Hacker News Reader

Comment by jcrawfordor | Hacker News Reader

There seems to be a lot of confusion in the comments about what's going on here.

1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved.

2. This has nothing at all to do with code signing.

3. Carbon Black is part of the category of "next generation antivirus" which are notorious for false positive problems. It relies heavily on cloud-based machine learning heuristic techniques to identify "malware-like" behavior. It's fairly well known in the industry that these methods are prone to mislearning uncommon runtimes and compression/obfuscation tools as malware.

4. Vendors of these products usually suggest that the false positive problem will be mitigated by the corporate security operations center reviewing and dismissing alerts, but in practice most corporations configure the product very conservatively and do not invest the resources in managing the false positives.

View on HN

I don't work in security, but I've had zero good experiences with the anti-virus vendor market in my small amount of interaction. These next-gen ones will tell you that you won't even know it's running because it's so efficient. It uses machine learning buzzwords to magically find intruders or viruses.

It's sad that these salesmen seem to have convinced lots of the right industry people that you really need them.

I work in security, and I've had zero good experiences with the anti-virus vendor market.

I can't think of a program more dangerous than one which intercepts and has option to receives every byte read from the filesystem -- while also having its own arbitrary network access ... the idea that employing such a tool could ever be better than _not_ having that tool is wrong at such a fundamental level that I don't understand how our computing society allows it to go on ...

If you have the latitude to architect things well it can work. Sadly, almost nobody does :(

CB is a family of security products that runs on Linux, Windows and MacOS - one particular product prevents binaries from running until they have been placed in an explicit allow list based on a hash signature. At least some of those "I changed my exe and now it won't run" sounds suspiciously like their machines are running that particular product.

> Microsoft is not involved.

In this case maybe not, but MS Defender doesn't like Nim (and Nimble), either[0][1].

[0] https://github.com/nim-lang/Nim/issues/18933

[1] https://forum.nim-lang.org/t/8196

Windows Defender often doesn't like Go programs either.

Not sure the current status but at least a few times a year I have Windows Defender flag Go programs I compiled myself locally as potential malware. This has happened as recently as November.

I double clicked on a js file inside a zip folder before by accident. It ran, did nothing, but I got an email from IT within hours saying I needed to wipe my device. It took a lot of convincing to avoid doing that.

God this makes me appreciate working in the only section of a company that allows unmanaged devices and allows users to image their machines with whatever they see fit.

I can't imagine the paranoia I'd feel with having spyware on my machine constantly calling home.

What why? That’s the typical configuration for very large corporations. Coping steps:

1. Do not use your work computer for personal data.

2. There is no step 2.

Its less about personal information and more that I'm never comfortable with constant observation, regardless of what I'm doing. I could be buying a bagel and feel uncomfortable with a camera or police officer.

Additionally, my work requires the ability to pivot quick with software and requires root access, hardware control, etc. I've regularly worked with coworkers in other areas of the company who spend a week setting up a workaround to the managed machine.

My colleagues and I all run personalized linux configurations and a typical managed machine would greatly hamper that. The company is large enough that the IT dept would not have time to manage all our exceptions so they just let us be.

It helps to look at it from the other direction as well: if you install the wrong NPM/PyPI package and something exfiltrates your corporate credentials, data, etc. how are you going to look if the managed device configuration would have stopped it? It's a change in how we think about computing but the old styles are not very secure and attackers have considerable experience exploiting those all or nothing security models. Having something which monitors unknown binaries being launched is the right choice for most people, and even developers really need some careful sandboxing (e.g. unless a new binary is in ~/Projects it's probably malware).

The other thing to consider: why should you care about what you work on being monitored? The most obvious reason is using work equipment for personal things, which is just a bad idea for a number of reasons starting with liability and data loss (e.g. if you get laid off, does anything get lost when your now-former employer does a remote wipe?). The other reason is if you don't have a good relationship with the security people, which is a social problem which needs to be addressed at a higher level since it'll show up in other areas, too. Rather than looking like you're being difficult or non-compliant, it's probably better to try to figure out what rules make sense - e.g. having some relationship with the endpoint monitoring people to get policy updates on a non-geologic time scale, having an official policy for who in IT security has access to data and how that's logged, etc. It's good to get that kind of thing nailed down before, say, the company gets hit with a lawsuit because one of the ITSec analysts thought it was okay to stalk that hot intern & spy on their personal web activity.

You can justify arbitrary security theater by only looking at the worst case scenario.

Do you justify constant GPSs surveilance because your work keys/cards might get stolen if you visit a bad neighbourhood? I hope not.

It's always a tradeoff of security vs. actually being able to do your job. Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.

