. Do you know where I could find that? If you never wrote this, could you write it? My boss refuses to accept that anti-virus is dead and hearing from an expert might change his opinion.

Was it this post?

OSI bean dip posted:

Traditionally, anti-virus works through a few ways:

Signatures - this is really the most common way that AV vendors rely on and really all it is a list of items that indicate that whatever it is reading is good or bad. AV vendors have signatures for files they don't want to touch and files they do.

Behavioural - anything that does a number of steps in a specific order (or a single step) is monitored

Heuristics - don't really work but the idea is to figure out a pattern and work based on that

Sandbox - run the code within a virtual machine and determine if the outcome is good or not

Remotely - you'll see vendors claim they have a "cloud solution" when really it's not much different from that Python script I shared

The big problem with signature-detection is scale: back when the only attack vectors were floppies and BBSes, it was really a non-issue to just wait every six to twelve months to visit Computer City or CompUSA for a new-fangled edition of McAfee, which at the time was still under the nose John McAfee, except now his nose is above cocaine. The Internet was not really a major concern in the mid-90s because while there were things like worms going about, it was still relatively new and we were still in the age of joke viruses--ransomware is fairly old just for the record.

Once broadband became a thing and the new millennium dawned, malware started to change. Spam was really the big driving-force behind malware for a long time and to a certain extent still is, but it never became a huge issue in the malware sense until we started to see e-mail RBLs becoming popular--RBLs have been around since the mid-late 90s but became much more popular as everyone else started to get online. As a result of RBLs becoming popular, we started to see a shift in getting access to botnets for the purposes of sending e-mail spam as opposed to sharing files--much of the botnet activity I used to see back in the early-00s were really for people to share warez and porn.

Because of this shift in how botnets were being used, malware was becoming a bigger problem for the AV vendors to manage so then began an arms race between the writers and the defenders. It helps to understand the basic logic of how a signature works (and it should be mentioned that heuristics really fall into the signature category here so I won't elaborate much on them).

It's sort of hard to write into words (and I know that certain people are going to nitpick on what is written here because they want to be "right") but it sort of works like this:

What is the filename being used here? - Some malware (usually older) have filenames that are just consistent or have a predictable pattern. This is of course not reliable but if we're to look at this from a flow-chart then it allows for the next set of rules to go forward. The path of where the file resides is important too.

What's the file size? This may seem really dumb but both the filename and file size checks are super-important from a performance perspective because all we're doing is requesting details from the OS for the metadata.

What is the file type? This is done one of two ways usually: checking the extension and then checking for the magic pattern. There is a limited set of file extensions that AV engines by default will want to check--typically we're talking executables, libraries, drivers, et cetera. However, sometimes that isn't enough and what you can do instead is determine the file type by looking through the first few bytes or so and going based on that--Windows executables always start with with "MZ" on its first two bytes and PDFs will start with "%PDF" for example. This is also the first time the AV engine will touch the file.

Should it be an acceptable file type, what are the first few things it does right off of the bat? This is useful in the case of an executable because a number of junk programs will do things like constantly call the OS' API to do a bunch of things but then do nothing afterward. This can be checked through reading the first handful of software instructions but it is also checked within the sandbox as well.

Is this file encoded in a specific way? Malware tends to get packed, meaning that if you were to run the code through a debugger, you won't get the entire picture until you unpack it. There's a couple of ways to get around this: namely either running it in a sandbox then dumping what it loaded into memory or just outright detecting based on the packer itself--there are legitimate executable packers out there and there are known stolen copies which do happen to leave a signature on files. You can unpack the files as well but only if you are able to determine what the packer-type is to begin with. It's pretty easy to do this with Python if you're curious.

What patterns does it match? What strings does it have? If there are known strings then it can start to apply whatever rules to those. Sometimes it needs a specific pattern such as it's calling on a socket to connect to an IP address to determine its location but then it goes and reads the SAM file to see what users are on there immediately afterward--things like that.

I should disclaim that the above list is really a really, really simplified look at an AV engine as I cannot divulge too much further without putting myself at potential legal risk here (I'll leave this part to your guys' imagination), but what it does describe is that there are so many things signature-based AV engines have to look at in order to come to a conclusion whether or not a file is safe--keep in mind, signatures can be used to whitelist in addition to blacklisting. The problem with the signature system is really straightforward: it is really easy to determine how to get around it once you're aware that one exists. I may elaborate on these points or your questions if you want, but I may hold back too just because of what I said earlier here.

