Hacker News Reader

The funny thing about these is that the obfuscator leaves a billion clues that can tip you off that the macro is malicious, without even having to run it. Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...

View on HN

> Any human being can tell you that DKTxHE is a bogus name for a function, so the only trick is to implement that detection in code...

Don't people run code obfuscators on macros?

> the only trick is to implement that detection in code

String entropy scoring works surprisingly well for problems like this: build a corpus of function names (scrape it from github?), generate a markov model, see how probable the candidate function name is according to the markov model.

Then I'll just run a prettifyer with the same sample data and name functions in my malicious macros from that.

Like a lot of things, it's an arms race. For the most part people aren't doing that yet because it's easier, and almost as effective, to just generate them at random.

Reply on news.ycombinator.com