Something isn't security theater because you don't personally have the same threat model or exposure. Attackers can easily avoid traditional antivirus software so people with more aggressive security postures have switched to investigating or blocking any unknown executable following pretty standard advice in the field that it's not sustainable to try to enumerate all of the bad things in the world.

Someone running random JavaScript out of a downloaded ZIP file matches the signature of a lot of attacks, and almost no legitimate activity: that's a super common technique to use something built-in like JScript rather than their own binary which might be blocked, and even web developers never do that intentionally since their code is running in a browser or something else like Node.

> Sure, a breach will cost a company but if you only have access to (mostly worthless) company "secrets" and no customer data then you really need to consider the likelyhood of having your data/credentials stolen, the cost that would have as well as the cost of the proposed security measures to your daily operation.

Some other costs to think about:

1. If you have any sort of cloud credential on your system, how quickly can you spend money before someone revokes it?

2. Can your system be used to attack any internal infrastructure? Deploy something in the cloud for further attacks?

3. Can your system be used to phish other people at your company by, say, sending realistic messages? What about customers?

Now, it's true that you have to consider the impact on daily work but in this case it's pretty low unless your job actually is to run random downloads and at any organization over a certain size the majority of times that alert trips it's probably going to be something where the cost of the malware which people routinely try to run would be non-trivial, too, even if you just measured it in the time it takes to investigate and cleanup.

Thats interesting, my internal custom-designed red team malware does that exact same thing (js file in a zip). Except for the "does nothing" part. Once you click on it, I start a covert command channel in the background, using DNS.

(ohh and it bypasses carbon black too, because .js isn't an executable :) )

How can a js file execute by clicking it? I have never seen that happen. Did you bind the file extension somehow your self?

Yeah probably. I was a little surprised myself, but it is my dev machine so not that surprised

JScript (Microsoft's JavaScript dialect) can be used as a general purpose scripting language (in purpose similar to shell scripts or maybe VBA, but using JavaScript and ActiveX). And until you install your first code editor to map the file extension to, the default action on double click is to execute the script.

Or at least that used to be the case, not sure if this is still a thing in Windows 10/11.

Active Scripting, including JScript, still ships out of the box in Win11. The file extension association is also there, but I don't recall if it's active by default, or you get the "how would you like to open?" dialog first.

This is the default behaviour in Windows. It runs in the Windows Script Host as JScript (Microsoft's version of ECMAScript) and has access to basically anything Win32 the current user has, the same as macros in Office

"AI powered heuristics" are so frustrating in AV. "This program runs on the CPU. Malware often runs on the CPU! It must be malware!"

They advertise high detection rates, but the secret is just flagging everything as malware - and thus also catching the sample malware in a stopped-clock-is-sometimes-right kind of way

What does "runs on the CPU" mean in this context? Don't all programs "run on the CPU"?

That is in fact the joke

I thought jokes on HN were forbidden by law?

No just by convention and a relatively high bar. Clever jokes get by, unclever ones are doubly downvoted.

That was their point, yes. These tools treat anything they see malware do as a potential signal of malware, without any consideration of what the activity is. Obviously they're not actually going to flag "running on a CPU" as a sign of malware, but it's a pretty reasonable parody of their methodology.

In my experience, most of these "cloud/advanced/ai" anti-virus tools will tag your executables if you use common open source packers (upx) or open source obfuscators. Using less common tools generally doesn't raise red flags (???), but you can often trick them into being okay with packed code if you sign it with an EV cert.

I had a Powershell script embedded in an executable I wrote in C. It launched Powershell as a sub-process and piped the script into standard input. Windows Defender thought my executable was some trojan (something like trojan:Win32/Wacatac.B!ml). So I gzipped the script as part of the build process, embedded the gzipped script instead, along with a single file decompression library, and decompressed it at runtime - now Windows Defender is okay with my program. Gosh, if I can do that, some malware author can too. If these “heuristic” detections are so easy to bypass, what’s the point?

To mark a checkbox on some security compliance form somewhere.

> 1. The problem is occurring primarily with Carbon Black, a third-party product acquired by VMWare a few years ago. Microsoft is not involved.

The posted thread links others concerning other tools' detections. This problem is widespread and affects the entire AV industry, including Microsoft's products. It also affects pretty much every browser via "Google Safe Browsing" - and Google certainly does not care any more about false positives than the AV vendors they source their detections from. Also, Google runs VirusTotal, which greatly widens the reach of these shitty AV tools. For some reason Google feels the need to hide that association.

> 2. This has nothing at all to do with code signing.

Perhaps. It shouldn't, but that doesn't mean that lazy AV writers won't consider signing as a signal that something is safe - after all, Windows itself does. There are at least many developers claiming that signing helps against false positive detections.

Reply on news.ycombinator.com