Reply to thread

Message

<blockquote data-quote="Vitali Ortzi" data-source="post: 1110542" data-attributes="member: 57714">when I send samples to Symantec thankfully they check every dll but it can take even&nbsp; days till they file back a report in the mail if it&#039;s something unknown to them not very convenient but still pretty useful as it&#039;s simpler then debugging , disassembling suspicious files myself but even they probably only check certain filetypes and languages so you could probably bypass it with some gaming engine specific scripting language or other simple&nbsp; yet genius methods threat actors use in the wildSeems like&nbsp; default deny is the only way to stop all current in the wild threats yet both business and consumers usually don&#039;t really use default deny as it basically makes everything&nbsp; unknown a false positiveOh and even with default deny there are all kinds of tricks to bypass many default deny solutions just like you have shownI really hope windows does something to help users against so many threats as windows security&nbsp; by default has many exploit mitigations Linux lacks and windows IIs pushing safe languages to it&#039;s kernel (forced declaration, compiler memory checks etc )As long as they keep allow by default then social engineering will cause people to execute malware as usual just like happens to many big corporations meanwhile the base of windows technically as more security features then Linux but who cares when they don&#039;t need to try to exploit memory&nbsp; of processes with effective simple social engineering that users basically execute malicious software themselvesEven I can easily get fooled to executing malware on my windows system and at least android ,ios have sandboxes ,&nbsp; restricted permissions by default (true security by default) wich makes it harder for attackers to get privileged code running as they have to actually use exploit chains (layers of sandbox , memory checks etc requires in most cases a chain )</blockquote>

[QUOTE="Vitali Ortzi, post: 1110542, member: 57714"] when I send samples to Symantec thankfully they check every dll but it can take even days till they file back a report in the mail if it's something unknown to them not very convenient but still pretty useful as it's simpler then debugging , disassembling suspicious files myself but even they probably only check certain filetypes and languages so you could probably bypass it with some gaming engine specific scripting language or other simple yet genius methods threat actors use in the wild Seems like default deny is the only way to stop all current in the wild threats yet both business and consumers usually don't really use default deny as it basically makes everything unknown a false positive Oh and even with default deny there are all kinds of tricks to bypass many default deny solutions just like you have shown I really hope windows does something to help users against so many threats as windows security by default has many exploit mitigations Linux lacks and windows I Is pushing safe languages to it's kernel (forced declaration, compiler memory checks etc ) As long as they keep allow by default then social engineering will cause people to execute malware as usual just like happens to many big corporations meanwhile the base of windows technically as more security features then Linux but who cares when they don't need to try to exploit memory of processes with effective simple social engineering that users basically execute malicious software themselves Even I can easily get fooled to executing malware on my windows system and at least android ,ios have sandboxes , restricted permissions by default (true security by default) wich makes it harder for attackers to get privileged code running as they have to actually use exploit chains (layers of sandbox , memory checks etc requires in most cases a chain ) [/QUOTE]

Verification