« first day (3691 days earlier)      last day (35 days later) » 

2:05 AM
1
Q: Why do Windows AV software detect strings with case-sensitivitely?

John ZhauAs Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been demonstrated here where the string wdigest.dll is simply replaced with the same thing but with so...

Really, why are AVs case-sensitive?
 
 
3 hours later…
4:40 AM
@MechMK1 lolol well whoever said that is wrong and SE has absolutely no rules about that
I mean maybe that's true for Tavern's rules, but that is not a site-wide rule.
 
 
3 hours later…
7:40 AM
lmfao
 
 
4 hours later…
11:54 AM
@JohnZhau Sorry, I don't have time to watch the video, but does simply changing the case of the string result in the file not being detected anymore?
 
 
10 hours later…
10:15 PM
@nobody Signature detection in AV is only done against known malware samples. If the malware is modified, it can trivially evade signature detection. It's kind of pointless to make scanning case-insensitive when the scanning is only meant to detect unchanged, known signatures.
 
That's why antivirus software sucks
Or rather, antivirus software is not the answer we should be looking for
 
reed++
AV is a crutch.
 
What we need is a simple OS with a simple API that programs must use, and everything must be fully restricted by default
Program FOO can only access directory FOO. Do you want to install software COOL that access every other directory to manage all your pictures scattered all over your filesystem? YOU CAN'T. Not supported. Change OS if you want, GTFO
 
10:51 PM
Linux can be configured to do that.
E.g. with seccomp and mandatory access controls.
@reed You might want to look into seL4, which provides a very simple API and is formally verified (proven free of bugs, with caveats). It's a microkernel so all drivers run in userspace and have their abilities restricted by the kernel. It's not a drop-in replacement for OKL4, though.
 
11:11 PM
Huh, ThreadX is open source now that Microsoft owns it... I didn't know that.
 
11:51 PM
@MechMK1 I like ECC, but honestly I'm probably going to stick with RSA until post-quantum crypto gets standardized. It requires 2n + 1 qubits to break an n-bit RSA key, and 6n qubits to break an n-bit ECC key, so it's very possible that a quantum computer that could just barely break ECC would not (yet) be able to break RSA (ex. 6 * 256 < 4096 * 2 + 1).
 

« first day (3691 days earlier)      last day (35 days later) »