The Infosec Thread: Yes, time to move off Entrust

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›8 »

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

doctorfrog posted:

Is that the sort of thing where you're vulnerable because you're running a Symantec product? You'd be safer with nothing?

You can replace "Symantec" with other vendor names too.

# ¿ Apr 29, 2016 19:44

Adbot: ADBOT LOVES YOU

# ¿ May 12, 2024 08:44

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

co199 posted:

Ok, I'm not saying AV makes it cheaper, my question was specifically around securing a large enterprise, without AV, for a "reasonable" price. That's probably too broad of a specification, realistically, but for the sake of conversation we'll let it stand.

Please do not engage in doing any sort of IT work, let alone security. AV is far from "reasonable" regardless of how cheap it is.

# ¿ Apr 30, 2016 00:25

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Mustache Ride posted:

My company is like that too. We don't apply to any of those regulations and we're at >30,000 endpoints.

However we just use the free Microsoft av because it comes with our Microsoft subscription, it's free, and it's better than nothing.

Security is like an onion, the more poo poo you have layered on top of each other, the better off you'll be.

You are missing the point of why AV is complete crap. Just because you see it as a layer of security does not mean the layer is effective.

# ¿ Apr 30, 2016 22:06

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

How are you defining effectiveness?

Top-tier antivirus software (Kaspersky, BitDefender, etc) consistently picks off 99.9%+ of known threats, 95%+ of unknown threats via heuristics, and 98%+ of malicious sites. That's pretty effective in my book.

http://www.av-comparatives.org/wp-content/uploads/2016/04/avc_fdt_201603_en.pdf

http://www.av-comparatives.org/wp-content/uploads/2015/07/avc_beh_201503_en.pdf

http://www.av-comparatives.org/wp-content/uploads/2016/04/avc_factsheet2016_03.pdf

Tell me how in a real world situation these would actually achieve more than 40%--I am being fair here because it's really 5%. Tell me why AV cannot catch most ransomware even with up-to-date definitions.

# ¿ May 1, 2016 02:24

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

Way to beg the question. In the real world,

Users don't use antivirus (hello members of this thread)

Users don't keep antivirus up to date

Users disable antivirus when the virus asks them to

Users add viruses to ignore list when their AV trips on it because they really want to run it

Users use pirated Windows or AV installations that cannot be scanned by AV

and that's the AV-related causes of why viruses spread. I would also throw in users that disable UAC or let any random application ecalate to admin (especially dubious stuff like keygens), which may allow additional ways for malware to escape AV detection or kills.

Not that antiviruses are perfect - because they're not, nothing is 100% - but if you don't undercut them by doing the above, they are pretty effective. Some are more effective than others though - Kaspersky, BitDefender, ESET, and F-Prot regularly top the pack in detection rates, others have lower detection rates.

Ransomware isn't really any different than a standard virus, which also spread quite prodigously. The difference is that an average virus doesn't make your computer unusable until you send 50 bitcoins to Russia. Regular viruses want to stay undetected so they can keep using your machine in their botnet, spamming ads for ch34p v1agra, etc. If every single infected momputer out there suddenly flashed an alert message, we would notice them a lot more.

As someone who used to work for an antivirus company, you absolutely have no idea.

In your own words, how does antivirus work?

# ¿ May 1, 2016 05:20

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

Well, signatures look for unique bit-patterns in a file or in memory. For a trivial example, the classic "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" string.

Great. What else does a signature do? Does it have to rely on a file or in-memory?

quote:

Heuristics work by looking for patterns of characteristics and behavior of a process that might be suspicious. For example, a process that isn't signed by a trusted key, was recently installed, is running elevated, and has been a foreground window for less than a second might be a virus.

No.

quote:

Then there's sandboxing, where you set up what looks like a real kernel but actually is a stub run by the AV program, to see whether an executable or process tries touching a file or system resource that it shouldn't.

How does the sandbox deal with non-mutable system calls?

So far you're not nailing how anti-virus works. Have you ever seen a signature? Or even better, write me a YARA rule that will detect 99.9% of ransomware.

I do suggest that you read this thread before you proceed any further on debating here.

# ¿ May 1, 2016 06:28

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

One rule will never catch 99.9% of anything. You're an idiot who's trying to score points by making an impossible request.

Paul MaudDib posted:

Top-tier antivirus software (Kaspersky, BitDefender, etc) consistently picks off 99.9%+ of known threats, 95%+ of unknown threats via heuristics, and 98%+ of malicious sites. That's pretty effective in my book.

So what is it here? How does anti-virus catch "99.9% of known threats"? You think that multiple rules are piled upon it to come up with an answer?

quote:

Do you not drive with seatbelts because someone might t-bone you at 80 miles per hour and in that case you'd die anyway? Antivirus picks most of the low-hanging fruit - yeah the NSA is getting in regardless, but you don't have to make it easy for the first script-kiddie who gets a chance at you.

You're an idiot if you think the NSA has anything to do with average consumer security. No wonder you're "formerly employed" by an antivirus company.

