4 ms·

I find it especially funny when anti-malware tools flag things like 4k intros or even smaller demoscene production. The people doing that are shaving bytes, fi

by GuB-42 3y ago

I find it especially funny when anti-malware tools flag things like 4k intros or even smaller demoscene production. The people doing that are shaving bytes, fitting music and 3D graphics in self-contained executables smaller than many HN posts. Having enough space for malware after that would be insane. The reason these are often flagged as malware is that they are typically using runtime compression and a variety of tricks to save space, these techniques are unusual in legitimate programs and common in malware. Malware scanners could add support for the likes of crinkler and kkrunchy, but these are probably too niche to care.

Terr_ 3y ago
While it is true those executables may be small files, that doesn't mean they can't be part of a larger malware suite, one where the vestibulk of innocent looking code is elsewhere, and the specially-packed executable contains the damning secret sauce.
- GuB-42 3y ago
  They definitely could be part of malware, that's why they are flagged as such. I know the context, I know what's in the archive with it, and I am pretty sure the executable are safe, but the scanner doesn't know, and doesn't get to see the nice effects for conformation. Most people simply turn off the scanner when dealing with these files. Scanners could discriminate. These productions are often compressed with well known packers. It would be a "simple" matter of unpacking the file and scanning the result executable, which is often just a bunch of graphics and sound calls. But that's significant work for such a niche application. These tiny packers are also way more resource hungry than their size would suggest.
  - Terr_ 3y ago
    > These tiny packers are also way more resource hungry than their size would suggest. I wonder if that might also expose some attack-surface, like with "zip bombs".
kadoban 3y ago
How many bytes does it take to run "download X and exec it". I wouldn't think many?
no_time 3y ago
>Having enough space for malware after that would be insane. win32 shellcode for downloading the real malware could very easily fit even in a 4k intro. https://www.exploit-db.com/exploits/13515 https://www.exploit-db.com/exploits/13515

by GuB-42 3y ago

Terr_ 3y ago

While it is true those executables may be small files, that doesn't mean they can't be part of a larger malware suite, one where the vestibulk of innocent looking code is elsewhere, and the specially-packed executable contains the damning secret sauce.

GuB-42 3y ago
They definitely could be part of malware, that's why they are flagged as such. I know the context, I know what's in the archive with it, and I am pretty sure the executable are safe, but the scanner doesn't know, and doesn't get to see the nice effects for conformation. Most people simply turn off the scanner when dealing with these files. Scanners could discriminate. These productions are often compressed with well known packers. It would be a "simple" matter of unpacking the file and scanning the result executable, which is often just a bunch of graphics and sound calls. But that's significant work for such a niche application. These tiny packers are also way more resource hungry than their size would suggest.
- Terr_ 3y ago
  > These tiny packers are also way more resource hungry than their size would suggest. I wonder if that might also expose some attack-surface, like with "zip bombs".

kadoban 3y ago

How many bytes does it take to run "download X and exec it". I wouldn't think many?

no_time 3y ago

>Having enough space for malware after that would be insane. win32 shellcode for downloading the real malware could very easily fit even in a 4k intro. https://www.exploit-db.com/exploits/13515 https://www.exploit-db.com/exploits/13515