3 ms·

I can’t upvote this enough. An heuristic will always be an heuristic, it does not matter of which kind or what you are looking at. These products are not determ

I can’t upvote this enough. An heuristic will always be an heuristic, it does not matter of which kind or what you are looking at. These products are not deterministic and they give you no assurance whatsoever.

dogma1138 6y ago
To add to how simplistic their heuristics are we had a demo of one of the mentioned above ransomware detection. Their demo was about 2 hours long, during it I’ve written my own ransomware in a few lines. It used cipher.exe a command line utility that allows you to encrypt files, with about 5 lines of a batch script (well it was pinvoke in my case) I had a ransomware that would encrypt all document files in the user’s home directory with a new EFS cert, generate an EFS recovery agent and upload it to a webdav share, delete the EFS certificate from the system, then using the same cipher.exe utility secure wipe option (/w) nuke the file system and overwrite all deleted data to make both forensics and recovery near impossible. Since cipher.exe is a signed Microsoft executable it wasn’t detected. Their response was that they haven’t seen malware use this before and they were looking for windows crypto API calls, CPU metrics and other nonsense and assured us that it’s highly unlikely that anyone would use built-in command line utilities when compromising our network.
- sb23 6y ago
  Seems like if it were feasible it would already be being used by malware authors. Why would they not already be using cipher.exe?
  - dogma1138 6y ago
    Some do, at least according to Sophos https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap... And why would not re-inventing the wheel be a problem that malware developers have solved? ;)

3 ms·

I can’t upvote this enough. An heuristic will always be an heuristic, it does not matter of which kind or what you are looking at. These products are not determ

by tgragnato 6y ago

dogma1138 6y ago
To add to how simplistic their heuristics are we had a demo of one of the mentioned above ransomware detection. Their demo was about 2 hours long, during it I’ve written my own ransomware in a few lines. It used cipher.exe a command line utility that allows you to encrypt files, with about 5 lines of a batch script (well it was pinvoke in my case) I had a ransomware that would encrypt all document files in the user’s home directory with a new EFS cert, generate an EFS recovery agent and upload it to a webdav share, delete the EFS certificate from the system, then using the same cipher.exe utility secure wipe option (/w) nuke the file system and overwrite all deleted data to make both forensics and recovery near impossible. Since cipher.exe is a signed Microsoft executable it wasn’t detected. Their response was that they haven’t seen malware use this before and they were looking for windows crypto API calls, CPU metrics and other nonsense and assured us that it’s highly unlikely that anyone would use built-in command line utilities when compromising our network.
- sb23 6y ago
  Seems like if it were feasible it would already be being used by malware authors. Why would they not already be using cipher.exe?
  - dogma1138 6y ago
    Some do, at least according to Sophos https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap... And why would not re-inventing the wheel be a problem that malware developers have solved? ;)