I am not taking the NSA into account when I talk about things here; stop being obtuse.

So instead of responding in a manner where you act as your ego has been maligned, how about you answer my questions?

OSI bean dip posted:

Great. What else does a signature do? Does it have to rely on a file or in-memory?

How does the sandbox deal with non-mutable system calls?

Have you ever seen a signature? Or even better, write me a YARA rule that will detect 99.9% of ransomware.

If you're so certain about how AV works, answer these or shut up.

# ¿ May 1, 2016 06:55

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

invision posted:

Infosec Internet Discussions:
75% "How hack girlfrindz facebook????"
10% "12 year old copy-pasting old 'zine articles about wardialing and acting smug"
10% "Adults with jobs comparing internet dicks"
2.5% "We made a logo and a name for some real stupid non-exploitable bug to make our resume's look cooler p.s. please hire us"
2.5% "Actual good information and discussion"

You forgot to add charlatans somewhere in that list.

# ¿ May 1, 2016 20:27

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

Why? It's just YOSPOS having some drunken weekend anal leakage. You've got OSI Bean Dip, the Internet Antivirus Expert who once interned at Symantec or something, who just keeps asking someone to explain antivirus to him and who thinks the NSA is going after grandma's cat pictures (the explanation he gave in the thread he linked for why antivirus sucked, after I got past all the "under construction" paragraphs), and a bunch of white noise posters.

It would almost be funny if they weren't giving such bad advice. Sure, anyone who posts in this forum can probably avoid clicking any obvious malware links or opening a suspicious attachment. But that's not good advice for a business or for your aunt who loves those FWD: FWD: FWD: emails.

So angry. One of these idiots actually started stalking my posts to yell at me in other forums. Saturday night on Something Awful Dot Com, y'all

So why can't you answer the questions I threw at you instead of devolving to throwing insults as if somehow I have maligned you?

Surely you know must know more than me so step up here or show yourself out.

# ¿ May 1, 2016 22:56

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Paul MaudDib posted:

Top-tier antivirus software (Kaspersky, BitDefender, etc) consistently picks off 99.9%+ of known threats, 95%+ of unknown threats via heuristics, and 98%+ of malicious sites. That's pretty effective in my book.

Paul MaudDib posted:

One rule will never catch 99.9% of anything. You're an idiot who's trying to score points by making an impossible request.

Paul MaudDib posted:

Again, that's why we have heuristics.

Here's a post I wrote last year when dealing with a similar argument:

OSI bean dip posted:

Traditionally, anti-virus works through a few ways:

Signatures - this is really the most common way that AV vendors rely on and really all it is a list of items that indicate that whatever it is reading is good or bad. AV vendors have signatures for files they don't want to touch and files they do.

Behavioural - anything that does a number of steps in a specific order (or a single step) is monitored

Heuristics - don't really work but the idea is to figure out a pattern and work based on that

Sandbox - run the code within a virtual machine and determine if the outcome is good or not

Remotely - you'll see vendors claim they have a "cloud solution" when really it's not much different from that Python script I shared

The big problem with signature-detection is scale: back when the only attack vectors were floppies and BBSes, it was really a non-issue to just wait every six to twelve months to visit Computer City or CompUSA for a new-fangled edition of McAfee, which at the time was still under the nose John McAfee, except now his nose is above cocaine. The Internet was not really a major concern in the mid-90s because while there were things like worms going about, it was still relatively new and we were still in the age of joke viruses--ransomware is fairly old just for the record.

Once broadband became a thing and the new millennium dawned, malware started to change. Spam was really the big driving-force behind malware for a long time and to a certain extent still is, but it never became a huge issue in the malware sense until we started to see e-mail RBLs becoming popular--RBLs have been around since the mid-late 90s but became much more popular as everyone else started to get online. As a result of RBLs becoming popular, we started to see a shift in getting access to botnets for the purposes of sending e-mail spam as opposed to sharing files--much of the botnet activity I used to see back in the early-00s were really for people to share warez and porn.

Because of this shift in how botnets were being used, malware was becoming a bigger problem for the AV vendors to manage so then began an arms race between the writers and the defenders. It helps to understand the basic logic of how a signature works (and it should be mentioned that heuristics really fall into the signature category here so I won't elaborate much on them).

It's sort of hard to write into words (and I know that certain people are going to nitpick on what is written here because they want to be "right") but it sort of works like this:

What is the filename being used here? - Some malware (usually older) have filenames that are just consistent or have a predictable pattern. This is of course not reliable but if we're to look at this from a flow-chart then it allows for the next set of rules to go forward. The path of where the file resides is important too.

What's the file size? This may seem really dumb but both the filename and file size checks are super-important from a performance perspective because all we're doing is requesting details from the OS for the metadata.

What is the file type? This is done one of two ways usually: checking the extension and then checking for the magic pattern. There is a limited set of file extensions that AV engines by default will want to check--typically we're talking executables, libraries, drivers, et cetera. However, sometimes that isn't enough and what you can do instead is determine the file type by looking through the first few bytes or so and going based on that--Windows executables always start with with "MZ" on its first two bytes and PDFs will start with "%PDF" for example. This is also the first time the AV engine will touch the file.

