News for hackers. Stuff that matters.

A comment on Software security suffers as startups lose access to Google’s virus data. Parent comment

Re:Software security suffers as startups lose access to Goog... by newjersey on Monday May 09, 2016 @06:10AM (#11658652)
Sentinel One's position didn't make sense to me.

> “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.”

> Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as companies are excluded.

Even Microsoft's offering has an "advanced membership" through which they encourage users to share specimen of detected suspicious activity back to the mother ship. If Sentinel One can detect, they should be able contribute back?

> The company claims to have a number of customer wins with a malware detection rate of over 90% for zero-day threats.

https://en.wikipedia.org/wiki/SentinelOne

What are they saying?

[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by The_Magistrate on Monday May 09, 2016 @10:34AM (#11660109)
SentinalOne probably approached VirusTotal with specific requirements about how they wanted to contribute back, and VirusTotal said 'you can contribute the same way everyone else does.' The rest is marketing BS.
[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by iancarroll on Monday May 09, 2016 @10:54AM (#11660257)
It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.
[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by pandemicsyn on Monday May 09, 2016 @11:30AM (#11660547)
Yup, that seems likely. Their whole shtick is that signature based checks don't cut it and that their behavior based system is the way to go.

https://en.wikipedia.org/wiki/SentinelOne#Technology

https://www.sentinelone.com

[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by sjg007 on Monday May 09, 2016 @02:17PM (#11661909)
Sure but then generate a signature and submit it.
[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by iancarroll on Monday May 09, 2016 @04:51PM (#11663062)
It's not really that easy...
[ Parent | on HN ]
Re:Software security suffers as startups lose access to Goog... by sjg007 on Monday May 09, 2016 @11:18PM (#11664953)
It's not that hard.
[ Parent | on HN ]