13 ms·
Nim and Go programs identified by Carbon Black as malware on Windows
- PMunch 4y agoSuch a shame that innovative languages are hampered in getting users by the ineptitude of antivirus vendors.
- hardware2win 4y agoWhat is innocative in go? Concurrency primitives? Single file?
- rdevsrex 4y agoNothing wrong on iterating on what came before.
- mynameisvlad 4y agoSure, but it's also not really innovative to iterate.
- rakoo 4y agoWhen you think about it, is an automobile really an innovation compared to a horse cart ?
- mynameisvlad 4y agoI would argue the innovation is the concept of a mechanical engine powering it rather than horses. Cars are just one of the implementations, based off an iteration of the horse cart.
- int_19h 4y agoIt's relative. Go is more like an automobile that often pretends to be a cart for the sake of simplicity. Compared to a horse cart, that's definitely innovative. Compared to other cars, not so much.
- cy_hauser 4y agoGo is more like an climate that pretends to be an atmosphere for simplicity. Compared to a greenhouse you really can. Compared to the other climates it's essentially sophistry.
- vorpalhex 4y agoThis sort of comment is immature and doesn't help anyone.
- revskill 4y agoMaking things simpler to use is innovative to me.
- badrequest 4y agoclassic HN hivemind opinion regurgitation
- antifa 4y agoIs this a joke? I hate golang and have 99 bad things to say about it, but "not innovative" isn't going to be on that list.
- zoobab 4y agoMicrosoft Windows is a malware in the first place. Replaced it with Linux since 1996, never had any problems with 'viruses' since then. My parents still buys antiviruses for Windows, I told them to switch to Ubuntu long ago.
- gradExMachina 4y agoThe online consensus seems to be that Windows Defender (M$'s) is likely the best AV for windows. Perhaps you could tell them to get malwarebytes if they feel the need for one.
- account42 4y agoIME, Windows Defender does not care about false positives any more than the other vendors.
- radlad 4y agoI think the parent was just trying to save OP's parents some money. > My parents still buys antiviruses for Windows
- gradExMachina 4y agoThat was my intention.
- grapesurgeon 4y ago[dead]
- squarefoot 4y ago> My parents still buys antiviruses for Windows, I told them to switch to Ubuntu long ago. If I may offer some advice, don't tell elderly people to change anything, especially about things they're not familiar with, like computers are for many of them. The more people grow old, the more they need familiarity with things. During the years, also thanks to the transition to become a grey beard myself, I've learned the lesson and adopted a different approach, both for relatives and customers: I offer to solve problems at minimum effort, that is, no more viruses, lost data due to OS or software crashes, licenses and their expiration, planned obsolescence and subsequent need to buy new hardware, etc. It goes like "I'm giving you something much better with all your data where you expect them to be; you use it for a while, then after some time if you don't feel comfortable I'll revert it back exactly like before, for free". The "free" part of course is needed outside of family and friends. It is important to keep technical data for ourselves because every term they don't understand would reinforce the perception that Linux can't be used by non technical people and they would fear it long before even having seen it in action. If they ask "what's Linux?" the answer should be like "something like Windows but less problematic" and nothing more. I've started to experience success stories in migrating Windows users to Linux the day I've stopped expecting they could understand what is a compiler, a kernel or the GNU philosophy.
- anthk 4y agoRuntime related, maybe.
- PMunch 4y agoNim doesn't really have a runtime though, but there are probably some similarities between all programs written in Nim simply because it's machine generated. And feed the compiler one or two pieces of malware in Nim without any other Nim projects and you quickly end up reporting everything as Nim. Same goes for Go I presume, even though it does have a runtime.
- randomdata 4y ago> Nim doesn't really have a runtime though I don't know much about Nim, but its website claims that it has two possible runtimes[1]. What they dub the "old runtime" and the "new runtime". What's the source of discrepancy here? [1] https://nim-lang.github.io/Nim/intern.html#runtimes https://nim-lang.github.io/Nim/intern.html#runtimes
- jonathanstrange 4y agoUnlikely. It's just that some people use these languages for creating malfware and the heuristic scanner grab unto all executables, or the signatures are generated without much care. It's a common problem of smaller languages, e.g. Purebasic executables are frequently flagged as malware.
- cbdwqio 4y agoSimply banning the language because the language is efficient and elegant to be used for malware is ridiculous.
- brookst 4y agoAssuming technical mistakes reflect intentional policy is kind of conspiratorial. Far more likely that some ML algorithm trained on malware found the same patterns in legit software, all without any particular knowledge of source language.
- squarefoot 4y agoThat would be extremely stupid and shortsighted from them, to the point it makes one wonder it could be intentional. In the late 90s and early 2Ks a lot of cracking software, keygens etc. were made in Delphi, which i also used for years at different companies, and I don't recall a single antivirus complaining about executables compiled by me or any other colleague.
