4 ms·

Cb has responded - https://www.carbonblack.com/2017/08/09/directdefense-incorrectly-asserts-architectural-flaw-in-cb-response/ https://www.carbonblack.com/2017/

by strunz 9y ago

Cb has responded - https://www.carbonblack.com/2017/08/09/directdefense-incorrectly-asserts-architectural-flaw-in-cb-response/ https://www.carbonblack.com/2017/08/09/directdefense-incorre...

stedaniels 9y ago
Whilst they obviously try and refute the minor details Direct Defense gets wrong, their product should be warning their end users just a little more strongly for such a devastating "feature". This is data protection officers nightmare. If any UK company has this turned on the ICO could rake them over the coals and charge them millions in fines (if they had the teeth).
- jwcrux 9y ago
  I disagree. I think Carbon Black's disclaimer is more than sufficient: The screenshot in Carbon Black's response clearly says that VirusTotal "makes the binaries available for download to their partners". And here's the relevant text in the disclaimer: > You are hereby advised (i) VirusTotal makes the metadata publicly available along with scan results from dozens of anti-virus products and (ii) VirusTotal also makes the files available to VirusTotal partners. You must determine whether to elect to enable this feature at your sole discretion. And the warning also has this text in bold: > If you have custom business applications with confidential business information on your network, sharing binaries with VirusTotal may not be appropriate for you. With this being optional and off by default, I think it's on the customer to read the clear warning presented and make the call that's right for them.
  - bluesign 9y ago
    Sharing with Virustotal is not same as sharing it with ‘anyone’ i suppose, possibility of downloading files is not acceptable.
    - jwcrux 9y ago
      I believe their characterization is accurate. Not just anyone can download files from VT. You have to have access to their private API which is a premium billed (and anecdotally very expensive) service.[0] That, to me, qualifies the term "VirusTotal and their partners" as accurate, since this is only a select group of companies who are paying VT a large sum for access to the data. [0] https://www.virustotal.com/en/documentation/private-api/#file-feed https://www.virustotal.com/en/documentation/private-api/#fil...
      - user5994461 9y ago
        Cool, so you can pay a bit of money to get the AWS keys, ssh keys and thousands of top secret credentials from the fortune 500. Whatever number they charge, it is negligible for the trove of data you'll get!
exikyut 9y ago
I think this response is the kind of thing that goes with the "7 million+ software licenses sold, almost 2,000 customers worldwide" text noted in the article. This response does not hide the concrete facts of the situation, which I do think remains an unresolved problem. First of all, https://www.virustotal.com/en/documentation/private-api/ https://www.virustotal.com/en/documentation/private-api/ does not mention any prices. It says to get in touch. Boring. So I decided to try googling "virustotal private api cost", and bingo: I found a quote in the Hacking Team emails :D - https://wikileaks.org/hackingteam/emails/emailid/16069 https://wikileaks.org/hackingteam/emails/emailid/16069 As of 2013 - 5 years ago - the prices were: - 300 searches and downloads per month ... 500 EUR per month - 1,000 searches and downloads per month ... 1,000 EUR per month - 5,000 searches and downloads per month ... 2,000 EUR per month - 15,000 searches and downloads per month ... 3,000 EUR per month - 30.000 searches and 30.000 downloads per month .... 4,700 euros per month. - Unlimited searches and downloads per month... 8,250 euros per month For a somewhat more recent comparison, https://developers.virustotal.com/v2.0/reference#public-vs-private-api https://developers.virustotal.com/v2.0/reference#public-vs-p... notes that the private API allows just 4 requests per minute. Sounds like that could be the default tier and that things have gotten a lot more expensive over the past 5 years. ($10k per month in 2013... maybe it's double that now? Nice spare change for Google, eh - VirusTotal is a Google company.) But, once you sign up, you get access to a feed (https://developers.virustotal.com/v2.0/reference#file-feed https://developers.virustotal.com/v2.0/reference#file-feed) API call that will give you a JSON array of the last 24 hours' worth of uploaded files. Each item in the array includes a file download link, which you can fetch. There's also https://developers.virustotal.com/v2.0/reference#url-feed https://developers.virustotal.com/v2.0/reference#url-feed, the feed of all URLs scanned. This is less straightforward in terms of "we got 5000 passwords and keys today, woohoo" because the chances are (hopefully...) that the URLs being scanned are setup to let VirusTotal through but not anyone else. That said, this would likely give you valuable intel into internal network structures and so forth. (And, who am I kidding, a disconcerting number of organizations are going to have the areas surrounding the upload infrastructure horribly misconfigured.) I can totally see the standpoint of this report. This IS a pay-to-play data exfiltration system. You get everything. Regardless of who you are.

