4 ms·

The bit about the anti-malware is sad. Does anyone remember a true positive from their AV? I can recall countless incidents caused by false positives, but can’t

by nikanj 4y ago

The bit about the anti-malware is sad. Does anyone remember a true positive from their AV? I can recall countless incidents caused by false positives, but can’t remember a single true positive. The latest was Crowdstrike Falcon (AI POWERED!!1) flagging signtool.exe as malware. The one from the Windows SDK. By Microsoft. Signed with Microsoft keys.

fencepost 4y ago
The latest was Crowdstrike Falcon (AI POWERED!!1) flagging signtool.exe as malware. For more than 99% of their install base its presence on a system may be a decent indicator of compromise. Maybe not worth flagging by itself but worth investigating anything that bundled it.
BrandoElFollito 4y ago
Security is hard. It is only when you have to fight never ending scenarios from multiple users that you understand how limited a product that helps you is. Crowdstrike helped us a few times to contain serious issues, and made me difficult for people as well because it blocked their "suspicious" behaviour. The bad guys only need to succeed once.
Aachen 4y ago
> Does anyone remember a true positive from their AV? Yes. I don't remember the details but there was one time where it prevented me from executing some download that was malicious. This was more than a decade ago. On another occasion (around the same time) it failed to prevent malware from executing. I never found out what the method of infection was, but after changing back the wallpaper and removing it from startup programs, I suffered no further ill effects... fifteen year old me was not very thorough but seems to have worked anyway. And then there are the numerous annoyance occasions where it false-positived on legitimate software like Nirsoft, Cain&Abel, Netcat, Nmap, etc. Not to mention corporate proxies blocking my personal link shortener but being fine with bitly. Security theatre, those are. To be fair, AV also prevents executing standard metasploit things and attackers have to be a bit more creative which gets tedious and so it can be an indicator of compromise to have this pop an alert even if the attacker succeeds a few minutes later.

by nikanj 4y ago

fencepost 4y ago

The latest was Crowdstrike Falcon (AI POWERED!!1) flagging signtool.exe as malware. For more than 99% of their install base its presence on a system may be a decent indicator of compromise. Maybe not worth flagging by itself but worth investigating anything that bundled it.

BrandoElFollito 4y ago

Security is hard. It is only when you have to fight never ending scenarios from multiple users that you understand how limited a product that helps you is. Crowdstrike helped us a few times to contain serious issues, and made me difficult for people as well because it blocked their "suspicious" behaviour. The bad guys only need to succeed once.

Aachen 4y ago

> Does anyone remember a true positive from their AV? Yes. I don't remember the details but there was one time where it prevented me from executing some download that was malicious. This was more than a decade ago. On another occasion (around the same time) it failed to prevent malware from executing. I never found out what the method of infection was, but after changing back the wallpaper and removing it from startup programs, I suffered no further ill effects... fifteen year old me was not very thorough but seems to have worked anyway. And then there are the numerous annoyance occasions where it false-positived on legitimate software like Nirsoft, Cain&Abel, Netcat, Nmap, etc. Not to mention corporate proxies blocking my personal link shortener but being fine with bitly. Security theatre, those are. To be fair, AV also prevents executing standard metasploit things and attackers have to be a bit more creative which gets tedious and so it can be an indicator of compromise to have this pop an alert even if the attacker succeeds a few minutes later.