Advice Request I am head of research at Emsisoft. Ask me anything! :)

[Huchim]

I don't have any question at the moment but rather the same feedback when I uninstall Emsisoft from my pc's back on 2016 (tested in january 2017, 2018 and 2019) and also mentioned here; improve the update process, some softwares freezes like online videos, games and software editors no matter if the pc is more than capable to do this tasks, make it nicer with mobile data too.

 

[Fabian Wosar]

1. There will always be patient zero, right?
What I mean by that is that somebody's gotta get infected in order for cloud to get the sample/behavior etc data?

There is. It's actually one way some ransomware authors got caught in the past. It wasn't by us, but some of the Crysis ransomware guys had Kaspersky installed and consistently new Crysis variants showed up on their systems first. So it was obvious that this was the system of the malware author.

2. What is your take on cloud reputation? Shouldn't it be easy to block all unknown files (first encounters) to at least verify file's maliciousness? Or is whitelisting (Digital signatures) too limited for that and they require constant updating, as is with other databases?

There are more good files out there than there are malicious files. Such a database would be enormous and would grow many times faster than any malware database would.

If you are in a controlled environment, like an enterprise network for example, where you know exactly what applications a user is supposed to run, then whitelisting is a very viable option. But for general purpose, you run into exactly the same issues as with detecting malicious files.

It's by the way also a lot more difficult to prove that a file is not malicious than it is to prove it is malicious. It's the whole "proving a negative thing".

 

[Fabian Wosar]

I don't have any question at the moment but rather the same feedback when I uninstall Emsisoft from my pc's back on 2016 (tested in january 2017, 2018 and 2019) and also mentioned here; improve the update process, some softwares freezes like online videos, games and software editors no matter if the pc is more than capable to do this tasks, make it nicer with mobile data too.

Thanks. We are looking into updates. There is no concrete ETA or timetable yet when we will get to work on them.

 

[SumTingWong]

1) What tools do you use to analyze the malware?

2) What service do you use to maintain your server?

3) How do you get the malware samples beside users submission?

4) Do you use Skype to communicate with the team? Or how do you communicate with each others?

5) I am currently attending community college to work toward my transfer degree to a big college or university to pursuit programming, cyber security, and software development which all fall into Computer Science. What are your tips for these three careers?

6) How often do you get pay? Weekly, BiWeekly, or Monthly?

7) what are your biggest challenge in the field and the team?

 

[Fabian Wosar]

1) What tools do you use to analyze the malware?

A bunch of proprietary tools. But mostly x64dbg as well as IDA Pro. Ghidra looks super interesting as well. It may very well replace IDA Pro for me in the future.

2) What service do you use to maintain your server?

Lots of Docker, Hyper-V, Windows Server, Ubuntu and KVM.

3) How do you get the malware samples beside users submission?

Intelligence feeds like VirusTotal, VirScan etc.. AV vendors also trade samples between each other. Last but not least we also look for them actively.

4) Do you use Skype to communicate with the team?

We used to in the early days. We switched to Slack a couple of years ago and never looked back.

5) I am currently attending community college to work toward my transfer degree to a big college or university to pursuit programming, cyber security, and software development which all fall into Computer Science. What are your tips for these three careers?

I don't have a formal education. I dropped out of high school without any degree pretty much and never went to university. It's not something I recommend.

I suggest taking part in as many CTFs as possible. Get involved with the infosec community on Twitter. Maybe join a couple of Discords like The Many Hats Club for example. Stay curious and try to get at least a basic understanding of as many technologies as possible. Malware researchers are often generalists because malware authors will throw constant curveballs at you. It's important that you are able to grasp new technologies, programming languages, and frameworks quickly by being able to transfer knowledge from other areas. The best way to learn how to do that is by getting exposed to as many different technologies, programming languages and frameworks as possible. If you need to write a tool and it's not super time critical, maybe write it in Rust or Go or some other programming language that you never used before instead of your go-to programming language.

