5 ms·

There seems to be a lot of confusion in the comments about what's going on here. 1. The problem is occurring primarily with Carbon Black, a third-party product

There seems to be a lot of confusion in the comments about what's going on here. 1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved. 2. This has nothing at all to do with code signing. 3. Carbon Black is part of the category of "next generation antivirus" which are notorious for false positive problems. It relies heavily on cloud-based machine learning heuristic techniques to identify "malware-like" behavior. It's fairly well known in the industry that these methods are prone to mislearning uncommon runtimes and compression/obfuscation tools as malware. 4. Vendors of these products usually suggest that the false positive problem will be mitigated by the corporate security operations center reviewing and dismissing alerts, but in practice most corporations configure the product very conservatively and do not invest the resources in managing the false positives.

nikanj 4y ago
"AI powered heuristics" are so frustrating in AV. "This program runs on the CPU. Malware often runs on the CPU! It must be malware!" They advertise high detection rates, but the secret is just flagging everything as malware - and thus also catching the sample malware in a stopped-clock-is-sometimes-right kind of way
- arp242 4y ago
  What does "runs on the CPU" mean in this context? Don't all programs "run on the CPU"?
  - ketralnis 4y ago
    That is in fact the joke
    - arp242 4y ago
      I thought jokes on HN were forbidden by law?
      - elcritch 4y ago
        No just by convention and a relatively high bar. Clever jokes get by, unclever ones are doubly downvoted.
  - chc 4y ago
    That was their point, yes. These tools treat anything they see malware do as a potential signal of malware, without any consideration of what the activity is. Obviously they're not actually going to flag "running on a CPU" as a sign of malware, but it's a pretty reasonable parody of their methodology.
eyegor 4y ago
In my experience, most of these "cloud/advanced/ai" anti-virus tools will tag your executables if you use common open source packers (upx) or open source obfuscators. Using less common tools generally doesn't raise red flags (???), but you can often trick them into being okay with packed code if you sign it with an EV cert.
- skissane 4y ago
  I had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defender thought my executable was some trojan (something like trojan:Win32/Wacatac.B!ml). So I gzipped the script as part of the build process, embedded the gzipped script instead, along with a single file decompression library, and decompressed it at runtime - now Windows Defender is okay with my program. Gosh, if I can do that, some malware author can too. If these “heuristic” detections are so easy to bypass, what’s the point?
  - elcritch 4y ago
    To mark a checkbox on some security compliance form somewhere.
forgotusername6 4y ago
I double clicked on a js file inside a zip folder before by accident. It ran, did nothing, but I got an email from IT within hours saying I needed to wipe my device. It took a lot of convincing to avoid doing that.
- MSFT_Edging 4y ago
  God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they see fit. I can't imagine the paranoia I'd feel with having spyware on my machine constantly calling home.
  - ianlevesque 4y ago
    What why? That’s the typical configuration for very large corporations. Coping steps: 1. Do not use your work computer for personal data. 2. There is no step 2.
    - MSFT_Edging 4y ago
      Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer. Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine. My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.
  - acdha 4y ago
    It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware). The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.
alyandon 4y ago
CB is a family of security products that runs on Linux, Windows and MacOS - one particular product prevents binaries from running until they have been placed in an explicit allow list based on a hash signature. At least some of those "I changed my exe and now it won't run" sounds suspiciously like their machines are running that particular product.
vlunkr 4y ago
I don't work in security, but I've had zero good experiences with the anti-virus vendor market in my small amount of interaction. These next-gen ones will tell you that you won't even know it's running because it's so efficient. It uses machine learning buzzwords to magically find intruders or viruses. It's sad that these salesmen seem to have convinced lots of the right industry people that you really need them.
- saagarjha 4y ago
  I work in security, and I've had zero good experiences with the anti-virus vendor market.
  - breatheoften 4y ago
    I can't think of a program more dangerous than one which intercepts and has option to receives every byte read from the filesystem -- while also having its own arbitrary network access ... the idea that employing such a tool could ever be better than _not_ having that tool is wrong at such a fundamental level that I don't understand how our computing society allows it to go on ...
    - saagarjha 4y ago
      If you have the latitude to architect things well it can work. Sadly, almost nobody does :(
hdjjhhvvhga 4y ago
> Microsoft is not involved. In this case maybe not, but MS Defender doesn't like Nim (and Nimble), either[0][1]. [0] https://github.com/nim-lang/Nim/issues/18933 https://github.com/nim-lang/Nim/issues/18933 [1] https://forum.nim-lang.org/t/8196 https://forum.nim-lang.org/t/8196
- georgemcbay 4y ago
  Windows Defender often doesn't like Go programs either. Not sure the current status but at least a few times a year I have Windows Defender flag Go programs I compiled myself locally as potential malware. This has happened as recently as November.
account42 4y ago
> 1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved. The posted thread links others concerning other tools' detections. This problem is widespread and affects the entire AV industry, including Microsoft's products. It also affects pretty much every browser via "Google Safe Browsing" - and Google certainly does not care any more about false positives than the AV vendors they source their detections from. Also, Google runs VirusTotal, which greatly widens the reach of these shitty AV tools. For some reason Google feels the need to hide that association. > 2. This has nothing at all to do with code signing. Perhaps. It shouldn't, but that doesn't mean that lazy AV writers won't consider signing as a signal that something is safe - after all, Windows itself does. There are at least many developers claiming that signing helps against false positive detections.

