Reply to thread

Message

<blockquote data-quote="BVLon" data-source="post: 861423">And a home-baked ransomware should trigger Eset, Norton, AV x, y, z beacause?A real-world ransomware1. Steps on a solid foundation of previous successful attacks.2. Is written for money by fully-dedicated TEAMS.3. Takes a lot of time + trial and error.4. Rarely just pops up;&nbsp; ransomware is not just one executable modifying and encrypting files, it&#039;s a complete attack vector.5. Together with file encryption algorithms, also contains mutliple logics to be stealthy, hidden and fast. Did you program those? I doubt you did.Your executable looks like some freebie that encrypts files for user&#039;s security &amp; on-demand. I would actually be very concerned if it triggers detection.ML-based solution will trigger an alarm when it has to trigger it. You can&#039;t make it squeal with 50 lines of code. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I&#039;ve tested many BB with a lot of ransomware and they always seem to be great at blocking that, with the exception of McAfee.&nbsp; Ransomware detection should not be anyone&#039;s concern in 2020.</blockquote>

[QUOTE="BVLon, post: 861423"] And a home-baked ransomware should trigger Eset, Norton, AV x, y, z beacause? A real-world ransomware 1. Steps on a solid foundation of previous successful attacks. 2. Is written for money by fully-dedicated TEAMS. 3. Takes a lot of time + trial and error. 4. Rarely just pops up; ransomware is not just one executable modifying and encrypting files, it's a complete attack vector. 5. Together with file encryption algorithms, also contains mutliple logics to be stealthy, hidden and fast. Did you program those? I doubt you did. Your executable looks like some freebie that encrypts files for user's security & on-demand. I would actually be very concerned if it triggers detection. ML-based solution will trigger an alarm when it has to trigger it. You can't make it squeal with 50 lines of code. :) I've tested many BB with a lot of ransomware and they always seem to be great at blocking that, with the exception of McAfee. Ransomware detection should not be anyone's concern in 2020. [/QUOTE]

Verification