If I was a malware distributor, I'd just throw a couple random bytes at the end each time I upload a malicious file, it'd still work and have a different checksum/hash.
Re:Ask HN: How to handle user file uploads?
by ecaradec on Thursday May 02, 2024 @07:44AM
(#40235009)
Antivirus are really stupid tools, but not that stupid. I said that from a time where I had to work around tools flagged by antivirus.
Among stupid things they do are flagging a part of an executable, some nsis plugin flagged the whole package as virus as soon as you included them. I think they probably hash files by chunks, if you have too many bad chunks then you are a virus. A few bytes at the end doesn't change that.
I'm not sure if it's still true, but it used to be that ~half of all antivirus would flag an executable if you compressed it with UPX.
Re:Ask HN: How to handle user file uploads?
by cinntaile on Saturday May 04, 2024 @07:34AM
(#40256849)
You could sometimes bypass this by opening the file with a hexeditor and change a meaningless value. When UPX was popular there were also alternative file compressors that could also be used to sometimes bypass this issue.
Re:Ask HN: How to handle user file uploads?
by toomuchtodo on Thursday May 02, 2024 @06:08PM
(#40241922)
CISA is offering a malware analysis service now, requires a Login.gov account to use and the user be a US citizen. Unsure how it compares to VirusTotal, itβs in our backlog to spike a poc in our IR workflow.
https://www.cisa.gov/resources-tools/services/malware-next-g...
[1] - https://docs.virustotal.com/reference/overview