6 ms·

I don't work in cybersecurity and, after looking at the site's homepage, couldn't exactly figure out from all the buzzwords what exactly is this product. The mo

I don't work in cybersecurity and, after looking at the site's homepage, couldn't exactly figure out from all the buzzwords what exactly is this product. The most concerning takeaway from this article for me is that the maintainers of Huntress (whatever it is) can keep a log of, as well as personally access, the users' browser history, history of launched executables, device's hostname, and presumably a lot of other information. How is this product not a total security nightmare?

skulk 1y ago
It looks like Huntress is a "install this on your computer and we'll watch over your systems and keep you safe, for sure." I also find it kind of funny that the "blunder" mentioned in the title, according to the article is ... installing Huntress's agent. Do they look at every customer's google searches to see if they're suspicious too?
- neffy 1y ago
  It´s also a lot of assumptions. This probably is an attacker - or wannabe at least. But you could be a student or researcher working on a cyber security course looking and for some projects your search flow would look a lot like this.
  - viccis 1y ago
    They mention in the write up that they correlated certain indicators with what they had seen in other attacks to be reasonably sure they knew this was an active attacker. The problem to me is that this is the kind of thing you'd expect to see being done by a state intelligence organization with explicitly defined authorities to carry out surveillance of foreign attackers codified in law somewhere. For a private company to carry out a massive surveillance campaign against a target based on their own determination of the target's identity and to then publish all of that is much more legally questionable to me. It's already often ethically and legally murky enough when the state does it; for a private company to do it seems like they're operating well beyond their legal authority. I'd imagine (or hope I guess) that they have a lawyer who they consulted before this campaign as well as before this publication. Either way, not a great advertisement for your EDR service to show everyone that you're shoulder surfing your customers' employees and potentially posting all that to the internet if you decide they're doing something wrong.
    - fckgw 1y ago
      > The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent. The machine was already known to the company as belonging to a threat actor from previous activity
      - bornfreddy 1y ago
        That's not very convincing. They still abused trust placed in them - by an active attacker, granted, but still... This seems like a legally risky move and it doesn't inspire trust in Huntress.
        fckgw 1y ago
        Who's trust? Their job is to hunt down and research threat actors. The information gained from this is used to better protect their enterprise customers. This gains more trust with their customers and breaking trust with ... threat actors?
        viccis 1y ago
        >Who's trust? Their job is to hunt down and research threat actors No, their job is to provide EDR protection for their customers.
        cybergreg 1y ago
        Threat intelligence is a thing.in fact there’s entire companies that sell just that. In fact, there’s entire government organizations that do just that.
        viccis 1y ago
        Sure but that's not what their customer was engaging with them to do. It's not ethical to sell "EDR" services and then use that access to spy on your customers for intelligence purposes.
- pizzalife 1y ago
  Indeed, this article makes them look bad. Seems completely tone deaf to release this as a puff piece about the product.
  - cbisnett 1y ago
    Actually we just thought it was interesting that an attacker installed our EDR agent on the machine they use to attack their victims. That’s really bad operational security and we were able to learn a lot from that access.
    - ctoth 1y ago
      What is weird to me is that you have access to this information at all? It would make sense for the people who use your software ... the IT departments or whatever to have access but why on earth do your engineers need access? What gates access to your customers' machines? What triggers a write-up like this? Hostnames, "machine names" are ... not unique by nature.
      - cybergreg 1y ago