nikanj 4y ago

"AI powered heuristics" are so frustrating in AV. "This program runs on the CPU. Malware often runs on the CPU! It must be malware!" They advertise high detection rates, but the secret is just flagging everything as malware - and thus also catching the sample malware in a stopped-clock-is-sometimes-right kind of way

arp242 4y ago
What does "runs on the CPU" mean in this context? Don't all programs "run on the CPU"?
- ketralnis 4y ago
  That is in fact the joke
  - arp242 4y ago
    I thought jokes on HN were forbidden by law?
    - elcritch 4y ago
      No just by convention and a relatively high bar. Clever jokes get by, unclever ones are doubly downvoted.
- chc 4y ago
  That was their point, yes. These tools treat anything they see malware do as a potential signal of malware, without any consideration of what the activity is. Obviously they're not actually going to flag "running on a CPU" as a sign of malware, but it's a pretty reasonable parody of their methodology.

eyegor 4y ago

In my experience, most of these "cloud/advanced/ai" anti-virus tools will tag your executables if you use common open source packers (upx) or open source obfuscators. Using less common tools generally doesn't raise red flags (???), but you can often trick them into being okay with packed code if you sign it with an EV cert.

skissane 4y ago
I had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defender thought my executable was some trojan (something like trojan:Win32/Wacatac.B!ml). So I gzipped the script as part of the build process, embedded the gzipped script instead, along with a single file decompression library, and decompressed it at runtime - now Windows Defender is okay with my program. Gosh, if I can do that, some malware author can too. If these “heuristic” detections are so easy to bypass, what’s the point?
- elcritch 4y ago
  To mark a checkbox on some security compliance form somewhere.

forgotusername6 4y ago

I double clicked on a js file inside a zip folder before by accident. It ran, did nothing, but I got an email from IT within hours saying I needed to wipe my device. It took a lot of convincing to avoid doing that.

MSFT_Edging 4y ago
God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they see fit. I can't imagine the paranoia I'd feel with having spyware on my machine constantly calling home.
- ianlevesque 4y ago
  What why? That’s the typical configuration for very large corporations. Coping steps: 1. Do not use your work computer for personal data. 2. There is no step 2.
  - MSFT_Edging 4y ago
    Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer. Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine. My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.
- acdha 4y ago
  It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware). The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.

alyandon 4y ago

CB is a family of security products that runs on Linux, Windows and MacOS - one particular product prevents binaries from running until they have been placed in an explicit allow list based on a hash signature. At least some of those "I changed my exe and now it won't run" sounds suspiciously like their machines are running that particular product.

vlunkr 4y ago

I don't work in security, but I've had zero good experiences with the anti-virus vendor market in my small amount of interaction. These next-gen ones will tell you that you won't even know it's running because it's so efficient. It uses machine learning buzzwords to magically find intruders or viruses. It's sad that these salesmen seem to have convinced lots of the right industry people that you really need them.

saagarjha 4y ago
I work in security, and I've had zero good experiences with the anti-virus vendor market.
- breatheoften 4y ago
  I can't think of a program more dangerous than one which intercepts and has option to receives every byte read from the filesystem -- while also having its own arbitrary network access ... the idea that employing such a tool could ever be better than _not_ having that tool is wrong at such a fundamental level that I don't understand how our computing society allows it to go on ...
  - saagarjha 4y ago
    If you have the latitude to architect things well it can work. Sadly, almost nobody does :(

hdjjhhvvhga 4y ago

> Microsoft is not involved. In this case maybe not, but MS Defender doesn't like Nim (and Nimble), either[0][1]. [0] https://github.com/nim-lang/Nim/issues/18933 https://github.com/nim-lang/Nim/issues/18933 [1] https://forum.nim-lang.org/t/8196 https://forum.nim-lang.org/t/8196

georgemcbay 4y ago
Windows Defender often doesn't like Go programs either. Not sure the current status but at least a few times a year I have Windows Defender flag Go programs I compiled myself locally as potential malware. This has happened as recently as November.

account42 4y ago

> 1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved. The posted thread links others concerning other tools' detections. This problem is widespread and affects the entire AV industry, including Microsoft's products. It also affects pretty much every browser via "Google Safe Browsing" - and Google certainly does not care any more about false positives than the AV vendors they source their detections from. Also, Google runs VirusTotal, which greatly widens the reach of these shitty AV tools. For some reason Google feels the need to hide that association. > 2. This has nothing at all to do with code signing. Perhaps. It shouldn't, but that doesn't mean that lazy AV writers won't consider signing as a signal that something is safe - after all, Windows itself does. There are at least many developers claiming that signing helps against false positive detections.