- KMag 4y agoI suspect it's just an over-fitting problem. By some (likely ML-derived) metrics, Go and Nim binaries don't look like MSVC binaries. My general feeling is that we're going to see many years of ML over-fitting for common cases, getting power users banned from various services, various oddball binaries flagged as malicious, etc.
- account42 4y agoLike most ills today, it's a not-caring-about-externalities problem. If there were real repercussions for rampant false positives, these would be fixed yesterday.
- KMag 4y agoThe thing is, these probably aren't rampant. I doubt more than 0.01% of all Windows machines have a Go or Nim binary on them.
- badsectoracula 4y agoThis has been a problem with many compilers that aren't MSVC. I had antiviruses claim issues with Free Pascal as well as less used C compilers. My solution to this "problem" is to simply ignore it - there isn't anything i can do about it anyway - and tell anyone who asks that it is a false positive. Though FWIW Windows Defender (or whatever the antivirus installed by default is called) so far never had a false positive. Perhaps other antiviruses are over-eager to justify their existence - and price - so they have an incentive to scare the clueless users.
- e40 4y ago> My solution to this "problem" is to simply ignore it - there isn't anything i can do about it anyway - and tell anyone who asks that it is a false positive. That works most of the time, but there are some orgs (e.g., US gov) where it will not.
- pietroppeter 4y agommh, so is using MSVC compiler a possible workaround?
- badsectoracula 4y agoPossibly, but note that this is a lack of encountering an issue, not that the issue doesn't exist. Also it limits you to MSVC, C/C++ and languages that can transpile to C/C++ via MSVC. This isn't something that, e.g. Free Pascal can do and when i use other C compilers is mainly to avoid MSVC :-P.
- GoblinSlayer 4y agoNo, the workaround is a signed executable.
- noobermin 4y agoIs Nim trying to get a signed compiler?
- daviddever23box 4y agoWe ship Microsoft-signed Go binaries on Windows (via Windows Update) and have never, to date, had any issues with false positives. This smells like clickbait for someone unfamiliar with Windows application release and delivery.
- hdjjhhvvhga 4y agoHave you read the linked page? It clearly shows many people have been affected.
- pjerem 4y ago> We ship Microsoft-signed Go binaries Cool. So we just all need to politely ask Microsoft to sign our binaries. What a bright future where Microsoft have the power to decide who lives and who dies. I know that you'll answer that Apple also does it. Well, it's also an issue. Who needs courts and laws when you have good corporations :)
- tgv 4y agoIdk how Windows does it, but under macOS, you can change a setting and it'll let you run any binary, but you have to approve it before running it the first time. It's not based on malware detection.
- Semaphor 4y agoIt’s the same in Windows. Well, mostly. You have to click 2 buttons to allow it. This thread is about AV software, sadly the horrible headline ("on Windows") makes everyone who stopped with the headline comment about unrelated things.
- daviddever23box 4y agoThat's what consenting adults do in lieu of 'bcdedit /set testsigning on' via an admin prompt. Alternately, one can call off the antivirus dogs and get on with it.
- IceWreck 4y ago
- wrldos 4y agoI had this with a VSTO MSI package I was developing a few years back. Had to submit samples to Microsoft who whitelisted it fairly quickly. This was an EV signed package. Only components packaged were Microsoft provided!
- ilaksh 4y agoI assume this is the same racket that they had years ago where you need some certification (which you have to buy from one the their licensed companies) to sign all of your binaries OR you have to go through the Windows store. It was pretty devastating for me a few years back because I spent a year and half making some software and then ended up with the best potential users accusing me of developing malware and being very hostile. Also when I tried to get the certificate the company was a nightmare to deal with. Truly garbage people. The whole thing is a racket. It's just another way for Microsoft to extract money. Because they are a bunch of mafia goons.
- BlueTemplar 4y agoYet another reason why it should be illegal for the OS maker to also own a store for it (specifically a for profit one, if the term "store" isn't clear enough). I am guessing that the situation got worse with the introduction of the Windows Store with Windows 8 ?
- DownGoat 4y agoThe most popular nim repository on Github except nim-lang itself is OffensiveNim which basically is a collection implementation of malware features in nim. It's a very popular language for red teamers. This has nothing to do with signed binaries.
- drewbitt 4y agoSo what’s the reason for Go? It too is eloquent enough to be able to write malware?
- indymike 4y agoI just put in tickets with the AV products our company uses requesting they examine whu Go and Nim binaries are being flagged. We only have AV because of security theater, and are on all Linux and Mac infrastructure, but for what it is worth, sometimes a few tickets go a long way.