        Huntress is a cybersecurity company. They’re specifically hired for this purpose, to protect the company and its assets. As far as unique identifiers go, advertisers use a unique fingerprint of your browser to target you individually. Cookies, JavaScript, screen size, etc, are all used.
        ctoth 1y ago
        The article states that the "attacker" downloaded the software via a Google ad, not deployed by their corporate IT. I'm also slightly curious as to if you might be associated with an EDR vendor? I notice that you only have three comments ever, and they all seem to be defending how EDR software and Huntress works without engaging with this specific instance.
        moffkalast 1y ago
- mrbluecoat 1y ago
  I found that creepy too. Apparently `blunder == installing their software`
  - fckgw 1y ago
    A threat actor installing software specifically designed to log and monitor attacks from threat actors would be considered a blunder, no?
  - moffkalast 1y ago
    Well they aren't wrong. Crowdstrike showed how much of a blunder it can become.
- tgv 1y ago
  It's stated in the article: "The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent." However, it's obvious that protection-ware like this is essentially spyware with alerts. My company uses a similar service, and it includes a remote desktop tool, which I immediately blocked from auto-startup. But the whatever scanner sends things to some central service. All in the name of security.
  - boston_clone 1y ago
    Directly impinging the enterprise-approved security tooling is really not a good idea, no matter your own personal opinions on their functionality. Unless maybe you just want to develop a more personal relationship with your internal cybersecurity team, who knows.
    - jacquesm 1y ago
      Or with the HR team and the corporate security guys assisting your departure from the building holding a small cardboard box.
      - tgv 1y ago
        Things are not so rigid here. Idk how you could work in the environment you and the parent comment describe.
        jacquesm 1y ago
        I'm not. But I know plenty of people who do.
  - coppsilgold 1y ago
    I would assume any machine not owned by me is fully compromised and there is no recovery possible. And treat it accordingly, such as using it just for the purpose the owner of the machine dictates assuming I value that relationship. The startup script you blocked could have just been a decoy. And set off a red flag. A lot of these EDR's operate in kernel space.
- beefnugs 1y ago
  Well lets be real, you dont decide one day "today is the day we read one users entire history" and BLAMMO its a hacker! Lets keep reading!
d4mi3n 1y ago
It's definitely not a product for an individual user. Controls like this are useful in certain arenas where you need total visibility of corporate devices. As with any highly privileged tool or service, compromise of it can be a big problem. That said, the goal with tools like this is to usually lock down and keep a close eye on company issued laptops and the like so you know when one gets stolen, hit by some malware, or somebody does things with it they aren't allowed to be doing (e.g. exfiltrating corp data, watching porn at work, running unauthorized executable, connecting to problematic networks, etc.). As an example, if you're at a FedRAMP High certified service provider, the DoD wants to know that the devices your engineers are using to maintain the service they pay for aren't running a rootkit and that you can prove that said employee using that device isn't mishandling sensitive information.
- isatsam 1y ago
  This makes sense, but in this case, isn't the company behind Huntress having direct access to this data still a problem? For example, if the government purchased Outlook licenses, I'd assume DoD can read clerks' emails, but Microsoft employees can't. I imagine worst case compromising a lot of Huntress' users is just a question of compromising of its developers, like one of the people in the authors section of this article.
  - evanjrowley 1y ago