Should it be an acceptable file type, what are the first few things it does right off of the bat? This is useful in the case of an executable because a number of junk programs will do things like constantly call the OS' API to do a bunch of things but then do nothing afterward. This can be checked through reading the first handful of software instructions but it is also checked within the sandbox as well.

Is this file encoded in a specific way? Malware tends to get packed, meaning that if you were to run the code through a debugger, you won't get the entire picture until you unpack it. There's a couple of ways to get around this: namely either running it in a sandbox then dumping what it loaded into memory or just outright detecting based on the packer itself--there are legitimate executable packers out there and there are known stolen copies which do happen to leave a signature on files. You can unpack the files as well but only if you are able to determine what the packer-type is to begin with. It's pretty easy to do this with Python if you're curious.

What patterns does it match? What strings does it have? If there are known strings then it can start to apply whatever rules to those. Sometimes it needs a specific pattern such as it's calling on a socket to connect to an IP address to determine its location but then it goes and reads the SAM file to see what users are on there immediately afterward--things like that.

I should disclaim that the above list is really a really, really simplified look at an AV engine as I cannot divulge too much further without putting myself at potential legal risk here (I'll leave this part to your guys' imagination), but what it does describe is that there are so many things signature-based AV engines have to look at in order to come to a conclusion whether or not a file is safe--keep in mind, signatures can be used to whitelist in addition to blacklisting. The problem with the signature system is really straightforward: it is really easy to determine how to get around it once you're aware that one exists. I may elaborate on these points or your questions if you want, but I may hold back too just because of what I said earlier here.

The thing is that the malware writers can use whatever they have at their disposal to pump out thousands of unique copies of their software that evade the signatures that have been created already. The idea behind heuristics is to come up with a pattern that potentially predicts this, but the packers already take that into account and can render any discovered pattern useless within a very short period of time. To combat that, AV vendors have agreements amongst many of themselves to share the data they already have, so Symantec may end up with McAfee's, Trend Micro's, Sophos', or Microsoft's data and vice-versa. VirusTotal for example is not popular with malware authors because VT themselves share the data with vendors who request access--at a fee of course, which is in order of a few thousand per month. They themselves have online testing tools that take popular AV engines and run the malware against and spit out results. It's really an arm's race that in my opinion the AV industry lost a decade ago, so the idea that you should go shopping around for different AV vendors is stupid.

The solution for AV vendors to keep the signature race going is to throw more people at it. It doesn't mean success but more bodies in seats in their labs does usually lead to better results. However, that becomes expensive so you have to make business decisions around that. I won't go much further into this but you'll probably get the idea.

AV vendors will come out and say that their cloud detection works but really all it is is a pre-warning for or from them. They'll get a hash sum from a client machine, run it against their DB, and if it has already has seen in it. they'll report back with details. The dirty little secret is that if your AV engine is already signature-based, you're going to have details about that hash sum anyway in the next update so all you're doing is pre-emptively checking against their set of signatures and hoping that they have seen it before you have managed to update.

Suspicious behaviour is a bit of a different beast all together and probably the worst of the bunch. It relies on a list of patterns within a pre-configured file in order to determine if the action taken by an application is legitimate or not. Here's a kicker: go and make a change to your Windows Firewall with it enabled; it might actually set it off. It works fine if you're running it on a single machine, but try and enable it corporate-wide across thousands of machines then deploy a change later via GPO that requires a task to be performed that the behaviour monitoring picks up on--your help desk will absolutely love you. AV vendors keep this sort of thing close to their chest on what they're actually looking for but I wouldn't be shocked if a list of what the look out for is floating about.

Sandboxing is useful to me because I can run the malware within a controlled environment to determine what the ramifications are, but there are solutions that will run malware at the perimeter and will react after the fact if it does something that is discovered to be malicious. You just have to hope that the box doesn't get compromised because of a a vulnerability.

So the reason why I have been giving [people who've learnt from their ways] poo poo for their opinions is because they both don't understand malware, how its remediated, and why a set of tools rambled off will do squat. They're quick to suggest software based on something they read elsewhere in this thread or on some other website, but they're then just as quick to defend their decisions when they're called out on their inability to explain them. Malware authors spend a lot of loving time going over how the whitehats are going after them and there is a lot of money to be made by them to keep it that way. You cannot assume that a list of software will fix the problem and that the only way to go about this is to assess how bad you think the risk is if you continue to use the machine post-infection. I consider it negligent to go about in this thread suggesting fixes without having any knowledge of what lead up to someone getting infected before.

I do recommend for those of you who are curious about the mindset of these guys that you contribute to Brian Krebs' forehead-reduction surgery by reading his book, Spam Nation. It's not a bad read as he does go into some detail about how malware, spam, and security in general became the way it is. I've had a few of you ask me questions via PM already and I am always happy to answer them as long as they're constructive and I feel comfortable to give an answer.

