FireEye Shares Details of Recent Cyber Attack

Re:FireEye Shares Details of Recent Cyber Attack by est31 on Tuesday December 08, 2020 @10:07PM (#25354862)

Also fingerprints will only stop the lowest level of attackers. You can easily change binaries in a way the fingerprint is changed but the functionality remains the same. Reorder functions, add some garbage data, etc.

[ Parent | on HN ]

Re:FireEye Shares Details of Recent Cyber Attack by arafsheikh on Tuesday December 08, 2020 @10:22PM (#25354962)

That makes sense. So given that the attacker is technically sophisticated in this case, what are the tangible benefits of publishing the fingerprints?

I guess one benefit might be to push the development of new detection techniques to detect the underlying implementation of these tools.

[ Parent | on HN ]

Re:FireEye Shares Details of Recent Cyber Attack by judge2020 on Tuesday December 08, 2020 @10:34PM (#25355018)

The biggest advantage is that it would allow orgs to audit all applications that have been fingerprinted within their org and see if they might have been attacked as well.

[ Parent | on HN ]

Re:FireEye Shares Details of Recent Cyber Attack by Kalium on Tuesday December 08, 2020 @11:10PM (#25355246)

Some of the fingerprints are easily gotten around by fudging the binaries a bit. Others, like snort rules, look at things like network traffic that might not always be so easily disguised.

[ Parent | on HN ]

Re:FireEye Shares Details of Recent Cyber Attack by weisk on Wednesday December 09, 2020 @10:03AM (#25359171)

Fingerprints are definitely not the only way to know if a binary has been tampered with.

[ Parent | on HN ]