Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 761001">It&#039;s common sense. And learn by doing.Take a bunch of malware samples and just look at the file names and inspect the file Properties. That alone gives suspicious indicators.Malc0ders are not all that creative. Just look at the file names of common run-of-the-mill malware.<ul>
<li data-xf-list-type="ul">8.xls.exe that is supposed to be a sales report. It&#039;s a weaponized Excel document.</li>
<li data-xf-list-type="ul">NightShades.exe that is supposed to be a Flash update. It&#039;s signed with a valid cert by, you guessed it, &quot;Night Shades, Inc&quot; and is PUA.</li>
<li data-xf-list-type="ul">92374.js that is supposed to be an .mp4 download. It is a worm.</li>
</ul>I mean, come on... this is childs&#039;-play. It takes the barest minimum of a user paying attention to what they just did, what they got, and a quick look. And all of it is common sense requiring the least bit of effort.And the vast majority of the malc0ders are not even going to spend the $1500 to get a certificate and sign their malware properly. Some argue that they don&#039;t have the funds to pay the fees, but the real reason is to not leave any trails or links that can lead back to them. The signed PUA\PUP pushers, however, do pay for certs because it nets them mad revenue for their measly effort - and the certificate authorities won&#039;t revoke their certs except in obvious cases.I don&#039;t care what anyone says. You don&#039;t have to be a malware analyst or an Win Internals expert to figure any of this stuff out. I know 70+ year-old grandmas doing this basic level stuff. If they can figure it out, then so can everyone else.And that this very low-level stuff isn&#039;t being actively taught is just plain pathetic and shameful. It&#039;s society&#039;s responsibility to teach it - and most definitely should not be made the exclusive responsibility of all the security soft vendors nor the industry itself.</blockquote>

[QUOTE="509322, post: 761001"] It's common sense. And learn by doing. Take a bunch of malware samples and just look at the file names and inspect the file Properties. That alone gives suspicious indicators. Malc0ders are not all that creative. Just look at the file names of common run-of-the-mill malware. [LIST] [*]8.xls.exe that is supposed to be a sales report. It's a weaponized Excel document. [*]NightShades.exe that is supposed to be a Flash update. It's signed with a valid cert by, you guessed it, "Night Shades, Inc" and is PUA. [*]92374.js that is supposed to be an .mp4 download. It is a worm. [/LIST] I mean, come on... this is childs'-play. It takes the barest minimum of a user paying attention to what they just did, what they got, and a quick look. And all of it is common sense requiring the least bit of effort. And the vast majority of the malc0ders are not even going to spend the $1500 to get a certificate and sign their malware properly. Some argue that they don't have the funds to pay the fees, but the real reason is to not leave any trails or links that can lead back to them. The signed PUA\PUP pushers, however, do pay for certs because it nets them mad revenue for their measly effort - and the certificate authorities won't revoke their certs except in obvious cases. I don't care what anyone says. You don't have to be a malware analyst or an Win Internals expert to figure any of this stuff out. I know 70+ year-old grandmas doing this basic level stuff. If they can figure it out, then so can everyone else. And that this very low-level stuff isn't being actively taught is just plain pathetic and shameful. It's society's responsibility to teach it - and most definitely should not be made the exclusive responsibility of all the security soft vendors nor the industry itself. [/QUOTE]

Verification