StrongPity: Advanced Persistent Threat

Re:StrongPity: Advanced Persistent Threat by poorman on Monday October 10, 2016 @11:12AM (#12677488)

Seems like there could be a use for a distributed service that automatically checks the signature of common downloaded executables --especially for in Microsoft world. It's not enough for vendors to simply put the signature on their website.

[ Parent | on HN ]

Re:StrongPity: Advanced Persistent Threat by arkem on Monday October 10, 2016 @11:28AM (#12677595)

This exists, it's not 100% effective because it's generally implemented as a UI flow change where less trusted binaries get scarier "are you sure?" popups and only the most obviously malicious files are blocked.

Edge has Microsoft SmartScreen[1], Chrome has CAMP[2] / Safe Browsing and Firefox has a system that also uses Google's data[3].

[1] https://technet.microsoft.com/en-us/itpro/microsoft-edge/sec...

[2] https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf

[3] https://wiki.mozilla.org/Security/Features/Application_Reput...

Edit: I missed that part where you were meant pro actively check against publisher provided signatures. The above systems do that only via looking at the code's embedded signature and indirectly via "wisdom of the crowds" style reputation.

[ Parent | on HN ]

Re:StrongPity: Advanced Persistent Threat by mordocai on Monday October 10, 2016 @11:20AM (#12677545)

Not distributed but for windows users, https://chocolatey.org/. According to https://chocolatey.org/security it verifies package checksums.

Of course chocolatey itself could be compromised.

[ Parent | on HN ]

Re:StrongPity: Advanced Persistent Threat by mynameislegion on Monday October 10, 2016 @11:35AM (#12677668)

Something like Certificate Transparency but for binaries and source code?

[ Parent | on HN ]