    Many businesses outsource their SOC to third parties like Huntress, Carbon Black, SentinelOne, all of whom offer very fancy Endpoint Detection and Respone (EDR) tools. Just about every EDR solution is a Cloud/SaaS offering provided either directly or indirectly through a third party Managed Service Provider (MSP). We call this Managed Detection and Respone (MDR). From technical and privacy standpoints, it probably sounds like a huge risk, but it's also worth acknowledging that EDR companies operate immense threat intelligence platforms through real-time monitoring of customers. From a C-suite perspective, it makes a lot of sense to offload the specializations of real-time protection and malware analysis to EDR solutions. There are risk managers who have quantified the risk tolerance for these types of products/arrangements. The company legal department, the CFO, and the board of directors are all satisfied with the EDR solutions placement on the Gartner quadrant and SOC Type 3 report saying the EDR provider follows best practices. Sometimes it's even a requirement for "cyber insurance" which a business may need depending on the industry. For better or for worse, EDR is how most institutions secure their IT infrastructure today.
esseph 1y ago
Huntress is a security company. One of the tools they make is a Endpoint Detection and Response (EDR) product. The kind of thing that goes on every laptop, server, and workstation in certain controlled environments (banks, government, etc.).
politelemon 1y ago
If you work in any mid to large enterprise, there is a tool like this installed on your laptop. It was put there by your security team.
jonstewart 1y ago
Their customers are companies. Almost every company, of at least a certain size, has one or more security tools installed on every host in the organization; there are called Endpoint Detection & Response (EDR) tools. Some marquee products are SentinelOne and CrowdStrike Falcon, but there are dozens. Huntress makes their own security tool but operates it for their customers as a service, which is called Managed Detection & Response (MDR). Everything on this page is legit.
xp84 1y ago
I was also frustrated by this. I got about 25% of the way in and was annoyed that they still did such a poor job of communicating what their product is. An advertorial like this can often save the "And that's why Our Product is so great, it can protect you from attacks like these!" for the end, but here, where the article is about how merely installing their product gives Huntress the company full access to everything you do, it leaves me with more questions than answers. As a corporate IT tool, I can see how Huntress ought to allow my IT department or my manager or my corporate counsel access to my browser history and everything I do, but I'm even still foggy on why Huntress grants themselves that level of access automatically. Sure, a peek into what the bad guys do is neat, and the actual person here doesn't deserve privacy for his crimes, but I'd love a much clearer explanation of why they were able to do this to him and how if I were an IT manager choosing to deploy this software, someone who works at Huntress wouldn't be able to just pull up one of my employee's browser history or do any other investigating of their computers.
- viccis 1y ago
  Their product is advertised as "Managed EDR". That usually means they employ a SOC that will review alerts and then triage and orchestrate responses accordingly. The use case here is when your IT manage chooses to deploy this and give them full visibility into your assets because your company wants to effectively outsource security response. It's a relatively common model, with MDR and MSSP providers doing similar things. I don't see it as much with EDR providers though.
cbisnett 1y ago
Thanks for the feedback on not understanding what we sell from the homepage. We sell an Endpoint Detection and Response (EDR) product that we manage with our 24/7 SOC. To perform the investigations on potentially malicious activity, we can fetch files from the endpoint and review them. We log all of this activity and make it available to our customers. We are an extension of their security team, which means they trust us with this access. We’ve been doing this for more than 10 years and have built up a pretty good reputation, but I can see how that would freak some folks out. We also sell to businesses, so this is something that would be installed on a work computer.
- isatsam 1y ago
  How was an individual user (in this article's case, a phishing sites developer) able to install your software and seemingly not notice the level of access they gave you to their computer?
  - cbisnett 1y ago
    Windows doesn’t have application permissions like Mac, iOS, and Android. An app doesn’t specify what it need to be able to do, it inherits the permissions of the user that launched it. Not a great permissions model, but it’s legacy all the way back to the earliest versions of Windows.
    - isatsam 1y ago
