3 ms·

> Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Maybe the "this will be easy" part was that without AV software, there was

> Anti-virus software is utterly worthless in detecting previously-unknown rootkits. Maybe the "this will be easy" part was that without AV software, there was a greater chance that they could just spin up Metasploit, and wouldn't even have to use one their stockpiled zero-days?

autoexec 3y ago
Why worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".
- consumer451 3y ago
  If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."
throwaway09223 3y ago
AV doesn't detect the exploit mechanism -- that's not how it works. It's only pattern matching existing binaries. The difficulty level is "recompile with small changes and test that it doesn't match" not "develop a new attack vector" It really is stupid and pointless against an attacker with even a bare minimum of competence (able to run a software build vs downloading binaries)
- IIsi50MHz 3y ago
  This would fit my expectations of a classical 1990s antivirus, however I would expect modern ones to also employ heuristics against behaviours. Are you referring specific'ly to a limitation ClamAV?
- consumer451 3y ago
  But AV (EPP) could detect a binary which was passed through a traditional vector, like phishing or gaining access to a "trusted" email account and attaching a compromised PDF, as a random example. Just a reminder that I was originally talking about desktop Linux, and all of the additionally installed attack surface which that entails. It would seem to me that it does not matter how "technical" a user is, they are still human, and some of the time anyone could fall for a well formed phishing attack. We all get tired, overworked, or click too fast, etc. Not running AV on a desktop OS and relying on one's own superhuman technical ability seems like the exact type of hubris that would be ripe for attack.
  - midasuni 3y ago
    How many genuine issues (not nonsense like “blah.con has stored a cookie” does your av pick up?
    - consumer451 3y ago
      It is very likely that a modern AV (I should have been saying EPP) will pick up your average re-encoded payload, or Metasploit fun time. Certainly they will pickup most known vulnerabilities. Endpoint Protection (EPP) orgs use the same CVE DBs that adversaries use. See another user's comment: https://news.ycombinator.com/item?id=38594247 https://news.ycombinator.com/item?id=38594247 Security is an onion, perfect is the enemy of good, etc... Why make it easier for the adversaries? While annoying, running EPP on your desktop OS is not exactly neuroscience. Ideally, it's furnished by the OS provider so that there are fewer parties to trust. I hate to say it, but Microsoft is now teaching by example. MS has factually one of the best-in-class Endpoint Protection agents on the market. If resources allowed, all other desktop OS providers should follow suit, otherwise they are just shirking responsibility.
      - EricLeer 3y ago
        Any recommendations for a good AV/EPP for desktop linux (ubuntu)?

autoexec 3y ago

Why worry about stockpiled zero-days even for non-linux systems when they can just force MS or Apple to hand over data or inject whatever they want into an OS "update".

consumer451 3y ago
If I'm beginning to recall the story correctly, it's that your suggested route would involve more time, paperwork, and this particular op might not be important enough to get the big guns authorized by the higher-ups. Hence, "oh, this will be (relatively) easy..."

throwaway09223 3y ago

AV doesn't detect the exploit mechanism -- that's not how it works. It's only pattern matching existing binaries. The difficulty level is "recompile with small changes and test that it doesn't match" not "develop a new attack vector" It really is stupid and pointless against an attacker with even a bare minimum of competence (able to run a software build vs downloading binaries)

IIsi50MHz 3y ago
This would fit my expectations of a classical 1990s antivirus, however I would expect modern ones to also employ heuristics against behaviours. Are you referring specific'ly to a limitation ClamAV?
consumer451 3y ago
But AV (EPP) could detect a binary which was passed through a traditional vector, like phishing or gaining access to a "trusted" email account and attaching a compromised PDF, as a random example. Just a reminder that I was originally talking about desktop Linux, and all of the additionally installed attack surface which that entails. It would seem to me that it does not matter how "technical" a user is, they are still human, and some of the time anyone could fall for a well formed phishing attack. We all get tired, overworked, or click too fast, etc. Not running AV on a desktop OS and relying on one's own superhuman technical ability seems like the exact type of hubris that would be ripe for attack.
- midasuni 3y ago
  How many genuine issues (not nonsense like “blah.con has stored a cookie” does your av pick up?
  - consumer451 3y ago
    It is very likely that a modern AV (I should have been saying EPP) will pick up your average re-encoded payload, or Metasploit fun time. Certainly they will pickup most known vulnerabilities. Endpoint Protection (EPP) orgs use the same CVE DBs that adversaries use. See another user's comment: https://news.ycombinator.com/item?id=38594247 https://news.ycombinator.com/item?id=38594247 Security is an onion, perfect is the enemy of good, etc... Why make it easier for the adversaries? While annoying, running EPP on your desktop OS is not exactly neuroscience. Ideally, it's furnished by the OS provider so that there are fewer parties to trust. I hate to say it, but Microsoft is now teaching by example. MS has factually one of the best-in-class Endpoint Protection agents on the market. If resources allowed, all other desktop OS providers should follow suit, otherwise they are just shirking responsibility.
    - EricLeer 3y ago
      Any recommendations for a good AV/EPP for desktop linux (ubuntu)?