The thing is that the malware writers can use whatever they have at their disposal to pump out thousands of unique copies of their software that evade the signatures that have been created already. The idea behind heuristics is to come up with a pattern that potentially predicts this, but the packers already take that into account and can render any discovered pattern useless within a very short period of time. To combat that, AV vendors have agreements amongst many of themselves to share the data they already have, so Symantec may end up with McAfee's, Trend Micro's, Sophos', or Microsoft's data and vice-versa. VirusTotal for example is not popular with malware authors because VT themselves share the data with vendors who request access--at a fee of course, which is in order of a few thousand per month. They themselves have online testing tools that take popular AV engines and run the malware against and spit out results. It's really an arm's race that in my opinion the AV industry lost a decade ago, so the idea that you should go shopping around for different AV vendors is stupid.

The solution for AV vendors to keep the signature race going is to throw more people at it. It doesn't mean success but more bodies in seats in their labs does usually lead to better results. However, that becomes expensive so you have to make business decisions around that. I won't go much further into this but you'll probably get the idea.

AV vendors will come out and say that their cloud detection works but really all it is is a pre-warning for or from them. They'll get a hash sum from a client machine, run it against their DB, and if it has already has seen in it. they'll report back with details. The dirty little secret is that if your AV engine is already signature-based, you're going to have details about that hash sum anyway in the next update so all you're doing is pre-emptively checking against their set of signatures and hoping that they have seen it before you have managed to update.

Suspicious behaviour is a bit of a different beast all together and probably the worst of the bunch. It relies on a list of patterns within a pre-configured file in order to determine if the action taken by an application is legitimate or not. Here's a kicker: go and make a change to your Windows Firewall with it enabled; it might actually set it off. It works fine if you're running it on a single machine, but try and enable it corporate-wide across thousands of machines then deploy a change later via GPO that requires a task to be performed that the behaviour monitoring picks up on--your help desk will absolutely love you. AV vendors keep this sort of thing close to their chest on what they're actually looking for but I wouldn't be shocked if a list of what the look out for is floating about.

Sandboxing is useful to me because I can run the malware within a controlled environment to determine what the ramifications are, but there are solutions that will run malware at the perimeter and will react after the fact if it does something that is discovered to be malicious. You just have to hope that the box doesn't get compromised because of a a vulnerability.

I should add that almost all endpoint software is really garbage as they tend to just be different shades of poo poo.

Lain Iwakura fucked around with this message at 19:31 on Nov 27, 2015

# ? Nov 27, 2015 19:28

Segmentation Fault: Jun 7, 2012

OSI bean dip posted:

Was it this post?

I should add that almost all endpoint software is really garbage as they tend to just be different shades of poo poo.

Thanks! I felt like you wrote a post that specifically mentioned your time working at an AV firm but I couldn't find it. Oh well, in any case that's going to help out big time.

# ? Nov 27, 2015 22:32

spankmeister: Jun 15, 2008

Question is do you still need it to deal with the low hanging fruit? And depending on your environment and user base the answer may still be yes.

# ? Nov 27, 2015 22:37

Segmentation Fault: Jun 7, 2012

spankmeister posted:

Question is do you still need it to deal with the low hanging fruit? And depending on your environment and user base the answer may still be yes.

sure, but MSE/Defender is good enough for everybody in that department

# ? Nov 27, 2015 22:39

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Segmentation Fault posted:

Thanks! I felt like you wrote a post that specifically mentioned your time working at an AV firm but I couldn't find it. Oh well, in any case that's going to help out big time.

I might have but this is the only post that comes to mind.

# ? Nov 27, 2015 23:13

Phyzzle: Jan 26, 2008

Segmentation Fault posted:

Thanks! I felt like you wrote a post that specifically mentioned your time working at an AV firm but I couldn't find it. Oh well, in any case that's going to help out big time.

You may be thinking of this other guy in the same business:

http://forums.somethingawful.com/showthread.php?threadid=3731439#post447828487

# ? Nov 28, 2015 02:00

Adbot: ADBOT LOVES YOU

# ? Apr 24, 2024 11:54

Garrand: Dec 28, 2012; Rhino, you did this to me!

Pretty certain they're thinking of this post from the prevoius thread which is more or less why we ended up with a new thread in the first place.

# ? Nov 28, 2015 02:48

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Haus of Tech Support > Your Operating System has Poor Operational Security

«‹›42 »