8 ms·
Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password pro
by schmichael 6y ago
Password protection may have been used to bypass antivirus and other filters. While you should treat dumps like this with a lot of suspicion, treat password protected zips with a heaping dose of care as they may have been used to evade automated defenses.
- ccurrens 6y agoThat's an excellent point I wouldn't have considered. I have no intention of looking at the dump anyway, but thanks for the warning.
- 1-6 6y agoI think the proper term is Honeypotting.
- deleted 6y ago[deleted]
- pjc50 6y agoYes - but not for hostile purposes, but because your own company's antivirus won't let you mail an executable to a colleague.
- marcosdumay 6y agoUsually this. Or in my workplace, an image. Antivirus are some crazy shit that may trigger on any random action and will teach people to follow the most unsafe procedures without questioning, so they can get anything done.
- myself248 6y agoI've heard it put this way: If you force users to trade convenience for security, they will find a way to obtain convenience at the expense of security.
- hinkley 6y agoIf you make it harder for people to do the right thing than the wrong thing, they will choose the wrong thing. This has been brought up a million times in the context of DRM, but it is true in the general case as well.
- tombert 6y agoI could be mistaken on this, but wasn't this basically the sales pitch for Spotify? Basically saying "you'll never get rid of piracy, but you can compete with it".
- setr 6y agoNot sure about Spotify, but I know gabe newell had famously made basically this argument, in regards to steam's success
- danudey 6y agoThis was the sales pitch for iTunes and the iTunes store: "We approached it as 'Hey, we all love music.' Talk to the senior guys in the record companies and they all love music, too. … We love music, and there's a problem. And it's not just their problem. Stealing things is everybody's problem. We own a lot of intellectual property, and we don't like when people steal it. So people are stealing stuff and we're optimists. We believe that 80 percent of the people stealing stuff don't want to be; there’s just no legal alternative. So we said, Let's create a legal alternative to this. Everybody wins. Music companies win. The artists win. Apple wins. And the user wins because he gets a better service and doesn't have to be a thief." https://www.esquire.com/news-politics/a11177/steve-jobs-esquire-interview-0703/ https://www.esquire.com/news-politics/a11177/steve-jobs-esqu... Another point of reference: because they had no legal ground to stand on, HBO targeted Canadian torrenters of Game of Thrones with an e-mail saying, among other things, "It's never been easier to [watch Game of Thrones legally]!" This was true, it had never been easier. It had also never been harder. For the entire time that Game of Thrones was being aired, the only legal way for Canadians to watch it was to pay about a hundred dollars per month for cable and the cable packages that would give them HBO. You could buy it on iTunes, but only as a season, after the season was over. So yeah, I kept torrenting it, everyone I know kept torrenting it, and everyone hated (or laughed at, or both) HBO the whole time.
- sjg007 6y agoAntiviruses will quarantine compiler output...
- AlotOfReading 6y agoAt one company, Symantec would also quarantine the compiler and build system. It certainly made builds exciting to have the antivirus playing Russian roulette with the entire toolchain.
- Spooky23 6y agoOf course many places have replaced dopey AV with creepier advanced tools like ATP or CrowdStrike.
- mcdevilkiller 6y agoEvery time I went to configure a toolchain on Jetbrains' CLion, Cmake would create some test files and compile them. Windows Defender deleted every file and even the embedded toolchain. Fun :)
- silverdemon 6y agoThis 100%. I recall many a fun night at $BIGCORP burning the midnight oil, receiving the warning emails that my "unauthorised software" had been reported to my manager, and that it had been quarantined away for my own safety and convenience. Given that $BIGCORP was a tech firm my manager would be intensely delighted that they would receive regular midnight notifications that I was doing my job. Whatever that damn thing cost it would have been cheaper to let the malware do its thing.
- nine_k 6y agoWindows development seems to be fun as of recently. Didn't touch it for couple of decades. Sometimes I think that modern Windows is a nice platform already, even comfortable. (Like, you know, C++17 is very unlike C++98.) But then I'm reminded of the necessity to run an antivirus in front of it in a corporate environment.
