38 replies to this topic

[Copernic]

Interesting discussion with a hacker on Reddit. Microsoft Security Essentials is the most preferred and easiest to bypass (according to this guy).

Some screens: http://i.imgur.com/yxMDx.jpg

Highlights:

(R - Reddit / H - Hacker)

R: What anti virus software free/paid for presents to you the biggest obstacles?
H: Kaspersky was the most challenging at first, Kaspersky is paranoid as f...k! But it has an exploit in KIS, KAV and PURE, allowing to start malicious code in the memory context of a trusted system process unnoticed. Kaspersky won't interfere if it thinks it's the system process doing changes to the system.

R: What advice can you give to us "average" folk on how to stay secure online?
H: If the attachment is ending in .exe and pretending to be something else, it's malware for sure. If it's a .pdf it can only infect you if you haven't patched your Adobe Reader (Is now done automaticly). Cybercriminals use 0day exploits only on valueable targets like Iranian power plants or companies with intellectual properties and ****ing lot of cash.
- Facebook friends don't share funny cat pictures on randomly generated domain names.
- If your AV says it's clean or even if Virustotal gives you 0/43 it can still be malware, been there, seen that. Srsly, don't trust your AV.
- Use HBCI or similiar for online banking, it costs 30$ and is military grade cryptography (private key signing), only open source cryptography on signed hardware is 100% secure.
- Windows updates, yes, do them. If you have a pirated copy, just buy that **** or use linux.
- If you are super paranoid, buy a netbook and use a LiveCD or similiar on it whenever you put your CC information in.
- Banking on mobile phone, it's stupid, but atm 'not that dangerous as it seems', because 99% of cybercriminals can't code and there is no (serious) android or iOS malware yet on the market.

R: Does this mean Linux or MAC OSx are impermeable to malware? If so, why? If not, what's the best way Linux or MAC users see if they've been infected?
H: No, but Linux is not targeted, because it is not economical.

R: What do you use to spread?
H: Automatically backdooring warez and uploading it to one click hoster and Usenet. It's funny that even governmental agencies use warez, I found FAA.gov credentials. My momma always said, "A botnet is like a box of chocolates. You never know what you're gonna get."

R: why?
H: It first started as a challenge to circumvent AntiVirus systems, but then I realised all AV suck at detection and it's easy to make money with it.

R: how about making a better AV detection system and profiting off that?
H: AV is a completely wrong approach to security. If you need AV to feel secure you already failed.

R: First, thanks for the AMA, really interesting. Could you write some "perfect protection" AV software yourself? I bet you could make a ****ton of cash even if it is a one time sale per person. Is there hacker-folk interest in putting AV companies out of business by giving away or selling cheap, far superior, protection? Would it be more fun to screw over big companies who sell snake oil?
H: Most "hacker-folk" kinda work at AV companies already. There is already a company going the "elimate it at the root" approach: http://www.triumfant.com . But it's not that easy, the big companies have the moneys, Symantec has the colorful commercials, McAfee has the governmental contracts for voting machines AV (Mr. McAfee has btw the same lifestyle as your average Russian Spam King: 66 years old, huge house in a tropical country, 17 year old girlfriend, lots of unregistered weapons lol). It's not about the product itself, it's about power and influence. Read about the "HBGary federal accident" or watch the Defcon 19 video with "Aaron Van Barr (totally not Aaron Barr, because he wasn't allowed to be there )". Changing the security industry is like changing the copyright system.

R: you're the reason we can't have nice things.
H: People who can just about start Facebook and put in their credit cards are the reason such things exist. Antivirus companies selling snakeoil and lull consumers into absolute security are another one.

Read more:
http://www.reddit.co...t_operator_ama/

[Deathknight74]

Very interesting article.

[+Daedroth]

Interesting article, but from reading the 'hackers' responses, I can tell they are pretty young.

[SirEvan]

I kinda disagree. Sure, hackers who know their stuff can get around AV, but I've seen others, as well as experienced myself, when Nod32 catches a virus in an email attachment, thus saving me from ever having to see it in my system. Am I 100% protected? of course not, but just like condoms, and everything else...you can never be 100% safe from anything. I think a reputable (kaspersky/nod32) antivirus app, along with a decent firewall, and a HUGE dose of common sense and logic are your best tools for staying safe from malware/viruses.