      This is a surprising response - I was expecting something like "they clicked past an alert notifying that they were giving us this level of access". Just because Windows only has a generic password prompt whenever an app wants to do something dangerous, doesn't mean you can't inform the user via your app's own UI. Others like AnyDesk do exactly that.
      - cybergreg 1y ago
        You’re really missing the point here. Huntress is an MDR, a cybersecurity company. They protect the endpoint by monitoring it for malicious activity and responding in kind. It’s what they do, not unlike Crowdstrike, Microsoft, etc. Generally a threat actor will install a security agent like this to find a bypass in order to attack more victims. They know exactly what they’re doing.
mc32 1y ago
Those things are what MTR/MDR solutions do. They track where you go and what processes are running and spawn other processes, etc. it allows tenants to see how an exploit progresses or stops, etc. these systems can also do web filtering for the tenant as well as keep logs as to what sessions get established and so on. That’s how these products work.
deedubaya 1y ago
It pains me how this comment illustrates how ignorant most folks are of the consequences of installing software off the internet is (even technically inclined folks that hang out on HN). How many of us have non-security software installed on our computers today that do exactly these things... but sell the information? Definitely a non-zero number! If folks understood this better, there would be less reason for software like Huntress' EDR to exist.
- ctoth 1y ago
  I don't think anyone is unfamiliar with the consequences of installing potential malware. I think people are surprised that a seemingly? legit company is going off and having a little pokeabout on arbitrary computers based on nothing more than a hostname match. Then sharing screenshots on HN. I guess they're Canadian but wow does this seem to have CFAA written all over it?
  - deedubaya 1y ago
    Where can I find that Potential Malware Inside™ sticker that warns everyone else who is familiar with the consequences? Asking for a friend!
    - ctoth 1y ago
      https://www.etsy.com/market/malware_stickers https://www.etsy.com/market/malware_stickers or https://www.zazzle.com/alert_malware_detected_avoid_clicking_sticker-256207918092674985?srsltid=AfmBOorBx--DOKZSYUPC19vhgwqgmioaPem2i9u9tbDqjR4p1R13rfZ- https://www.zazzle.com/alert_malware_detected_avoid_clicking...
  - couchridr 1y ago
    Probably the huntress user agreed to hundreds of conditions when he clicked “I agree to the terms of service.”
- aaron695 1y ago
  [dead]
spogbiper 1y ago
If you work for a company that's bigger than a mom and pop, chances are very good that your IT department has this same level of access to any computer used in the organization. Huntress is basically an outsourced portion of the IT department for smaller companies that don't have their own 24/7 security team. It's a pretty common thing, with many vendors offering this type of service. Your work computer may have a similar product/service installed
- ctoth 1y ago
  This makes total sense.. Except who is the SMB in this case? It sounds like the person just downloaded this off the Internet, it wasn't pre-installed by IT. So it sounds like Huntress has full and complete access to whoever downloads their software to try it out/demo it... and aren't afraid to use this access for their own purposes/just do a bit of poking around because why not? When a hostname matches?
  - spogbiper 1y ago
    yeah i don't know about the legality or morality of what huntress did here. i just know these types of products/this level of access are very common
  - viccis 1y ago
    Reminds me of when a Hostgator employee told me on reddit that he liked digging through peoples' websites and chatted with me about the stuff I had hosted on my website.
    - Sophira 1y ago
      That's potentially different, to be fair. Websites are generally made with the intention of making them public, and unless you're digging through stuff that hasn't been made public, there's nothing wrong with browsing your customers' websites and talking about it. (Of course, maybe that's what the Hostgator employee was doing - in which case, shame on them.) On the other hand, I'm pretty sure that the person who installed Huntress did not intend to upload any info at all, let alone to have that information made public.
dboreham 1y ago
> couldn't exactly figure out from all the buzzwords what exactly is this product I suspect this is deliberate.
deleted 1y ago
[deleted]