- kyrra 4y agoGo had an FAQ entry for this because it happens so frequently. https://go.dev/doc/faq#virus https://go.dev/doc/faq#virus
- hbn 4y agoYeah I ran into this a couple years ago when I tried to distribute Windows binaries for a utility program I wrote. I seem to recall the issue being described in that since every Go binary comes pre-packaged with the Go runtime, all software -- including malware written in Go -- will have similar structure, and some common code. I wasn't planning on monetizing the utility and I didn't expect a lot of people to use it so I just posted it with a disclaimer to ignore Windows Defender, and the source code was available on Github.
- alkonaut 4y agoIs this identified by windows or by a third party product? The thread seems to be about CarbonBlack?
- fabian2k 4y agoI understand that OS and browser vendors want to protect users from all kinds of exploits, but it's extremely annoying that essentially any new and unknown binary is treated as if it contained a virus. Windows will show a warning dialog for essentially any unknown executable downloaded from the internet. The only way out of this is to buy a somewhat expensive EV code signing certificate and sign the binary. Or to have that binary become popular enough to get known, but then you have the same issue again after an update. Chrome will tell users that "downloaded files are dangerous" if they are an unknown executable. So far I don't know any way around this warning, and users have to go to the full download page to override this. No idea how to get Chrome to trust this, maybe code signing helps here as well, but who knows. And we're not even at false positives from anti-virus yet, those come on top of these problems.
- Dalewyn 4y ago>Windows will show a warning dialog for essentially any unknown executable downloaded from the internet. Windows has done this since at least XP with any executable of remote origins (including other machines in LANs), regardless of digital signatures. Personally, I think this is fine so long as it is just a notification/warning and lets the user be on their way with a simple confirmation.
- mynameisvlad 4y agoBlame stupid users who open anything and everything without a second thought. The protections are in place because most users can't be trusted to have enough self-control and intelligence to question that attachment called VerifyYourPassword.exe from youronlineaccount@totallyrealchasebank.com
- ta8903 4y agoUsers opening anything and everything is only a problem because Windows doesn't (or rather didn't, for a long time) have a package manager and "opening anything and everything" is the primary way to install applications.
- 4y ago
- lopkeny12ko 4y ago10 years ago, my antivirus software on Windows flagged a program that I wrote myself, for my own use, as malicious. That was the day I instantly lost trust of all "antivirus" solutions and never touched one again.
- deleted 4y ago[deleted]
- narag 4y agoIt was usual more than twenty years ago already. AVs often panic with any sockets or registry code.
- brundolf 4y agoTo get out ahead of it for people who didn't read: this is about certain third-party antivirus programs, not Windows itself
- ok123456 4y agoRun into this problem when I distribute binaries at work to people who are using Windows. Every time I was using a mingw tool chain to either compile c++ directly, or using it as part of something like Nikita to distribute python junk. Windows defender just stopped execution, some of the enterprise endpoint junk deletes the file entirely.
- rubyist5eva 4y agoanti-virus software is the most dangerous malware that exists, it extracts money from you while slowing down your computer and generally making your life hell for no next to no benefit whatsoever the amount of productivity lost to useless anti-virus software is incalculable
- bitwize 4y agoBasically, any binary you compile for Windows needs a special exemption in order not to be flagged by antivirus -- even Defender, which just quietly deleted files I've compiled. You need to contact the antivirus vendors in order to get your software on their allowlist. Sorry, but it's just the way of the world now.
- low_tech_punk 4y agoYou can always make the "err on the safe side" argument for security related practice. But at least provide transparent and responsive communication channels for legitimate authors to dispute a flagging. Right now the whole malware detection thing is a blackbox that makes software authors feel powerless. I can only imagine AI products making this even worse.
- btbuilder 4y agoI have run into this when distributing go binaries to enterprises. We also found that many of the malware vendors share their heuristic-detected signatures with each other so once one decides your binary is malware things really go downhill. We signed the exe with a standard code signing cert and the problems went away. These days we use an EV code signing cert that have to have their private key in an HSM.
- OptionX 4y agoI don't actively develop in C/C++, but a few year back when I had to use them for a few university assignments I do remember them triggering most AV software. Don't know if it got better nowadays.
- rany_ 4y agoMy understanding is that this is caused by Nim/Go's stdlib or other program dependencies being identified as malware. These languages are almost always built statically so the stdlib and other dependencies are always included in the program binaries and could trigger a false positive.
- IncRnd 4y ago> I do not think we were able to ever get in contact with anti malware software I've found it very easy to do so. This statement seems like you didn't use the phone or the keyboard.
