Re:NirSoft Freeware (2008)
by petecooper on Monday April 16, 2018 @04:00PM
(#16852174)
>I wonder if there is a defamation/libel type of lawsuit here. Anti virus vendors are making false accusations.
Some (many? most?) will report these applications as 'potentially unwanted applications' (PUAs) and sidestep the issue of blame or malicious intent, often asking the user if they want to proceed rather than just denying access.
Source: former Sophos employee.
Re:NirSoft Freeware (2008)
by CWuestefeld on Tuesday April 17, 2018 @09:41AM
(#16858165)
My employer's security team, in their infinite wisdom, is entirely blocking access to the NirSoft site.
Re:NirSoft Freeware (2008)
by neko_koneko on Monday April 16, 2018 @05:04PM
(#16852760)
Malware authors often incorporate legitimate software into their malware - e.g. Nir Sofer's Mail PassView and Web PassView are used in Emotet spam bot to harvest user credentials. Usually such files are marked as "Potentially unsafe software" by analysts, or in some cases could be detected as part of a malware family by AV companies' automated detection tools.
Another thing is that actions malware take and actions legitimate "power user" software takes are separated only by context. Thus automated behavior analysis is always going to produce false positives.
Is there much behaviour analysis done by consumer AV? Even Defender seems to be mostly signature based.
Re:NirSoft Freeware (2008)
by neko_koneko on Tuesday April 17, 2018 @04:50AM
(#16856586)
Yep. Malware is constantly repacked/encrypted. It is impractical/impossible to write static unpacking engines for every type of malware packing technique, so behavioral analysis engine is a must (btw, behavioral engines still detect malware using signatures).
Same for psexec and xexec for remote execution.
Re:NirSoft Freeware (2008)
by petercooper on Monday April 16, 2018 @04:12PM
(#16852283)
I wonder if there is a defamation/libel type of lawsuit here.
If that would ever fly, I want to take action against mail servers that tell me my mail is "spam" when it clearly isn't and was double opted-in by their users :-D
Google seems to have a habit of dumping directly to spam emails from any domain they do not recognize.
Or at least i have seen some complaints bouncing around certain mailing lists in that regard.
Re:NirSoft Freeware (2008)
by woolvalley on Monday April 16, 2018 @04:30PM
(#16852449)
viruses may use the tools to achieve things, which creates an association
I wonder if there is a defamation/libel type of lawsuit here. Anti virus vendors are making false accusations.