News for hackers. Stuff that matters.

A comment on What the CIA WikiLeaks Dump Tells Us: Encryption Works. Parent comment

Re:What the CIA WikiLeaks Dump Tells Us: Encryption Works by fnordfnordfnord on Saturday March 11, 2017 @11:53AM (#13846076)
>If you treat the software as a black box and only study run time behavior, you have no idea if you have tripped a countermeasure that silences the malicious behavior; if you study the control flow directly, you can look for such countermeasures.

It would be great to find such a countermeasure, and be able to trigger it reliably, or assert the behavior on a permanent basis. Considering that particular weakness of such countermeasures though, wouldn't the safest [for the attacker] default countermeasure likely be to simply crash the device?

[ Parent | on HN ]
Re:What the CIA WikiLeaks Dump Tells Us: Encryption Works by maxerickson on Saturday March 11, 2017 @12:04PM (#13846122)
Could be.

A user that knows about malicious code (which you would have to in order to trigger it to go silent) in a binary just shouldn't use the binary at all though.

The broader point is more important: compiled software isn't a black box, treating it like a black box is not the only or best way to analyze it.

[ Parent | on HN ]