4 ms·
What does it mean for the backdoor to be "poorly detected"? I would think "poorly implemented [thus easily detected]" makes sense but not "poorly detected." U
by wyldfire 4y ago
What does it mean for the backdoor to be "poorly detected"? I would think "poorly implemented [thus easily detected]" makes sense but not "poorly detected." Unless maybe this means that the backdoor is so well hidden that it's not detected by backdoor-detectors?
EDIT: yes this does seem to be the case:
> A distinctive feature of SessionManager is its poor detection rate. First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services.
I still can't help thinking that the detection capability lies in the detector(s) and it's not a credit to SessionManager as much as it is a fault of the detectors. Is it just too new to be fingerprinted/identified?
- Natsu 4y agoI mean, a poorly-detected virus has always been one that doesn't get caught by many detectors. It's normally a call for other vendors to pay more attention to it and implement detection.
- weq 4y agoOr maybe its calling people out for intentionally not detecting this backdoor because of whom it benefits?
- ConstantVigil 4y agoPossibly, but it depends on who we are talking about here. Care to elaborate?
- deleted 4y ago[deleted]
- nomilk 4y agoIt seems "poorly detected" means "(many of) those who have it don't know about it" > it is still possible to discover related malicious activities months or years later, and this will probably be the case for a long time
- technion 4y agoOf the variants listed: https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14edf09794fa76a71cb04348d2a332991f3fceab2b https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14... 25/66 detection. Detected by Windows Defender free version if you do nothing but leave it in a default configuration and don't install a competing product. https://www.virustotal.com/gui/file/40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3 https://www.virustotal.com/gui/file/40de45ea45d352703a19c4a5... 30/64, as above detected by Defender https://www.virustotal.com/gui/file/500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686 https://www.virustotal.com/gui/file/500905187d6b2d387fed36c8... 31/67, as above Defender 2410D0D7C20597D9B65F237F9C4CE6C9 - never seen by Virustotal. So yes, it probably has poor detection.
- aasasd 4y agoIsn't detection by about half of the engines the normal state of things on Virustotal?
- technion 4y agoYes, but many of these products are meme products. I'd like to say "No enterprise is running SUPERAntiSpyware on their Microsoft Exchange cluster" but I'm aware of one that is. In general though, half the engines is actually a place where I'd dispute the "poorly detected" description. This what poor detection looks like after an IR investigation and opening tickets with several vendors two months ago. https://www.virustotal.com/gui/file/d8ac4f43a5279e3aa33b2a743e17e1c59ba170c74965c45feca529fd8e817140 https://www.virustotal.com/gui/file/d8ac4f43a5279e3aa33b2a74...
- vient 4y agoThe key sentence is > First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services. Of course by now majority of AVs detect those files, detections spread rather quickly between AVs. Sadly, VirusTotal seems to show detection history only to registered users. I can confirm that at least second sample still had 0 detections in April.