9 ms·
Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my
by scosman 2y ago
Fun concept.
If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.
- vmfunction 2y agoIt is a cat and mouse game. And security by obscurity practice. Not saying it won't work, but if it is open sourced, how long before the malware will catch on? Here is one on github: https://github.com/NavyTitanium/Fake-Sandbox-Artifacts https://github.com/NavyTitanium/Fake-Sandbox-Artifacts
- xyzzy123 2y agoThe really fun part is when malware authors add detections for "fake sandbox" and then real sandbox authors get to add those indicators.
- vmfunction 2y agoLook into Windows NT source code that was leaked. The if-else/switch statements in there is just another level of string matching hell. Seems like software development just become "let's jerry rig it to just make it work and forget about it." Pretty sure management (without tech clue) have something to do behaviours like this.
- 1992spacemovie 2y ago> Pretty sure management (without tech clue) have something to do behaviours like this. Always the same bullshit with you people here. Could never possibly someone built a sub-optimal system -- it HAD to be management fucking with our good intentions!
- CyberScarecrow 2y agoAuthor of scarecrow here. Our thinking is that if malware starts to adapt and check if scarecrow is installed, we are doing something right. We can then look to update the app to make it more difficult to spot - but its then a cat and mouse game.
- hluska 2y agoYou had an answer canned for one part of the query. Why are you trying to release security software completely anonymously? This is insane - you want an incredible amount of trust from users but can’t even identify a company. Simply, if users are as intelligent as you think, they’re too intelligent to use your product.
- dylan604 2y agoIf you think that is what will make it a cat and mouse game instead of understanding it has been a cat and mouse game since the beginning of time, then you're not compelling me into thinking you're very experienced in this space.
- boxed 2y agoIf windows would have this built in, then it would make malware authors job much more difficult. I like that.
- self_awareness 2y agoSome malware will catch on, some will not. It's a cost vs profit problem. Statistically, this will always decrease the number of possible malware samples that can be installed on the machine, but by what margin? Impossible to say.
- _xiaz 2y agoI'd be willing to bet good money that 99% of malware authors won't adapt, since 99% (more like 99.999%) of the billions of worldwide windows users will not have this installed. For the cat to care about the mouse it needs to at least be a good appetizer.
- ferfumarma 2y agoI think this is a same thing as betting on your own failure: "not enough people will use this for it to be an important consideration for hackers".
- Sebb767 2y agoI've worked in companies with horrendous security, where someone with just a bit of SQL injection experience could have easily carried out the data. Yet, since this was a custom in-house application and your off-the-shelve-scanners did not work, this never happened; the only times the servers were hacked was when the company decided to host an (obviously never updated) grandfathered Joomla instance for a customer. But even more simply, just setting your SSH port to something >10000 is enough to get away with a very mediocre password. It's mostly really not about being a hard target, not being the easiest one is likely quite sufficient :)
- giobox 2y ago> But even more simply, just setting your SSH port to something >10000 is enough to get away with a very mediocre password. Given how easy and free tools like Wireguard are to setup now (thanks Tailscale!), I really don't understand why folks feel the need to map SSH access to a publicly exposed port at all anymore for the most part, even for throw away side projects.
- _xiaz 2y agoI say leave it at 22 and use public key authentication. If a hacker can crack that, they deserve my server!
- RajT88 2y agoNot just that - it only works on smart malware. There is plenty of dumb malware. Security folks seem to get overly focused at times on the most sophisticated attackers and forget about the unwashed hordes.
- linsomniac 2y agoIt's not a cat an mouse game; it's a diver and shark game. In SCUBA training we joked that you had the "buddy system" where you always dive in pairs, because that way if you encounter a shark you don't have to outswim the shark, you only have to outswim your buddy. A low-effort activity that makes you not be the low-hanging fruit can often be worth it. For example, back in the '90s I moved my SSH port from 22 to ... not telling you! It's pretty easy to scan for SSH servers on alternate ports, but basically none of the worms do that.
- Tao3300 2y agoWhat I've heard is: If you're running from a bear, you only have to be faster than the other guy.
- deleted 2y ago[deleted]
- HPsquared 2y agoA lot of security stuff is a bit ironic like that. "Give this antivirus software super-root access to your machine".. it depends on that software being trustworthy.
- CyberScarecrow 2y agoAuthor of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators. I have just added a bit of info about us on the website. I'm not sure what else we can do really. Its a trust thing, same with any software and AV vendors.
- Z7YCx5ieof4Std 2y agoIs it possible to fake being from Russia. I heard some malware won't install on computers from Russia or with the Russian language as primary language
- CyberScarecrow 2y agoGreat idea. Looking at installing an additional keyboard or language with out it being anoying to the user is next on the feature list.
- llama_drama 2y agoThis might be not a good idea. There are some reports of malware (npm packages, iirc) specifically targeting russian computers since the invasion
- n2d4 2y agoThis can have the opposite effect too: https://arstechnica.com/information-technology/2022/03/sabotage-code-added-to-popular-npm-package-wiped-files-in-russia-and-belarus/ https://arstechnica.com/information-technology/2022/03/sabot...
- kozak 2y agoAnd be targeted by cyberwarfare from the first-world side.
- DougN7 2y ago
- kazinator 2y ago> It’s a random webpage that wants my personal details, and sends me a “exe”. No different from MacAffee, Trend Micro, Symantec. Oh, but those are brand names you can trust, like Coca-Cola and Kellog's Corn Flakes.
- diegolas 2y agowell... yes, that's what trust means
- Brian_K_White 2y agoYou can't spot the super subtle difference between a name with a rep to protect and a no-name?
- digging 2y agoBesides the obvious points made by others, those are odd choices. I don't trust any of those brands.
- michaelmior 2y ago> The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small. Unfortunately (at least outside of HN) "people who understand what this tool does" probably isn't a subset of "people who would run that "exe"."
- 2OEH8eoCRo0 2y agoThat's a problem with a lot of software and developers these days. An "About Me" section with a real face and presence is important and I don't mean anime characters and aliases either. Tell me who you are, put yourself out there.