- flohofwoe 4y agoFirst question for clarification would be: is it the "SmartScreen popup", or is it an actual malware warning from Windows Defender? The SmartScreen popup happens for all native executables downloaded from the internet, even when they are code signed with a 'regular' code signing certificate, it doesn't matter in which language those executables had been coded in. Only way around that popup reliably is to buy an expensive "EV certificate" (at least as far as I know) [0]. As far as I understand, SmartScreen assigns an intransparent "reputation score" to executable downloads. Popular downloads have a higher reputation score than propgrams with low download numbers. And programs signed with an "EV Certificate" have a higher reputation score then an unsigned program, or a program with a regular code signing certificate. TL;DR: if you want to distribute software on Windows outside the Microsoft Store, you need to get an expensive EV code signing certificate. [0] https://www.digicert.com/support/resources/faq/public-trust-and-certificates/what-is-an-extended-validation-ev-ssl-certificate https://www.digicert.com/support/resources/faq/public-trust-...
- jcrawfordor 4y agoThere seems to be a lot of confusion in the comments about what's going on here. 1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved. 2. This has nothing at all to do with code signing. 3. Carbon Black is part of the category of "next generation antivirus" which are notorious for false positive problems. It relies heavily on cloud-based machine learning heuristic techniques to identify "malware-like" behavior. It's fairly well known in the industry that these methods are prone to mislearning uncommon runtimes and compression/obfuscation tools as malware. 4. Vendors of these products usually suggest that the false positive problem will be mitigated by the corporate security operations center reviewing and dismissing alerts, but in practice most corporations configure the product very conservatively and do not invest the resources in managing the false positives.
- nikanj 4y ago"AI powered heuristics" are so frustrating in AV. "This program runs on the CPU. Malware often runs on the CPU! It must be malware!" They advertise high detection rates, but the secret is just flagging everything as malware - and thus also catching the sample malware in a stopped-clock-is-sometimes-right kind of way
- alar44 4y agoOnce again, the hackernews crowd shows their embarrassing lack of security understanding. Every time security stuff comes up, the comments are just cringe. "Durrr fuck M$." Eesh.
- byt3bl33d3r 4y agoAuthor of the OffensiveNim repo here. This is a problem that's existed since the creation of the AV/EDR industry and is not going away as vendors have 0 motivation to address it. All programming languages have had to deal with this issue, this is definitely not targeted towards the Nim language. - If you're a Nim developer trying to deploy a production app in a Windows environment: get a code signing cert and slap it on your application (signing the compiler won't help). - If you're trying to develop a Nim app in an organization that has an EDR/AV deployed: you're going to have to talk with your friendly neighborhood security folks and work with them to whitelist the Nim compiler, tooling and folders where you work with Nim code. You'll still be subjected to the EDR/AVs WinAPI hooking and behavioral heuristics even with the code signing cert and sometimes even after whitelisting depending on the product so you still might get issues were the AV/EDR is affecting your application but at least it won't straight up quarantine it and go ape shit. EDIT: just to be clear, the root cause of this is the AV/EDR industry not doing due diligence. Unfortunately, I'm very skeptical of them doing anything about this as their entire business model revolves around "cast a wide net in the attempt to catch as many things as possible".
- treeform 4y agoAbout antivirus on Windows, as a person who has shipped a commercial windows app that was regularly hit by anti virus. There is almost nothing you can do except wait. Windows antivirus companies mark your program as a virus when you .exe looks different from anything it saw before. The reports do come down after your .exe is shipped to thousands of computers and users unquarantine it manually. Signing the exe with windows keys or uploading your exe to special white lists does not work! We tried. It's just time and install base. Every update changes the exe and AV would flare up again. Windows antivirus companies are basically a scam and are worse than the protection they offer. They are more likely to mine Bitcoin ( https://www.theverge.com/2022/1/7/22869528/norton-crypto-miner-security-software-reaction https://www.theverge.com/2022/1/7/22869528/norton-crypto-min... ) or man-in-the-middle ( https://www.thesafemac.com/avasts-man-in-the-middle/ https://www.thesafemac.com/avasts-man-in-the-middle/ ). Antivirus companies have become the bad actors they tried but failed to stop. (https://www.cbc.ca/news/science/antivirus-software-1.3668746 https://www.cbc.ca/news/science/antivirus-software-1.3668746 ) I recommend Nim does nothing with regards with AV as there is nothing it can do but wait...
- StreamBright 4y agoI am wondering how long it takes for enterprises to give up on antivirus scam.
- xwowsersx 4y agoI wrote an antivirus program that identifies Windows as a virus (simmer down ya'll, I jest)
- WalterBright 4y agoI had a lot of trouble years ago because the Digital Mars C/C++ compiler had its own runtime library. Many malware detectors would flag anything that didn't have the Microsoft C compiler runtime library in it as malware. Fortunately, this problem has been cleared up.
- r2vcap 4y agoThat's why I don't code on Windows and I don't work for bureaucratic companies where the IT department isn't flexible enough to understand how compilers work and how antivirus software can go wrong.