- TheSpiceIsLife 6y agoLet’s call a spade a spade. Antivirus software is malware.
- stefan_ 6y agoYour company's antivirus, or GMail. A binary? A zip with a binary? Nuh-uh.
- Delk 6y agoTo be fair, emailing binaries (apart from known types such as images, PDFs, etc.) is a rare enough use case for legitimate purposes and an easy enough way of spamming malware to clueless random people that it's probably a reasonable default for gmail. Having an option to allow them might be okay though. (I barely use gmail so I don't know if it has one or not.)
- sjg007 6y agoAh you must be young...
- totetsu 6y agofor not using gmail? The hooked me in school
- Alekhine 6y agoHe means there used to be a time when people would mail binaries to each other more often, before they got too big and DRM'ed for that.
- bawolff 6y agoThere was also a time when alt.binaries was a thing (technically not email, but usenet is pretty similar)
- Nasrudith 6y agoFor not sending binaries by email - there is no shame to being young in this case as it means never developing the bad habits. Before Dropbox and similiar it was far more a norm and various file sharing systems like SharePoint may wind up not actually used. Non-computer technical people often do so in companies all the time and practically use it as an ersatz version control system to the cringe of IT.
- danudey 6y agoIn February, I e-mailed a python script to one of our developers to help debug an issue with their SSL configuration. Two days ago, I needed the script again but couldn't find it. Went to our e-mail thread and it said "the following potentially malicious attachments were blocked", showing mine, but... even from my outgoing mailbox? That seems ridiculous and problematic, considering that it sent fine at the time. I know that e-mail shouldn't be used as a replacement for Sharepoint or Dropbox or whatever, and I should have a local copy of what I need, but it just seems annoying and arbitrary. Anyway, I just logged into Outlook Web and downloaded it from the message there. Problem solved.
- dillonmckay 6y agoThis has happened to me with gmail. Zipfiles I had sent in the past are no longer allowed to be downloaded from my sent items folder through the standard interface.
- majewsky 6y agoIf I had to deploy AV for mail, I would absolutely scan outgoing mail as well. Imagine if some compromised mail account in my org sends malware to accounts in other companies. These companies could then sue my company for negligence if they can show that we did not scan our mail for viruses on outbound (which could potentially be done by examining mail headers). (I am not a lawyer.)
- hnick 6y agoWe just rename our files with .novirus on the end. I assume the main point is to stop executables from outside running with a click, or internal forwards of the same by compromised users which is why it's so easy to bypass.
- swiley 6y agoShouldn’t you put it in either eg artifactory or a code repo?
- somehnguy 6y agoYes. Whenever I email or transfer a zip via any method really I always put a basic password on it. I've been bitten way too many times by dumb filters that pick some file out of the zip and declare that it is malicious. I also don't trust messenger apps to not pull my files out and do who knows what with them. A basic password prevents this junk 99% of the time for almost no effort. It won't stop a determined system from cracking the password. But that isn't what I'm trying to defend against.
- saagarjha 6y agoGmail doesn't seem to like archives it can't open :/
- blue52 6y agoLol wonder why?
- neltnerb 6y agoAh, the halcyon days of merely changing the file extension from .exe to .txt...
- jon-wood 6y agoThis brings back happy memories of a college (senior high for the Americans in the audience) computing teacher finding a friend and I had been writing irritating malware instead of doing actual work, and his only comment being “if you’re going to email that to yourself change the extension so it doesn’t get flagged for IT support”.
- j1elo 6y agoGmail won't even let you send a JAR file, or a zip you made out of a project where it happens to be a .jar file somewhere deep in some random subdirectory.
- Spooky23 6y agoIIRC, You can do it by embedded the content into an Office file, which is a zip file.
- lmilcin 6y agoI have left Intel couple of years ago, that's exactly what passwords were used for. It was pretty annoying to try to send files and putting them in encrypted archive wast the most convenient method. It was not just for binaries but for scripts, html, etc.