Now please stop it with the heuristics nonsense and if you want to argue in this thread, stop calling people and actually contribute to the conversation because this is in fact not YOSPOS.

Hopefully the above was too long for you to read because apparently you've had some trouble reading other things and have assumed I am talking about the NSA here.

# ¿ May 2, 2016 06:49

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

online friend posted:

nobody's posting conspiracy theories? where are you getting this?

A lack of reading comprehension skills tends to lead to this belief that we're concerning ourselves with the NSA backdooring anti-virus products I guess.

# ¿ May 2, 2016 06:54

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Wiggly Wayne DDS posted:

If you've not paid attention to AV vulns lately we're pointing at zero interaction pre-auth rces to system - not lpes. That or destroying any concept of cert validity. Worse than the disease.

Yeah. Like just look at this list of really loving dumb vulnerabilities:

Remote debugger in TrendMicro left enabled
Comodo forwards to non-mutable API calls on the host
Comodo disables aspects of Chrome's sandbox
TrendMicro has RCE problems
Kaspersky buffer overflow

And these are just a random sampling of vulnerabilities from that Project Zero page.

Or you can see Tavis' Sophail presentation from 2011, which covers issues like XSS in the web protection module amongst others. This presentation is really what started the rabbit hole for him to go down on how loving dumb AV is designed.

And lastly we have a bug for Symantec coming our way.

# ¿ May 2, 2016 15:34

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Daman posted:

taviso's AV bugs are cool but the "RCE" is rarely actually practical or part of the actual AV itself. nobody sane is recommending you install sophos or comodo. generally enterprise AV is all worthless, other protections should be in place on the enterprise network to protect endpoints on the network/permissions layer. enterprise is a totally separate theater.

bugs that result from scanning downloaded files (CHM, kaspersky upx bug, etc) are not practical for widespread random idiot infection. you're usually not going to be able to detect and filter for specific AV users and send AV-specific payloads(with the exception of a few awful solutions nobody normally recommends that add plugins+headers). throwing these payloads at everyone would result in your poo poo getting detected in a flash. even if you ignore this problem many bugs in this category that taviso finds are also not actually remotely exploitable on platforms with ASLR and DEP (Windows), as a separate bug to generate a good heap spray or memory exhaustion usually isn't there. all of this is _high effort_ for EK authors.

bugs that result from mitm are lol who the gently caress cares, you'd get about $5 for a full chain using that on the market. not practical to use to infect random idiots.

bugs in massive products like TM are funny, but who the gently caress is recommending TM to their family? generally people suggest (the user versions of) bitdefender, malwarebytes, eset, maybe kaspersky. the non-enterprise versions tend not to include misc garbage.

some of taviso's best bugs in poo poo that actually matters, like his ESET emulation RCE, are /still/ useless to infect rando users. code execution on modern windows was totally defeated by mitigations. his example ran on OSX because of this. people tried to make his exploit generic and failed because of this. even good security researchers will overstate the practicality of their bugs so that people will patch them.

imo y'all combine enterprise vs idiot user recommendations too much. misc_ransomeware_2000 / EK_hailsatan_666 are not really using AV vulns for RCE/LPE because they loving suck and there's easier ways. most even dip the out and stop execution if they can detect AV because it's _not worth the time_. if they don't target $CJ_AV_REC and $CJ_AV_REC stops them occasionally and saves time cleaning grandma's computer there's really no problem in having them.

"lol don't use AV just update" isn't helpful when there are offerings that don't include nodejs, a loving password manager with code execution, and ASLR defeats. these will stop a variety of infections and nobody is targeting grandma for an AV RCE that requires a mitm.

The problem I have with your reply here is that what you're saying is that we should overlook these vulnerabilities because no known malware is currently exploiting any of this. You are correct that in as far as any of us know right now nothing is currently exploiting a really dumb RCE in TrendMicro or whatever AV suite to get a foothold on the system. However, what you're forgetting is that what Tavis has found so far demonstrates a complete lack of care or at least intelligence into developing these software suites.

If these applications are supposed to make us more secure, then why are there really obvious RCEs? Why is debug mode left on? What soft of loving moron creates a sandbox that allows for the passing of API calls to the host OS just because they assumed that it was safe to do so because they couldn't make system changes? These are the idiot decisions that make me wonder about the actual care and attention that goes into the development of these application suites that again are supposed to make systems more secure.

You also are doing a disfavour to your argument by thinking enterprise and non-enterprise AV suites are different when in reality at their core they're not other than manageability. If we look at my earlier post, my argument against the use of it with the expectation of it doing anything is not based on idiotic vulnerabilities that have no business existing but instead the fact that signatures, heuristics, behavioural and everything else being done to detect malware just simply do not work.

AV's biggest problem isn't the bugs within; it's the fact that it simply cannot scale. If I can pump out 200,000 unique copies of some ransomware in a single day that signatures cannot keep up with, heuristics cannot predict without causing havoc with other applications, and suspicious behaviour will never get wind of, how can I as an AV vendor expect to be able to keep up? It's really an impossible task to expect that you'll get enough analysts in the lab to come up with answers. This is why I find the whole notion of switching AV vendors after an incident as dumb because another wave of malware will pop up eventually and you'll be back at the same conclusion like you had before.