There is also some great course material available at Welcome.

6) How often do you get pay? Weekly, BiWeekly, or Monthly?

Monthly.

7) what are your biggest challenge in the field and the team?

Probably time. There isn't enough of it.

Within the team, there aren't a lot of challenges. Communication can be a challenge when your 40 employees are from 20+ different countries and even more backgrounds. We combat that by trying to foster a very open company culture and allowing people to interact freely with each other and with the common understanding, that even if someone may sound a bit weird sometimes or may belong to a certain political or religious system you don't agree with, none of their actions is intended to be malicious or offending on purpose.

One interesting aspect, for example, is/was the Crimea conflict. We have Ukrainians and Russians working in the same team. One of our Russian developers at that time actually lived in Crimea. So when your two countries are literally at war with each other there is obviously a little bit of tension. However, we talked openly about it and it became obvious very quickly, that nobody except for the people in charge is responsible for the actions their country take or don't take.

In some cases, we also had to help our employees to move away from these crisis areas. There recently was an interesting article about work culture at Emsisoft. You can check it out here:

6 Benefits Of Having An Entirely Virtual Global Team

When Christian Mairoll founded Emsisoft 15 years ago, he chose to make his global antivirus software company entirely virtual. Here, he and several of his employees share their insights into the benefits of running and working for a business whenever and from wherever you want.

www.forbes.com

 

[bjm_]

It's doable and it is needed. Especially for stuff like VBS, VBA, JScript and Powershell. It's actually quite interesting, as a lot of "Next-Gen AV" handle these vectors poorly, if at all. Especially when it comes to attacking company networks, you often see that attackers don't use classic malware at all. Everything is done through Powershell.

...and does Emsisoft direct detect Non-PE? Or, does Emsisoft indirect detect Non-PE via ?.

 

[bribon77]

Perhaps this is a compromised question and it is a question that in all security Forums is almost always asked by the novice. Which is the best AV for you, except Emsisoft, obviously.

 

[Fabian Wosar]

...and does Emsisoft direct detect Non-PE? Or, does Emsisoft indirect detect Non-PE via ?.

We do. The behaviour blocker, for example, is capable of associating actions directly to specific scripts, not just the script interpreter. We also support AMSI, which helps a lot. Our scan engine is capable of scanning scripts just like it does PE files.

Perhaps this is a compromised question and it is a question that in all security Forums is almost always asked by the novice. Which is the best AV for you, except Emsisoft, obviously.

No questions about other products. But generally speaking: The one that works best on your system. Doesn't matter if you have the perfect software that detects everything, but it annoys you so much you turn it off all the time.

 

[SumTingWong]

Which programming language is good for beginner to start out? Javascript or C++?

 

[ForgottenSeer 72227]

I am really excited for the cloud console, as I am really into centralized management. From what I understand, currently the focus will be on the Windows version of EAM, but I was wondering if there are any plan in the future to include the Android version as part of the cloud console? I think it would be really good to be able to not only setup, monitor and control the Windows machines, but also your mobile Android devices as well.

Another question that came to mind, is what are your thoughts on sandboxing AV's to protect the OS from any potential vulnerabilities in the AV/AM program, that aren't yet patched? I know Tavis Ormandy has been preaching this for a while now and with Microsoft adding this to WD, do you feel like it is necessary? Furthermore, I was listening to a Security Now podcast where Steve Gibson was talking about this (after Microsoft stated that they were implementing this) and he said that Microsoft is really the only one who is able to do such a thing, is this true, or can other vendors like yourselves also implement something like this if needed?

 

[trandung]

1. I think EAM's processes are not using Protected Processes and Control Flow Guard. Is that true ? If not used, what is the reason?
2. What do you think about adding Webcam Protection feature to EAM?