skulk 1y ago

It looks like Huntress is a "install this on your computer and we'll watch over your systems and keep you safe, for sure." I also find it kind of funny that the "blunder" mentioned in the title, according to the article is ... installing Huntress's agent. Do they look at every customer's google searches to see if they're suspicious too?

neffy 1y ago
It´s also a lot of assumptions. This probably is an attacker - or wannabe at least. But you could be a student or researcher working on a cyber security course looking and for some projects your search flow would look a lot like this.
- viccis 1y ago
  They mention in the write up that they correlated certain indicators with what they had seen in other attacks to be reasonably sure they knew this was an active attacker. The problem to me is that this is the kind of thing you'd expect to see being done by a state intelligence organization with explicitly defined authorities to carry out surveillance of foreign attackers codified in law somewhere. For a private company to carry out a massive surveillance campaign against a target based on their own determination of the target's identity and to then publish all of that is much more legally questionable to me. It's already often ethically and legally murky enough when the state does it; for a private company to do it seems like they're operating well beyond their legal authority. I'd imagine (or hope I guess) that they have a lawyer who they consulted before this campaign as well as before this publication. Either way, not a great advertisement for your EDR service to show everyone that you're shoulder surfing your customers' employees and potentially posting all that to the internet if you decide they're doing something wrong.
  - fckgw 1y ago
    > The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent. The machine was already known to the company as belonging to a threat actor from previous activity
    - bornfreddy 1y ago
      That's not very convincing. They still abused trust placed in them - by an active attacker, granted, but still... This seems like a legally risky move and it doesn't inspire trust in Huntress.
      - fckgw 1y ago
        Who's trust? Their job is to hunt down and research threat actors. The information gained from this is used to better protect their enterprise customers. This gains more trust with their customers and breaking trust with ... threat actors?
        viccis 1y ago
        >Who's trust? Their job is to hunt down and research threat actors No, their job is to provide EDR protection for their customers.
        cybergreg 1y ago
        Threat intelligence is a thing.in fact there’s entire companies that sell just that. In fact, there’s entire government organizations that do just that.
        viccis 1y ago
        Sure but that's not what their customer was engaging with them to do. It's not ethical to sell "EDR" services and then use that access to spy on your customers for intelligence purposes.
pizzalife 1y ago
Indeed, this article makes them look bad. Seems completely tone deaf to release this as a puff piece about the product.
- cbisnett 1y ago
  Actually we just thought it was interesting that an attacker installed our EDR agent on the machine they use to attack their victims. That’s really bad operational security and we were able to learn a lot from that access.
  - ctoth 1y ago
    What is weird to me is that you have access to this information at all? It would make sense for the people who use your software ... the IT departments or whatever to have access but why on earth do your engineers need access? What gates access to your customers' machines? What triggers a write-up like this? Hostnames, "machine names" are ... not unique by nature.
    - cybergreg 1y ago
      Huntress is a cybersecurity company. They’re specifically hired for this purpose, to protect the company and its assets. As far as unique identifiers go, advertisers use a unique fingerprint of your browser to target you individually. Cookies, JavaScript, screen size, etc, are all used.
      - ctoth 1y ago
        The article states that the "attacker" downloaded the software via a Google ad, not deployed by their corporate IT. I'm also slightly curious as to if you might be associated with an EDR vendor? I notice that you only have three comments ever, and they all seem to be defending how EDR software and Huntress works without engaging with this specific instance.
        moffkalast 1y ago
mrbluecoat 1y ago
I found that creepy too. Apparently `blunder == installing their software`
- fckgw 1y ago
  A threat actor installing software specifically designed to log and monitor attacks from threat actors would be considered a blunder, no?
- moffkalast 1y ago
  Well they aren't wrong. Crowdstrike showed how much of a blunder it can become.
tgv 1y ago
It's stated in the article: "The standout red flag was that the unique machine name used by the individual was the same as one that we had tracked in several incidents prior to them installing the agent." However, it's obvious that protection-ware like this is essentially spyware with alerts. My company uses a similar service, and it includes a remote desktop tool, which I immediately blocked from auto-startup. But the whatever scanner sends things to some central service. All in the name of security.
- boston_clone 1y ago
  Directly impinging the enterprise-approved security tooling is really not a good idea, no matter your own personal opinions on their functionality. Unless maybe you just want to develop a more personal relationship with your internal cybersecurity team, who knows.
  - jacquesm 1y ago
    Or with the HR team and the corporate security guys assisting your departure from the building holding a small cardboard box.
    - tgv 1y ago
      Things are not so rigid here. Idk how you could work in the environment you and the parent comment describe.
      - jacquesm 1y ago
        I'm not. But I know plenty of people who do.
- coppsilgold 1y ago
  I would assume any machine not owned by me is fully compromised and there is no recovery possible. And treat it accordingly, such as using it just for the purpose the owner of the machine dictates assuming I value that relationship. The startup script you blocked could have just been a decoy. And set off a red flag. A lot of these EDR's operate in kernel space.
beefnugs 1y ago
Well lets be real, you dont decide one day "today is the day we read one users entire history" and BLAMMO its a hacker! Lets keep reading!

d4mi3n 1y ago

It's definitely not a product for an individual user. Controls like this are useful in certain arenas where you need total visibility of corporate devices. As with any highly privileged tool or service, compromise of it can be a big problem. That said, the goal with tools like this is to usually lock down and keep a close eye on company issued laptops and the like so you know when one gets stolen, hit by some malware, or somebody does things with it they aren't allowed to be doing (e.g. exfiltrating corp data, watching porn at work, running unauthorized executable, connecting to problematic networks, etc.). As an example, if you're at a FedRAMP High certified service provider, the DoD wants to know that the devices your engineers are using to maintain the service they pay for aren't running a rootkit and that you can prove that said employee using that device isn't mishandling sensitive information.

