4 ms·

I'd also be curious what happens if you rename them to {not-keygen}.exe I'd hope it wouldn't make a difference, but my experience with IT security thinking mak

• httpsterio 5y ago
  It sadly doesn't make a difference. I have about a dozen keygens on my machine and they get quarantined unless they're zipped behind a password or zipped into a 7z. Just downloading a zip with a keygens inside, it gets removed from the zip before even unarchiving it.
  • ethbr0 5y ago
    Also, AFAIK by spec, the manifest of a zip file is unencrypted, even if the zip "is". Most scanners are too brain dead to care, but I have come across a few that still quarantine if the manifest lists a file with a blacklisted extension. Easy solution? Compress to zip, then compress that zip to another zip, with a password. (Yes, I've spent far too long trying to get work done underneath insane corporate security policies)
    • 13of40 5y ago
      Gmail will block you from sending a a password-protected ZIP with anything potentially bad in it, like an EXE, because they can see the individual file headers and central directory, like you say. Unfortunately, if you have a ZIP inside a passworded ZIP it also gets considered dangerous and blocked.
      • josephcsible 5y ago
        Here's a workaround: rename the .exe file to a .txt file, then put that in a password-protected zip file. Now braindead security scanners have no choice but to believe that it really is a text file.
• indigochill 5y ago
  Yeah, I once circumvented gmail's antivirus detection by sending a (perfectly legitimate) installer executable as a txt file because gmail apparently just has/had a strict "no files with certain extensions" policy. And IIRC Zendesk applies the same rule to file attachments on support tickets. I had pitched for my team to build a tiny widget that would send attachments to virustotal, but it would have required a license for commercial use and we never had a security incident with files coming into our support center so it never became a priority.
  • atatatat 5y ago
    > we never had a security incident with files coming into our support center ...that you are aware of.
  • tinus_hn 5y ago
    While this may sound like a dumb policy, the end result is exactly what you want, a system that makes it impossible to have you download executables without you being aware.
  • Hjfrf 5y ago
    Can confirm that ServiceNow and Outlook have the same workaround.
• kozak 5y ago
  I renamed it into {not-keygen}.{not-exe} instead. I didn't investigate the issue in details, but I think that Microsoft expects a more enterprisey file name for a legitimate keygen. I should have called it something along the lines of CredentialManager.exe instead :) But I wonder whether it did auto-submit these files to Microsoft together with my private keys. I'm glad that the private keys were in config files outside of the executables, and this probably saved them from being compromised.
  • doubled112 5y ago
    If everybody started renaming keygens to CredentialManager.exe, would the learning algorithms the AV companies are using start to flag and delete those .exes too? No way, right? What could go wrong?