News for hackers. Stuff that matters.

A comment on Malware identified in CCleaner 5.33. Parent comment

Re:Malware identified in CCleaner 5.33 by kevin_thibedeau on Monday September 18, 2017 @08:52AM (#15275372)
The culprit was the non-free AV. Gone are the days of simple passive signature scanners. Now they all sink their claws deeply into the OS intercepting filesystem operations, network packets, and any other privileged activity. Performance be damned.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by danieldk on Monday September 18, 2017 @10:19AM (#15276159)
Gone are the days of simple passive signature scanners. Now they all sink their claws deeply into the OS intercepting filesystem operations, network packets, and any other privileged activity.

Well, things have been like that for a long time already. E.g. Thunderbyte used an ISA card in the early 90ies to insert itself before and outside the operating system [1].

Old anti-virus programs also used Terminate and Stay Resident (TSR) [2]

[1] https://en.wikipedia.org/wiki/ThunderByte_Antivirus

[2] https://en.wikipedia.org/wiki/MSAV

[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by digi_owl on Monday September 18, 2017 @06:02PM (#15280078)
On the note of ISA cards, i once helped install a card on some school computers that inserted itself before the OS loaded and split the HDD in half. This so that on certain conditions a clean version of the OS etc could be loaded from the half that was hidden during normal use.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by voltagex_ on Monday September 18, 2017 @08:32PM (#15280888)
DeepFreeze? I thought it was all software.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by digi_owl on Tuesday September 19, 2017 @12:58PM (#15286406)
Do not recall the brand, i just helped install them and set up the initial install of OS and software.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by 0xfeba on Monday September 18, 2017 @10:38AM (#15276317)
Free and non-free AV are liabilities at this point (for Windows). Microsoft has never had an official way to let AV hook into the system calls needed, so they all relied on hacks and shifty stuff.

Surprise, surprise, now there is more attack surface available since AV is kernel level. And so now we see attacks getting root or kernel level access via AV vulnerabilities.

[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by srcmap on Monday September 18, 2017 @12:03PM (#15277040)
Unfortunately attack surface on AV also includes Windows Defender itself:

https://arstechnica.com/information-technology/2017/06/lates...

[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by nugget on Monday September 18, 2017 @12:18PM (#15277173)
This is why security mono-culture is dangerous and it's in our interest to maintain a diverse ecosystem of security vendors in every area. Security is hard and anyone can have a serious vulnerability.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by Dylan16807 on Monday September 18, 2017 @01:10PM (#15277632)
I'll still take 1-2 vendors that actually have security as a top priority over a variety of vendors that care plenty about features and detection rates but not about actually hardening their code.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by happy-go-lucky on Monday September 18, 2017 @09:14AM (#15275545)
> The culprit was the non-free AV.

Yes it was. After using it a couple years, when I decided to get it off my system, it was far from easy. It simply didn't go. Because of the trouble it was giving me, I thought I had no choice but to renew my subscription. It was at this point I started looking for an OS alternative.

[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by emodendroket on Monday September 18, 2017 @08:59AM (#15275424)
To be fair, they're responding to more sophisticated virus distribution.
[ Parent | on HN ]
Re:Malware identified in CCleaner 5.33 by jszymborski on Monday September 18, 2017 @10:23AM (#15276195)
There's always ClamAV/ClamWin that does just that...

[0] http://www.clamwin.com/

[ Parent | on HN ]