isatsam 1y ago
This makes sense, but in this case, isn't the company behind Huntress having direct access to this data still a problem? For example, if the government purchased Outlook licenses, I'd assume DoD can read clerks' emails, but Microsoft employees can't. I imagine worst case compromising a lot of Huntress' users is just a question of compromising of its developers, like one of the people in the authors section of this article.
- evanjrowley 1y ago
  Many businesses outsource their SOC to third parties like Huntress, Carbon Black, SentinelOne, all of whom offer very fancy Endpoint Detection and Respone (EDR) tools. Just about every EDR solution is a Cloud/SaaS offering provided either directly or indirectly through a third party Managed Service Provider (MSP). We call this Managed Detection and Respone (MDR). From technical and privacy standpoints, it probably sounds like a huge risk, but it's also worth acknowledging that EDR companies operate immense threat intelligence platforms through real-time monitoring of customers. From a C-suite perspective, it makes a lot of sense to offload the specializations of real-time protection and malware analysis to EDR solutions. There are risk managers who have quantified the risk tolerance for these types of products/arrangements. The company legal department, the CFO, and the board of directors are all satisfied with the EDR solutions placement on the Gartner quadrant and SOC Type 3 report saying the EDR provider follows best practices. Sometimes it's even a requirement for "cyber insurance" which a business may need depending on the industry. For better or for worse, EDR is how most institutions secure their IT infrastructure today.

esseph 1y ago

Huntress is a security company. One of the tools they make is a Endpoint Detection and Response (EDR) product. The kind of thing that goes on every laptop, server, and workstation in certain controlled environments (banks, government, etc.).

politelemon 1y ago

If you work in any mid to large enterprise, there is a tool like this installed on your laptop. It was put there by your security team.

jonstewart 1y ago

Their customers are companies. Almost every company, of at least a certain size, has one or more security tools installed on every host in the organization; there are called Endpoint Detection & Response (EDR) tools. Some marquee products are SentinelOne and CrowdStrike Falcon, but there are dozens. Huntress makes their own security tool but operates it for their customers as a service, which is called Managed Detection & Response (MDR). Everything on this page is legit.

xp84 1y ago

I was also frustrated by this. I got about 25% of the way in and was annoyed that they still did such a poor job of communicating what their product is. An advertorial like this can often save the "And that's why Our Product is so great, it can protect you from attacks like these!" for the end, but here, where the article is about how merely installing their product gives Huntress the company full access to everything you do, it leaves me with more questions than answers. As a corporate IT tool, I can see how Huntress ought to allow my IT department or my manager or my corporate counsel access to my browser history and everything I do, but I'm even still foggy on why Huntress grants themselves that level of access automatically. Sure, a peek into what the bad guys do is neat, and the actual person here doesn't deserve privacy for his crimes, but I'd love a much clearer explanation of why they were able to do this to him and how if I were an IT manager choosing to deploy this software, someone who works at Huntress wouldn't be able to just pull up one of my employee's browser history or do any other investigating of their computers.

viccis 1y ago
Their product is advertised as "Managed EDR". That usually means they employ a SOC that will review alerts and then triage and orchestrate responses accordingly. The use case here is when your IT manage chooses to deploy this and give them full visibility into your assets because your company wants to effectively outsource security response. It's a relatively common model, with MDR and MSSP providers doing similar things. I don't see it as much with EDR providers though.

cbisnett 1y ago

Thanks for the feedback on not understanding what we sell from the homepage. We sell an Endpoint Detection and Response (EDR) product that we manage with our 24/7 SOC. To perform the investigations on potentially malicious activity, we can fetch files from the endpoint and review them. We log all of this activity and make it available to our customers. We are an extension of their security team, which means they trust us with this access. We’ve been doing this for more than 10 years and have built up a pretty good reputation, but I can see how that would freak some folks out. We also sell to businesses, so this is something that would be installed on a work computer.

