5 ms·
To be fair, this does look like a false positive. In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some o
by john_moscow 5y ago
To be fair, this does look like a false positive.
In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software.
If you don't qualify as a "mainstream software vendor", simply building a random piece of code into an exe file will get you about 10% chance of getting flagged by one of the "heuristic engines" if you upload it to VirusTotal.
You can contact the A/V vendor and they will usually add it to the whitelist, but it only lasts until the next rebuild. Or you can rebuild it a couple of times with different optimization levels, and the detection sometimes goes away.
- howaboutnope 5y agoDeleting both the exe and the source code makes a false positive seem rather unlikely to me.
- jcrawfordor 5y agoThe source code in question appears to have been obfuscated (possibly just for brevity). I'd guess the Defender signature in question was written around the packer/obfuscator.
- eurasiantiger 5y agoWanna bet the signature is the hex key?
- jcrawfordor 5y agoyeah, that'd be my guess. It's going to be in different representations in the source and the executable but if I was writing a signature for it straight up I'd probably add the C escape representation as well for good measure.
- deleted 5y ago[deleted]
- kwonkicker 5y agoI don't care how broad your definition is, it shouldn't include the mp4 files in my hard drive.
- geofft 5y agoEr, doesn't that assume that the mp4 files on your hard drive can't genuinely be infected with viruses? Why is that assumption true?
- Xylakant 5y agoEspecially given how common media files are as an attack vector.
- gruez 5y agoAre they? Compared to other forms (eg. trojans or browser/os 0days) they're not really common. I suspect you have a better chance of getting infected from a site asking you to download a "codec", than you have of the site serving you a malformed media file.
- Xylakant 5y agohttps://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jpeg returns 390 results. And that’s jpeg alone. It’s fairly common that you see some sort of media file format parsing bug to lead to command execution.
- gruez 5y agoBut how many of those are actually exploited, and how does that compare to the other vectors I mentioned? Media file exploits seem in same class of exploits as spectre/rowhammer. You hear about them often (not as often as spectre/rowhammer, but I frequently see security fixes being mentioned in media player changelogs), but you rarely hear about attacks that use them.
- 5y ago
- eru 5y ago> In general, the desktop antivirus space in 2021 is a mess. Because of the sheer number of malware, and some obfuscation techniques used by some of it, antivirus software has to use very broad regular expressions for describing the malware, counterbalanced by huge whitelists of known mainstream software. Why do they have to use regular expressions?
- zinekeller 5y ago"Regular expressions" as a concept, not PCRE regex.
- eru 5y agoIn the sense of https://en.wikipedia.org/wiki/Regular_language https://en.wikipedia.org/wiki/Regular_language ? That's even more restricted than PCRE regex. (Which is often a good thing, but not sure about here.)
- integricho 5y agoI don't believe they use regular expressions.
- pmalynin 5y agoWhy not? I.e. is that from experience on working on anti malware remediation systems?
- eurasiantiger 5y agoWhat would it match against? ASCII strings? Add a whitelisted string and make your malware pass. The heuristics are much more complex than that, cf. spamassassin rules.
- pwdisswordfish8 5y agoOpcode sequences. Regular expressions may be applied to any formal language, not just ones based on human-readable alphabets.
- eurasiantiger 5y agoThat kinda makes sense, thanks. However, wouldn’t this kind of heuristic be extremely simple to counter by obfuscating the machine code, e.g. by inserting complex noops and using threaded subroutines which individually look innocuous? Or, are this kind of techniques looking at known syscall patterns or something like that, and ignoring the general program flow? To me, regex doesn’t seem applicable to static analysis of machine code, but what do I know :)
- dannyw 5y agoantiviruses are composed of multiple systems and techniques. Regexp is just one.
- eurasiantiger 5y ago
- RcouF1uZ4gsC 5y ago> In general, the desktop antivirus space in 2021 is a mess. I don’t think that antivirus is helpful in 2021. I think the most important thing you can do is make sure you are all patched and do not run as administrator. Antivirus is likely to be unable to catch the really bad stuff, and it actually increases your attack surface. In addition, you pay a performance tax all the time. IMO, just not worth it.
- kmonsen 5y agoThe thing is, malware vendors can do the same. At least for zero day attacks you just test them on the target’s antivirus to make sure it will not discover the malware.
- icare_1er 5y agoThe amount of false-positives with WinDef is insane, it's pretty much like any desktop link to as shared drive is considered malware right of the bat without even inspecting it. Let alone documents with macros... Having said that, I wouldn't want to be one of those having to implement detection logics because the malware jungle is so creative that it's pretty much an impossible job they have to do.