AV provides a false sense of security and the suggestion that you should rely on it should only come from AV vendors themselves, not from people who shouldn't peddle crap.

Lain Iwakura fucked around with this message at 18:47 on May 2, 2016

# ¿ May 2, 2016 18:18

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Daman posted:

of course you shouldn't rely on any one thing. defense in depth is not just a meme. picking an AV that doesn't come with debug JS servers is a part of that. most _do_ stop lovely kiddy trojans. I'd question whether the knowledge of having an AV would affect what a dumb user does at all.

Okay. But how do you pick an AV that doesn't have dumb programming put into it? How many users avoided Comodo because they knew that it was doing harm to Chrome? How many users knew that TrendMicro was running the debug server? How many people knew that Avast was passing API calls to its sandbox to the host OS?

None of them.

So if I am someone who goes into a store to buy an anti-virus suite, I am likely the type of person to not know the above problems and will likely be at harm for further issues.

Daman posted:

of course you should consider that these vulnerabilities existed (in the specific configurations and components they occurred in) when deciding if av_vendor is a good choice. history of security issues, vendor response to these, and recent additions/changes to the product should all be taken into consideration.. one vendor's actions don't indicate every product is going to contain ridiculous issues.

One vendor's poor coding shows the level of care being put into the engine.

Daman posted:

To me, it seems like the argument of "if one can get through, why bother at all?" You're still going to see attackers using simple malware spread, why not protect users who don't know any better from these? AV will totally trigger on old garbage trojans people cast a huge net out with. They'll still be affected by payloads that are well-written to avoid AV, but they would've been anyways?

If a user is going to be at risk at catching "old garbage trojans", they're already going to get hit by something newer that is going to bypass the anti-virus anyway. The average user who goes and gets themselves infected with something that is old is more likely to get hit with something else because their hygiene is already compromised.

# ¿ May 3, 2016 15:43

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Here's a practical one that you can do in Metasploit with the TIFF file format:
https://www.rapid7.com/db/modules/exploit/windows/fileformat/mswin_tiff_overflow

quote:

This module exploits a vulnerability found in Microsoft's Tagged Image File Format. It was originally discovered in the wild, targeting Windows XP and Windows Server 2003 users running Microsoft Office, specifically in the Middle East and South Asia region. The flaw is due to a DWORD value extracted from the TIFF file that is embedded as a drawing in Microsoft Office, and how it gets calculated with user-controlled inputs, and stored in the EAX register. The 32-bit register will run out of storage space to represent the large vlaue, which ends up being 0, but it still gets pushed as a dwBytes argumenet (size) for a HeapAlloc call. The HeapAlloc function will allocate a chunk anyway with size 0, and the address of this chunk is used as the destination buffer of a memcpy function, where the source buffer is the EXIF data (an extended image format supported by TIFF), and is also user-controlled. A function pointer in the chunk returned by HeapAlloc will end up being overwritten by the memcpy function, and then later used in OGL!GdipCreatePath. By successfully controlling this function pointer, and the memory layout using ActiveX, it is possible to gain arbitrary code execution under the context of the user.

# ¿ May 3, 2016 21:48

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Mustache Ride posted:

I had an interesting meeting with Cylance. yesterday, who said they are using math models to predict the APIs and library loads commonly used by malware instead of signatures or heuristics

OSI have you used their engine before? They claim it didn't need to be online to pull signatures and it has some pretty nice looking features that makes us want to rip and replace our Bit9 infrastructure with it.

I've had the pleasure in being stuck in a room with them and seeing the product demoed without an NDA. It does its "job" as an AV suite but I have yet to play with it beyond that.

The fact that they won't let you demo it at all without an NDA is ridiculous and speaks volumes about what they think about it.

One day I will write about it.

# ¿ May 5, 2016 14:48

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Mustache Ride posted:

Yeah, in the sit down the Sales Engineer had some intersting things to say about some of the questions I had, including, and I quote "We're not on Virustotal because we would catch everything and then the big 6 would use us as a reputation source and everyone would be using our engine."

My boss and I also kept cracking up in the meeting because the sales douches were so like those in the most recent Silicone Valley episode. The Cylance guys had not seen Silicone Valley, of course.

When I had them pay my company a visit, they gave a full-on demo and even repacked the malware, etc to show off its abilities--which was suspiciously done mind you. When I asked what they'd do when their "magic math" is compromised, they said that they could just adjust some variables and carry on, which smelt of horseshit.

Based on the demo I can say that they probably rely on signatures too but they danced around it when I asked them pointed questions about whether or not that was the case.

A friend of mine at a similar-sized organization had demo'd their product and got into trouble over their NDA when they posted on a message board about it, being critical about some of its software bugs.

