3 ms·

This article is written so poorly or targeted at the most unknowing user most of the information has been watered down to be useless.

bookofjoe 2y ago
This comment troubles me because of this: >Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. Dan is based in San Francisco. Follow him at @dangoodin on Mastodon. Contact him on Signal at DanArs.82. With the credentials of the author being seemingly impeccable, how can his article be so bad?
- ddtaylor 2y ago
  I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under the implication of sophistication. Using TOR for exfiltration or C2 related activities is amateur as it obviously will be detected. A minimum standard in this category for malware is something that makes use of primary gadgets of trusted hosts like Google, Microsoft or Apple. A more sophisticated area of this are various abuses of DNS and other accepted protocols where data can be stuffed into "trusted" records by places like Cloudflare. > Stopping activities that are easy to detect when a new user logs in This and a few other "points" like this seem like filler. This has been a thing malware does since the beginning and is the most basic anti-detection "technique" possible. > Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic At least he mentions the specific thing being hooked here, but again, the idea that malware would override the system or an API in some way to lie to the rest of the system is one of the most fundamental things a malware can do. > It gets installed by exploiting more than 20,000 common misconfigurations That's probably a very long-winded and hand-wavy way to say they are probably using Metasploit or similar.

bookofjoe 2y ago

This comment troubles me because of this: >Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. Dan is based in San Francisco. Follow him at @dangoodin on Mastodon. Contact him on Signal at DanArs.82. With the credentials of the author being seemingly impeccable, how can his article be so bad?

ddtaylor 2y ago
I have no idea why, but I can elaborate a bit. Here are some highlights: > Using a Unix socket over TOR for external communications This is being said under the implication of sophistication. Using TOR for exfiltration or C2 related activities is amateur as it obviously will be detected. A minimum standard in this category for malware is something that makes use of primary gadgets of trusted hosts like Google, Microsoft or Apple. A more sophisticated area of this are various abuses of DNS and other accepted protocols where data can be stuffed into "trusted" records by places like Cloudflare. > Stopping activities that are easy to detect when a new user logs in This and a few other "points" like this seem like filler. This has been a thing malware does since the beginning and is the most basic anti-detection "technique" possible. > Manipulating the Linux process pcap_loop through a technique known as hooking to prevent admin tools from recording the malicious traffic At least he mentions the specific thing being hooked here, but again, the idea that malware would override the system or an API in some way to lie to the rest of the system is one of the most fundamental things a malware can do. > It gets installed by exploiting more than 20,000 common misconfigurations That's probably a very long-winded and hand-wavy way to say they are probably using Metasploit or similar.