4 ms·

tldr; large companies are uploading all their files and executables to Carbon Black to get them white listed as virus-free. The OP reports these uploaded files

by yodon 9y ago

tldr; large companies are uploading all their files and executables to Carbon Black to get them white listed as virus-free. The OP reports these uploaded files are easily discoverable and inspectable by 3d parties and contain large numbers of AWS and Azure private keys, API tokens, and other confidential data.

tyingq 9y ago
"these uploaded files are easily discoverable and inspectable" Any clues as to how they are this way? S3 buckets with credentials the same for all customers or similar?
- julianj 9y ago
  From the article: > One of the useful features of this multiscanner is that they allow searching for similar malware to get some context, and in doing so, we stumbled across a couple of files that were very different. >We noticed that the other files were all uploaded by a similar uploader. It appears they then automated downloading samples and scanned for content. From what I can tell, the files were discoverable by anyone that was able to access/search this multiscanner service. For instance, malwr.com allows the downloading of samples by authenticated users. VirusTotal also allows researchers access to download submissions via their private API[0]. [0] https://www.virustotal.com/en/documentation/private-api/#file-feed https://www.virustotal.com/en/documentation/private-api/#fil...
  - deleted 9y ago
    [deleted]
  - chinathrow 9y ago
    Wow didn't know that. I uploaded a few suspected files to virustotal for a quick check but will have to refrain from doing that in the future.
    - tetrep 9y ago
      If you're comfortable uploading something to a server, you should be comfortable with that server (and any of it's owners/operators) reading it. While I also didn't know those sites let other people download the samples, that doesn't change how much I trust them, since my model has changed from "whatever randos own this website see this file" to "whatever randos own this website, plus whatever randos they appoint, can see this file". In either case, I must trust "whatever randos own this site", and so them delegating that trust shouldn't change much. There's a bit of a grey area around uploading something to a VPS host that you control, but unless you signed an agreement explicitly saying that your stuff won't be looked at, expect it to be. And for the sake of cliche, it's safest to just assume anything you upload to the internet is public. Don't assume otherwise unless you really really need to, and make sure there's at least some legal and/or cryptographic protection for you if you're going that route :)
      - user5994461 9y ago
        Let's not confuse reading a file and reading a file then redistributing it to whoever is willing to pay for it.
PappaPatat 9y ago
The way I read it: large companies use Carbon Black to have all their files and executables to checked for maliciousness. CB then uploads these file to antivirus.com to have them checked against 50 AV engines. VT 'hides' the uploader behind a dedicated API key, in the case of CB: 32d05c66 directdefense then download some of these files from virustotal and found (among a shitload of nothing) sensitive stuff, wrote a blog and blamed CB. With a little more digging they would have found many, many more services and applications that do the exact same thing.

by yodon 9y ago

tyingq 9y ago

"these uploaded files are easily discoverable and inspectable" Any clues as to how they are this way? S3 buckets with credentials the same for all customers or similar?

julianj 9y ago
From the article: > One of the useful features of this multiscanner is that they allow searching for similar malware to get some context, and in doing so, we stumbled across a couple of files that were very different. >We noticed that the other files were all uploaded by a similar uploader. It appears they then automated downloading samples and scanned for content. From what I can tell, the files were discoverable by anyone that was able to access/search this multiscanner service. For instance, malwr.com allows the downloading of samples by authenticated users. VirusTotal also allows researchers access to download submissions via their private API[0]. [0] https://www.virustotal.com/en/documentation/private-api/#file-feed https://www.virustotal.com/en/documentation/private-api/#fil...
- deleted 9y ago
  [deleted]
- chinathrow 9y ago
  Wow didn't know that. I uploaded a few suspected files to virustotal for a quick check but will have to refrain from doing that in the future.
  - tetrep 9y ago
    If you're comfortable uploading something to a server, you should be comfortable with that server (and any of it's owners/operators) reading it. While I also didn't know those sites let other people download the samples, that doesn't change how much I trust them, since my model has changed from "whatever randos own this website see this file" to "whatever randos own this website, plus whatever randos they appoint, can see this file". In either case, I must trust "whatever randos own this site", and so them delegating that trust shouldn't change much. There's a bit of a grey area around uploading something to a VPS host that you control, but unless you signed an agreement explicitly saying that your stuff won't be looked at, expect it to be. And for the sake of cliche, it's safest to just assume anything you upload to the internet is public. Don't assume otherwise unless you really really need to, and make sure there's at least some legal and/or cryptographic protection for you if you're going that route :)
    - user5994461 9y ago
      Let's not confuse reading a file and reading a file then redistributing it to whoever is willing to pay for it.

PappaPatat 9y ago

The way I read it: large companies use Carbon Black to have all their files and executables to checked for maliciousness. CB then uploads these file to antivirus.com to have them checked against 50 AV engines. VT 'hides' the uploader behind a dedicated API key, in the case of CB: 32d05c66 directdefense then download some of these files from virustotal and found (among a shitload of nothing) sensitive stuff, wrote a blog and blamed CB. With a little more digging they would have found many, many more services and applications that do the exact same thing.