I've been actively looking to get my hands on a copy of the product without an NDA and so far I have yet to succeed beyond the installer executable which still requires an MSI that I haven't gotten yet. :filez:

I really think that they're scam artists with a half-decent marketing team because they've gotten some "recognition" in various circles.

# ¿ May 5, 2016 15:19

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

The hype factor is seriously pumped.

http://www.pcworld.com/article/3005677/business-security/new-dell-partnership-throws-doubt-on-traditional-antivirus-programs.html

Dumbshit PC World article posted:

A partnership announced by Dell on Tuesday shows how cybersecurity defenses are evolving, which could have wide-ranging effects on vendors like Symantec, McAfee and Trend Micro.

The PC giant has partnered with Cylance, an Irvine, California-based company that specializes in detecting and blocking attacks on endpoint computers.

Early next year, Dell will wrap Cylance�s Protect product in its Data Protection Endpoint Security Suite, said Brett Hansen, Dell�s executive director of data security solutions. The suite is an integrated package with encryption capabilities, authentication features and malware detection.

Many antivirus programs still rely in part on systems that require identification of a piece of malware, which is then further identified by security products once a �signature� is pushed to a PC�s security application.

But most security experts have agreed that signature-based detection is fairly ineffective these days since what is essentially the same malware can be changed to avoid detection.

Other technologies in antivirus suites can detect strange behavior and block malware, but often only after it has already infected a machine and done something bad.

�Our customers have been telling us the same thing: it is just not working,� Hansen said.

Cylance doesn�t use signatures. Instead, it uses an algorithm that analyzes seven million characteristics of files and programs and scores those elements on the likelihood of them being malicious, and can block them.

It�s a lightweight agent that runs on a computer, and it only occasionally needs updating. Two or three times a year, Cylance send out an update to fine tune the algorithm.

That also means Protect doesn�t need a consistent network connection to work, which is also appealing to those frustrated by daily or even hourly downloads of new signatures.

Finding a satisfactory product took Dell security experts more than a year. There are a lot of new companies that are trying different approaches to stopping malware and advanced attacks, and Dell looked at products from more than 60, Hansen said.

Most were the same, using a combination of cloud computing, heuristics and behavioral analysis. They couldn�t guarantee that a computer wouldn�t get infected, but did say they could detect and remediate it, Hansen said.

That wasn�t good enough, and Dell was looking for something that would prevent machines from getting infected in the first place. One of the common complaints from Dell customers is that they spend an inordinate amount of time answering helpdesk calls about infected computers.

Cylance�s Protect was tested by Dell�s SecureWorks, the company�s crack security division. SecureWorks put about 200 samples of the most effective malware and exploits together on a USB stick and was impressed with how Protect handled it, Hansen said.

Dell used a signature-based antivirus product in the first version of Data Protection Endpoint Security Suite, which Hansen declined to name. The second version of the suite, which will be released early next year, will still have that kind of product, along with Cylance�s.

But Hansen said he expects over time that as customers see how Protect works, they�ll be �more than happy� to drop signature-based malware detection.

It's really, really hard to find comparison details on them and this article that came out in November was as close as I could find at the time to talking about how "well" it "worked".

# ¿ May 5, 2016 17:49

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Related, but how many of you are using FireEye HX at all?

I don't care about the other FireEye products for this response.

# ¿ May 5, 2016 21:59

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

BangersInMyKnickers posted:

A patch for that particular CVE has already been pushed via the update channel which is why they are disclosing it now. Check for version 1.1.1.4 of eng.sys/eng64.sys. The bigger issue is what the hell is going on with their coding standards where they think it is 1) acceptable to unpack malware in the kernel and 2) disable buffer security checks at compile because more eyes are going to be looking at their products for low hanging fruit after this and they won't bother disclosing it like Tavis did.

I have yet to see how AV improves security but what do I know. :rolleyes:

# ¿ May 17, 2016 17:05

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

andrew smash posted:

So I stumbled into a pretty glaring security flaw in a medical licensing board's Web portal by doing nothing more nefarious than trying to reset my password. Any idea how I should go about reporting this?

Is this the US?

# ¿ May 17, 2016 20:55

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

andrew smash posted:

Yes

Is it run by the state or is it private?

# ¿ May 17, 2016 21:21

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

PeppysDilz posted:

I disagree. An OS firewall that blocks/alerts you when a new process attempts an outbound connection (like LittleSnitch on OSX) is very valuable. I know GlassWire works for this use case, but who knows if you should trust it, give Tavis 20 minutes with it and we might find you introduced new attack surface. So basically just stop using Windows :-P.

The only time I tell people to stop using Windows is when they tell me they're too paranoid to use Bitlocker because "it's closed source".

# ¿ Jun 5, 2016 18:45

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

the real blah posted:

I'm not sure of the best way to word this, but does anyone have a good tool for letting me test what ports are open through a firewall when I have no control of the firewall, but have control of both sides?