[TRC]

I stopped using antivirus programs a decade ago, just a waste of resources. Never had a virus anyway or any other malware, I don't know how people even get this stuff on their systems. Common sense is the best antivirus.

[veternan]

MSE forever and I have VM to test my suspicious files there...But The most sophisticated technology I have is MYSELF

[Xahid]

Common sense is best protection for sure, but some time, things happened with or without your acknowledgement, This is where you need AV. which can scan your trustworthy objects too.

[cork1958]

TRC, on 23 May 2012 - 08:27, said:

I stopped using antivirus programs a decade ago, just a waste of resources. Never had a virus anyway or any other malware, I don't know how people even get this stuff on their systems. Common sense is the best antivirus.

Yeah,
Like you'd know if you were infected or not if you don't have anything to scan with! Always love it when people say I've never been infected with anything then admit to being dumb enough not to even have any protection!

Whether they're worthless or not, something is better than nothing and if you're worried about resources on todays computers, you shouldn't even own a computer anyway!

[Deathknight74]

So from what I gather from the article is that if you really need protection you should use Linux and not depend on your anti-virus or anti malware software. Am I right?

[James123]

Downloading the source for a bot, modifying it slightly so Anti-viruses don't flag it and then distributing it via usenet/email makes you a "hacker" these days ? He seems no more knowledgeable than the average script kiddie.

[+Spirit Dave]

I was using anti-virus on my Mac before I re-installed to run Mountain Lion. And I must admit, everything he's saying is what I've already figured ... I simply don't need Anti-virus. I don't download illegal software, I only download from the Mac App Store or in rare cases, apps such as Skype from the official source. I don't click on ANY links on Facebook. I don't open myself to any scamming because my bank account is locked with a hardware pin device that I need to use to purchase items and use internet banking, and without that device linked to the PIN on my card, it's not possible to do anything with the account. Which can be annoying but is very secure.

So yeah ... I always install AV on friends and family machines because I know they're not going to be as sensible. But when you know enough about what you're doing and you use all legit stuff via secure servers/sources, you really can't fail. Or at least if things did go wrong, they'd be a one in a billion chance.

[+sanke1]

Boasting about having common sense instead of using antivirus is like boasting about having sex without using a condom. (you never know the stranger you slept with had AIDS or not and same applies to the world of cybersecurity.)

[+ShMaunder]

I still use them on Windows - though I am still using XP. When I used windows full time, I used to get a malware pop up being denied about once every 2 months. So I do feel somewhat protected - though better protection is using a sandbox.

[+primortal]

On the flip side of the coin. Maybe this hacker is thinking that if reader would believe's the fact that A/V software is useless and decide to stop using A/V thus making the hackers life easier to infect devices....

[Belazor]

Spirit Dave, on 23 May 2012 - 11:18, said:

I was using anti-virus on my Mac before I re-installed to run Mountain Lion. And I must admit, everything he's saying is what I've already figured ... I simply don't need Anti-virus. I don't download illegal software, I only download from the Mac App Store or in rare cases, apps such as Skype from the official source. I don't click on ANY links on Facebook. I don't open myself to any scamming because my bank account is locked with a hardware pin device that I need to use to purchase items and use internet banking, and without that device linked to the PIN on my card, it's not possible to do anything with the account. Which can be annoying but is very secure.

But that wouldn't stop random ad banners from infecting you via some 0day exploit or some other plugin vulnerability.

The site doesn't have to be dodgy in and of itself, but they might not whitelist advertisers as opposed to blacklisting bad ones - or their ad company may not be performing this kind of scrutiny with their advertising clients.

I believe an MMA site called BloodyElbow had an issue in the past, at least one of my friends were able to narrow that site down to one of the most likely candidates. That doesn't mean they are a malicious site, if they were in fact the source then they just had some bad luck with a banner - not their direct fault.

But my point is, you'd call a site trustworthy even if they don't scrutinise every ad banner, and the banners could potentially still infect you.