isatsam 1y ago
How was an individual user (in this article's case, a phishing sites developer) able to install your software and seemingly not notice the level of access they gave you to their computer?
- cbisnett 1y ago
  Windows doesn’t have application permissions like Mac, iOS, and Android. An app doesn’t specify what it need to be able to do, it inherits the permissions of the user that launched it. Not a great permissions model, but it’s legacy all the way back to the earliest versions of Windows.
  - isatsam 1y ago
    This is a surprising response - I was expecting something like "they clicked past an alert notifying that they were giving us this level of access". Just because Windows only has a generic password prompt whenever an app wants to do something dangerous, doesn't mean you can't inform the user via your app's own UI. Others like AnyDesk do exactly that.
    - cybergreg 1y ago
      You’re really missing the point here. Huntress is an MDR, a cybersecurity company. They protect the endpoint by monitoring it for malicious activity and responding in kind. It’s what they do, not unlike Crowdstrike, Microsoft, etc. Generally a threat actor will install a security agent like this to find a bypass in order to attack more victims. They know exactly what they’re doing.

mc32 1y ago

Those things are what MTR/MDR solutions do. They track where you go and what processes are running and spawn other processes, etc. it allows tenants to see how an exploit progresses or stops, etc. these systems can also do web filtering for the tenant as well as keep logs as to what sessions get established and so on. That’s how these products work.

deedubaya 1y ago

It pains me how this comment illustrates how ignorant most folks are of the consequences of installing software off the internet is (even technically inclined folks that hang out on HN). How many of us have non-security software installed on our computers today that do exactly these things... but sell the information? Definitely a non-zero number! If folks understood this better, there would be less reason for software like Huntress' EDR to exist.

ctoth 1y ago
I don't think anyone is unfamiliar with the consequences of installing potential malware. I think people are surprised that a seemingly? legit company is going off and having a little pokeabout on arbitrary computers based on nothing more than a hostname match. Then sharing screenshots on HN. I guess they're Canadian but wow does this seem to have CFAA written all over it?
- deedubaya 1y ago
  Where can I find that Potential Malware Inside™ sticker that warns everyone else who is familiar with the consequences? Asking for a friend!
  - ctoth 1y ago
    https://www.etsy.com/market/malware_stickers https://www.etsy.com/market/malware_stickers or https://www.zazzle.com/alert_malware_detected_avoid_clicking_sticker-256207918092674985?srsltid=AfmBOorBx--DOKZSYUPC19vhgwqgmioaPem2i9u9tbDqjR4p1R13rfZ- https://www.zazzle.com/alert_malware_detected_avoid_clicking...
- couchridr 1y ago
  Probably the huntress user agreed to hundreds of conditions when he clicked “I agree to the terms of service.”
aaron695 1y ago
[dead]

spogbiper 1y ago

If you work for a company that's bigger than a mom and pop, chances are very good that your IT department has this same level of access to any computer used in the organization. Huntress is basically an outsourced portion of the IT department for smaller companies that don't have their own 24/7 security team. It's a pretty common thing, with many vendors offering this type of service. Your work computer may have a similar product/service installed

ctoth 1y ago
This makes total sense.. Except who is the SMB in this case? It sounds like the person just downloaded this off the Internet, it wasn't pre-installed by IT. So it sounds like Huntress has full and complete access to whoever downloads their software to try it out/demo it... and aren't afraid to use this access for their own purposes/just do a bit of poking around because why not? When a hostname matches?
- spogbiper 1y ago
  yeah i don't know about the legality or morality of what huntress did here. i just know these types of products/this level of access are very common
- viccis 1y ago
  Reminds me of when a Hostgator employee told me on reddit that he liked digging through peoples' websites and chatted with me about the stuff I had hosted on my website.
  - Sophira 1y ago
    That's potentially different, to be fair. Websites are generally made with the intention of making them public, and unless you're digging through stuff that hasn't been made public, there's nothing wrong with browsing your customers' websites and talking about it. (Of course, maybe that's what the Hostgator employee was doing - in which case, shame on them.) On the other hand, I'm pretty sure that the person who installed Huntress did not intend to upload any info at all, let alone to have that information made public.

dboreham 1y ago

> couldn't exactly figure out from all the buzzwords what exactly is this product I suspect this is deliberate.

deleted 1y ago

[deleted]