I keep asking my company's firewall team to open a large number of ports between ranges, but they keep only doing half of what I ask and I don't find out until another group comes to me and asks "Why doesn't SNMP or some such work for device in range A, but does for device in range B?" and I find out security only half did the request. I have a bunch of monitoring/jump servers (outside) and a bunch of managed devices (inside) from a crap ton of different vendors. The issue is not every device "behind" the firewall uses every port and I can't even get a good list of which ones need what. My plan is to have laptops or something set up behind the main firewalls and nmap from some important servers outside. I can do a full tcp/udp port scan from the outside servers, but I am looking for something to listen on all TCP and UDP ports on the inside and report what can TCP handshake and what can be received via UDP. I think I will also need to test in the other direction.

A buddy showed me http://portspoof.org/ which looks like it can get me TCP. Does anyone have something similar for UDP, or a better tool, or am I XYing this problem?

http://scanme.nmap.org/

Run nmap against this.

# ¿ Jun 15, 2016 22:13

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

wyoak posted:

AV vulnerabilities are especially scary because of things like filter drivers and because they run with system/root privs - most vulns require the user to actually do something to get infected and run at the user level.

# ¿ Jun 30, 2016 15:22

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Just another reminder of why LastPass is garbage:

https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/

# ¿ Jul 27, 2016 15:18

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

flosofl posted:

There's this from Tavis last night:
https://twitter.com/taviso/status/758143119409885185

Separate vulnerability likely but yeah. LastPass is literal garbage.

# ¿ Jul 27, 2016 15:26

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

PBS posted:

Seems as simple as not having autofill on. I have lastpass set so I manually fill username/password fields.

So what will you do for the next vulnerability?

# ¿ Jul 28, 2016 02:00

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

PBS posted:

I sent them an email asking them to stop having vulnerabilities, I'm pretty sure all potential issues will now be resolved.

I sent similar emails to Oracle, Microsoft, Adobe, Cisco, and Apache as well. I like to try to be proactive.

I don't think that you understand the problem with LastPass.

# ¿ Jul 28, 2016 02:18

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

PBS posted:

Other than being a big juicy target maybe I don't.

Seems like few devs actually give a poo poo about security, and internally everything is somehow a shitshow with walls thrown up around it.

From my viewpoint no known major compromises for as long as they've been around given the target on their back is decent. Are you aware of an exact alternative that you'd consider to be more secure? If yes, can you explain your reasoning?

I value your opinion if you care to expound.

Here's the thing: LastPass cannot be audited without having to sign an NDA. You have no idea about the server-side aspect of how it runs and there have been far many problems. Nobody in here will be able to tell us how the server-side works and any suggestion that they're confident that they have made things secure is kidding themselves and are really giving charlatan-level advice.

1Password and KeePass are more than fine especially when you combine it with a cloud synchronization service like Dropbox, OneDrive, et cetera. Yes. Those services have problems in themselves, but if LastPass is breached in the right way (it's more than the cryptography we have to worry about here), all the passwords are going to be exposed. If someone gets their hand on a bunch of 1Password or KeePass databases, they're going to have to crack each individual file to get anything.

KeePass and 1Password can rely on the length of time between now and long-past the heat death of the universe to protect your passwords if you don't set a lovely master password. LastPass just needs one simple breach and thousands upon thousands of users are going to be hosed.

This is not the first LastPass problem nor will it be the last.

Lain Iwakura fucked around with this message at 02:49 on Jul 28, 2016

# ¿ Jul 28, 2016 02:42

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

PBS posted:

I appreciate the reply.

In summary, you're saying that any company that provides a service exactly like lastpass's would be considered similarly a bad decision to utilize?

Realistically, what separates lastpass from any other company that I have to place a fair amount of trust in to keep my money/information/etc secure? (If anything beyond the obvious that it stores my passwords for all other services)

Yes. Anyone who follows the same model like LastPass is likely to have the same problem.

As with all cloud-based services, you have to rely on someone else to ensure that your data does not get exposed either through incompetence or by an oversight in the design--so far LastPass has yet to achieve defending itself from either. Again, you still run the risk by sharing your password databases on a cloud service, but you gain more control over mitigating the effects because you can rely on the format of the 1Password or KeePass files to ensure that the passwords stay safe--I'd still change all the passwords if my KeePass file or whatever was exposed, but it buys you a near infinite amount of time provided that the password set for the database is good enough.

LastPass cannot provide you that level of security at all.

# ¿ Jul 28, 2016 03:01

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

doctorfrog posted:

I say this as an outsider who doesn't know much, but it seems like you have to balance minimizing risk with butthole-tight/no compromises security with just getting on with your life.

The problem with assessing risk is that it's not black and white like you think it is.

If you're putting all of your financial-related account details into LastPass, who do you get to compensate you when there is an incident that is directly the fault of them? If LastPass suffers a heavy enough breach (similar in style to say Juniper's code injection) where it bankrupts LogMeIn, will your bank be of help? Can you sue LastPass if a vulnerably arises and you are directly affected by it in the same manner?

These are questions that need to be answered before you even begin to assess the actualy risk you take by using something like LastPass. It's the same reason why I am waiting for the day that a bank opts to not compensate someone because they got their PC infected--London's police chief seems to think that this should be the case.