by strunz 9y ago

Cb has responded - https://www.carbonblack.com/2017/08/09/directdefense-incorrectly-asserts-architectural-flaw-in-cb-response/ https://www.carbonblack.com/2017/08/09/directdefense-incorre...

stedaniels 9y ago

Whilst they obviously try and refute the minor details Direct Defense gets wrong, their product should be warning their end users just a little more strongly for such a devastating "feature". This is data protection officers nightmare. If any UK company has this turned on the ICO could rake them over the coals and charge them millions in fines (if they had the teeth).

jwcrux 9y ago
I disagree. I think Carbon Black's disclaimer is more than sufficient: The screenshot in Carbon Black's response clearly says that VirusTotal "makes the binaries available for download to their partners". And here's the relevant text in the disclaimer: > You are hereby advised (i) VirusTotal makes the metadata publicly available along with scan results from dozens of anti-virus products and (ii) VirusTotal also makes the files available to VirusTotal partners. You must determine whether to elect to enable this feature at your sole discretion. And the warning also has this text in bold: > If you have custom business applications with confidential business information on your network, sharing binaries with VirusTotal may not be appropriate for you. With this being optional and off by default, I think it's on the customer to read the clear warning presented and make the call that's right for them.
- bluesign 9y ago
  Sharing with Virustotal is not same as sharing it with ‘anyone’ i suppose, possibility of downloading files is not acceptable.
  - jwcrux 9y ago
    I believe their characterization is accurate. Not just anyone can download files from VT. You have to have access to their private API which is a premium billed (and anecdotally very expensive) service.[0] That, to me, qualifies the term "VirusTotal and their partners" as accurate, since this is only a select group of companies who are paying VT a large sum for access to the data. [0] https://www.virustotal.com/en/documentation/private-api/#file-feed https://www.virustotal.com/en/documentation/private-api/#fil...
    - user5994461 9y ago
      Cool, so you can pay a bit of money to get the AWS keys, ssh keys and thousands of top secret credentials from the fortune 500. Whatever number they charge, it is negligible for the trove of data you'll get!

exikyut 9y ago

I think this response is the kind of thing that goes with the "7 million+ software licenses sold, almost 2,000 customers worldwide" text noted in the article. This response does not hide the concrete facts of the situation, which I do think remains an unresolved problem. First of all, https://www.virustotal.com/en/documentation/private-api/ https://www.virustotal.com/en/documentation/private-api/ does not mention any prices. It says to get in touch. Boring. So I decided to try googling "virustotal private api cost", and bingo: I found a quote in the Hacking Team emails :D - https://wikileaks.org/hackingteam/emails/emailid/16069 https://wikileaks.org/hackingteam/emails/emailid/16069 As of 2013 - 5 years ago - the prices were: - 300 searches and downloads per month ... 500 EUR per month - 1,000 searches and downloads per month ... 1,000 EUR per month - 5,000 searches and downloads per month ... 2,000 EUR per month - 15,000 searches and downloads per month ... 3,000 EUR per month - 30.000 searches and 30.000 downloads per month .... 4,700 euros per month. - Unlimited searches and downloads per month... 8,250 euros per month For a somewhat more recent comparison, https://developers.virustotal.com/v2.0/reference#public-vs-private-api https://developers.virustotal.com/v2.0/reference#public-vs-p... notes that the private API allows just 4 requests per minute. Sounds like that could be the default tier and that things have gotten a lot more expensive over the past 5 years. ($10k per month in 2013... maybe it's double that now? Nice spare change for Google, eh - VirusTotal is a Google company.) But, once you sign up, you get access to a feed (https://developers.virustotal.com/v2.0/reference#file-feed https://developers.virustotal.com/v2.0/reference#file-feed) API call that will give you a JSON array of the last 24 hours' worth of uploaded files. Each item in the array includes a file download link, which you can fetch. There's also https://developers.virustotal.com/v2.0/reference#url-feed https://developers.virustotal.com/v2.0/reference#url-feed, the feed of all URLs scanned. This is less straightforward in terms of "we got 5000 passwords and keys today, woohoo" because the chances are (hopefully...) that the URLs being scanned are setup to let VirusTotal through but not anyone else. That said, this would likely give you valuable intel into internal network structures and so forth. (And, who am I kidding, a disconcerting number of organizations are going to have the areas surrounding the upload infrastructure horribly misconfigured.) I can totally see the standpoint of this report. This IS a pay-to-play data exfiltration system. You get everything. Regardless of who you are.