New Update FS Protection PC 18.4 releases (beta)

[Anthony Qian]

I know. That's why I wonder why you feel the need to discuss this with me.
It was MacDefender who said it, but corrected it later.


That is a complex topic because how would this simple check look like? If you are interested to learn more about FPs in antivirus software, you will find some answers here: The real reason why malware detection is hard—and underestimated

When it comes to antivirus products, false positives must be manageable and a corresponding tolerance rate definitely has to be lower than 0.001%.

Totally agree with the above statement!
According to this article, F-Secure's FP control is really bad.

 

[upnorth]

While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

I said it before elsewhere on this forum. This specific disclaimer been around too long and is impossible to miss, unless one deliberate ignore it. Btw, MalwareBazaar since day one it opened always had a mix of non malicious and broken and dead samples. It's also completely normal on any malware repository when for example C&C ( command and control ) servers goes down or gets changed etc. Many samples is also poorly coded and simply not compatible enough etc etc. Time is a normal well known super important key factor for malware hunters, testers and re-searchers. That non malicious samples also gets submitted to that repository and others is neither a surprise or anything new under the sun, as the exact same occur on VirusTotal. It is after all a platform open for anyone to submit.

A very important factor that clearly is missing in this thread is that big AV companies like F-Secure handle a extreme amount of samples. Around 400k samples per day ( official numbers from 2021 ). Those are impossible for any human hands to handle all and everything correct 24/7. Claim otherwise is just, plain.

 

[Shadowra]

Hello,

To answer quickly about MalwareBazaar, I use this site when I have to sample my packs.
Only, as @upnorth says, many of them are broken or not malicious (they can say it's a RAT when it's a Putty clean...)

Personally, I ALWAYS test and analyze my samples before use. I use VirusTotal, AnyRun and a dedicated VM.
If the file does nothing, it goes in the trash. If vice versa, I integrate it.
It takes me 1 hour of sampling, but at least I have quality samples.

For F-Secure, I had already noticed this new detection during my video test.
I've also seen detection in Kwala during JS, either via DeepGuard or in the Cloud.

I think they need to give it time. I don't think F-Secure only uses abuse.ch, I think they must have a network of Honeypot or others to fish for malware and improve detection.
And I think @struppigel 's detailed it well

 

[upnorth]

I think they need to give it time. I don't think F-Secure only uses abuse.ch, I think they must have a network of Honeypot or others to fish for malware and improve detection.
And I think @struppigel 's detailed it well

Very true, as they use many different sources and that basic information is actually even available in some of their whitepapers. It's not any hidden or secret information and I'm pretty sure they are very happy chappie if someone would just reach out and ask them. What can be better then themselves? But here, it's automatic a bit of a dead end.

 

[MacDefender]

Hello,

To answer quickly about MalwareBazaar, I use this site when I have to sample my packs.
Only, as @upnorth says, many of them are broken or not malicious (they can say it's a RAT when it's a Putty clean...)

Personally, I ALWAYS test and analyze my samples before use. I use VirusTotal, AnyRun and a dedicated VM.
If the file does nothing, it goes in the trash. If vice versa, I integrate it.
It takes me 1 hour of sampling, but at least I have quality samples.

For F-Secure, I had already noticed this new detection during my video test.
I've also seen detection in Kwala during JS, either via DeepGuard or in the Cloud.

I think they need to give it time. I don't think F-Secure only uses abuse.ch, I think they must have a network of Honeypot or others to fish for malware and improve detection.
And I think @struppigel 's detailed it well

With unsigned samples I’ve had good luck making slight modifications or packing the executable to change the hash to get around the abch style rules.

For me, from an end user perspective, this kind of early zero day blacklisting is a good automatic defense against emerging threats before a human analysis can get around to it. It’s a good thing.

As a tester? I guess it’s uninteresting to me that F-Secure tells me “oh I found it in MalwareBazaar”. Guess what, I did too! I kind of want to see how the other engines respond to this threat. In my opinion it’s basically made MB a useless source of PE samples for F-Secure testing. Pretty much within an hour or two of the sandbox returning a negative verdict, the hash is blocked. Even trivially changing the hash bypasses that protection and results in the old behavior I wanted to test.

 

[Shadowra]

As a tester? I guess it’s uninteresting to me that F-Secure tells me “oh I found it in MalwareBazaar”. Guess what, I did too! I kind of want to see how the other engines respond to this threat. In my opinion it’s basically made MB a useless source of PE samples for F-Secure testing. Pretty much within an hour or two of the sandbox returning a negative verdict, the hash is blocked. Even trivially changing the hash bypasses that protection and results in the old behavior I wanted to test.

I was talking about myself for my videos, not the F-Secure lab...
Anyway, if you know how to modify an executable, you destroy all detections, except if Hexa detection

 

[MacDefender]

I was talking about myself for my videos, not the F-Secure lab...
Anyway, if you know how to modify an executable, you destroy all detections, except if Hexa detection

Not always. ESET signatures are often written in a way that makes it hard to lose the detection altogether with modifying and sometimes even repacking the binary with an off the shelf packer. It mostly defeats cloud based hash lookups as a first line of defense.

Kaspersky also does a great job with heuristic detections for both PE and MSIL malware, just the presence of certain win32 API calls alone will get you a heuristic detection.

 

[Mindaugas]

Have anyone received 18.4 update? In forum it's written that it is currently released, but still using 18.3 :/ FS Protection PC 18.4 releases

 

[upnorth]

Have anyone received 18.4 update? In forum it's written that it is currently released, but still using 18.3 :/ FS Protection PC 18.4 releases

The stable version 18.4 is scheduled for official release on the 3rd this month, hopefully.

 

[Mindaugas]

Just got it today

 

[franz]

f-secure safe 18.5 is out now, and I just got it