1Password and KeePass are not overly complicated nor a "no compromise" method of security.

Besides, I don't put my online banking details into my password manager and it's one of three that never will end up in there.

# ¿ Jul 28, 2016 21:02

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Boris Galerkin posted:

Since everyone hates virus scanners here, what do I do about Windows Defender? Leave it on or turn it off?

Also I noticed in my github account I have an option to upload a pgp key but I'm not really sure what this is. Is this just basically like having a second ssh key I need to babysit?

Just leave it on but don't waste money on another product.

As for PGP/GPG, it's there for verification that what you published is your code just to prevent tampering. It's trivial to falsify who you are in Git, so signing the commit adds a level of verification.

# ¿ Aug 10, 2016 16:06

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://wicg.github.io/webusb/

# ¿ Aug 11, 2016 17:20

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Windows and Linux are no different in terms of how "secure" they are but certain things are approached differently in each.

# ¿ Aug 21, 2016 05:01

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

It's as if a company wants to integrate a product they bought for billions into their own. The horror!

Also if you're using your fingerprint to unlock your phone, security is taking a backseat in your mind anyway.

# ¿ Aug 25, 2016 17:35

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Mustache Ride posted:

I think he was talking about hardware fingerprints like user agents and device metadata, not your actual fingerprint.

At least I hope he was, how the hell would whatsapp have access to your stored fingerprint info?

The thing about WhatsApp is that the conversations are kept private but there is no expectation that the meta data is. I am not sure why ItBurns fails to grasp the difference between the two.

# ¿ Aug 25, 2016 18:02

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Mustache Ride posted:

Back in the day the messages weren't even encrypted. They were stored in a plaintext database on the iPhone and relied solely on the iPhone's encryption to protect it (hah!). I haven't had to run a forensic case on an iPhone in a while, I wonder how much that has actually changed.

Realistically the important thing here is not what is being done with the data at rest but what is being done with the data in transit. If the data is not being encrypted in transport, then there is little need to go and try and get your hands on your target's device. However, if you got your hands on the target's device, then what's to stop them from doing things like extracting the data out of memory or if the device is already unlocked? The iPhone is an example of where this is a problem, but it hasn't stopped the FBI in the past if the circumstances are right (this is not the secure enclave stuff).

ItBurns posted:

Don't be obtuse. It's a relevant development and a significant reversal of their position (and a few poster's own positions) with regard to sharing identifying info with FB and by proxy advertisers and law enforcement where the (now) encrypted messages can be stored until/if an attack on the encryption is found.

What does it matter? You're using a third-party messaging application operated by a company that has a profit incentive. At the very least they encrypt the traffic going through their servers and there is no expectation that the meta data is obfuscated anyway.

# ¿ Aug 25, 2016 18:23

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Wiggly Wayne DDS posted:

Great so what does this have to do with infosec? Your privacy is a different subject entirely and you can go yell about it in D&D.

It goes over the heads of people like ItBurns that these companies have profit incentives and aren't charities. It also doesn't help that he cannot the difference between information security and privacy.

When I made the remark about pr0zac, I was talking about the encryption aspect of WhatsApp, not whether or not Facebook is going to integrate WhatsApp into its product ecosystem. But ItBurns wasn't able to elaborate much more than just taking stuff out of context because he doesn't really understand anything to begin with.

# ¿ Aug 25, 2016 18:35

Adbot: ADBOT LOVES YOU

# ¿ May 12, 2024 08:44

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Rufus Ping posted:

this was the assumed threat model all along - it is precisely because you don't trust all third parties not to do this that you're using e2e in the first place

whatsapp and other third parties not having access to metadata etc was never in scope unfortunately

Now be careful there or you'll end up with a new custom title that will be very mean.

The problem with a lot of individuals is that they quickly conflate privacy and security and assume that they're one in the same. They're two complete separate topics and those who work in the field are able to recognize that. From a security perspective, WhatsApp is doing it right and is making it so you cannot snoop in on messages in transit; from a privacy perspective, WhatsApp is revealing who your contacts are and other meta data to the rest of the Facebook infrastructure, which includes potential advertisers, meaning that the messaging service is not exactly ideal.

If you're concerned about WhatsApp--a privately-run service intended to somehow make money--making use of the data that exists within your account, perhaps WhatsApp was never meant for you to begin with? Like really while I recommend Signal instead (which uses the same cryptography framework as WhatsApp), the idea that you can entrust Moxie Marlinspike to always be on the side that we all would prefer is really asinine and that any concern you have over meta data leaking needs to be addressed in a completely different threat model.

Like use Signal over WhatsApp but if you're looking for complete privacy over who you converse with online, that is a whole different kettle of fish and realistically you cannot completely rely on third parties to provide adequate privacy. But be aware of when you're conflating things because it makes you look dumb.

# ¿ Aug 26, 2016 02:01

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Infosec Thread: Yes, time to move off Entrust

«‹›8 »