 

[Burrito]

Expired - Emsisoft Anti-Malware Giveaway

LIve! Ends On April 15,2019 Emsisoft Anti-Malware Giveaway We would like to thank Emsisoft for giving us the opportunity to give away these (32) Emsisoft Anti-Malware (1) Year / (1) PC licenses. *Licenses need to be used by 2019-06-07 13:59 UTC Emsisoft Anti-Malware Complete...

malwaretips.com

Fabian,

....and thanks for arranging the product giveaway for MT.

Thirty-five licenses for this community is very generous.

That could be effective too in getting a more persistent Emsisoft dialogue going here.

 

[spaceoctopus]

Hi @Fabian Wosar .Thanks for replying to my previous question. I have two others concerning Pups.
Is it possible for you to tell just about a few criterias, which Emsisoft uses to define a program as a Pup?

Does the Emsisoft behavioral engine is able to recognize Pup behaviors?Or is it just dependent on signatures. Thank you.

 

[Vasudev]

Hi Fabian,
Good to see you here engaging actively regarding your product ..
However just consider my opinion (if) found legit :
Drop the Bit fender engine if possible, since their signatures are over rated means cracks, keygens pua etc as Trojans.
Trust me even now more than 80% + normal users still use pirated softwares..So atleast if you don't support them, but do not make them believe the cracks are virus..
Bit defender is not that speed in reacting faster to newer threata..May be Eset, Avira are much better in responding faster than BD.
If possible kindly make your company to wiki..Almost nill information exists..
Thank you !

Usual top SEO ranks list fake crack software that are malware 99% of the time. You can switch to MSFT defender and use configure defender for max protection as well, still it detects and removes Microsoft Toolkit or KMS pico.

 

[Vasudev]

I don't have a formal education. I dropped out of high school without any degree pretty much and never went to university. It's not something I recommend.

I suggest taking part in as many CTFs as possible. Get involved with the infosec community on Twitter. Maybe join a couple of Discords like The Many Hats Club for example. Stay curious and try to get at least a basic understanding of as many technologies as possible. Malware researchers are often generalists because malware authors will throw constant curveballs at you. It's important that you are able to grasp new technologies, programming languages, and frameworks quickly by being able to transfer knowledge from other areas. The best way to learn how to do that is by getting exposed to as many different technologies, programming languages and frameworks as possible. If you need to write a tool and it's not super time critical, maybe write it in Rust or Go or some other programming language that you never used before instead of your go-to programming language.

I should have pulled out of my university too when I had the chance but I kept going and completed them.
Going to university and dreaming of becoming a great developer doesn't get you anywhere. Look at you, you can now guide people who have completed their university with Top grades just like a student. I reckon that will give a glimpse of hope that experience of real life counts rather than just studying!
Hahaaa....

How old were you when you started exploring Windows\comp sci ?

You had to work really hard at it, didn't you ? I mean you didn't type out a few lines of code, and voila, you instantly became the Anti-Malware King ? (We know you're brighter than most. You make it look so easy, but I know you had to have worked very hard to ascend to where you are today. You earned it by working your ass off.)

Can you provide a brief outline of how you progressed with your learning ?

How did you motivate yourself when you weren't progressing along, having difficulty finding learning resources,, or subject matter that was tough to learn ?

(I struggle with this... working in isolation, an overall lack of good, competent learning resources, almost impossible to get questions answered. It is only via sheer will power that I slug through the tough times. Finding sources that teach the subject matter well is a constant frustration - because there is virtually none. And around here, if you don't have certifications no potential employer will look at you even if you have been awarded a Nobel Prize in mathematics or a Turing award. No university degree and no certifications = no job.)

I think most people struggle with this... they want to learn, but there are only a few good resources to gain competency and "Googling it" is highly inefficient if not ineffective.

Even though I did my Engineering in Computer Science I'm not a good application developer but I am good at making some hardware mods, basic bios mods and repairing stuffs. Whenever I did write my own code I was put down saying you should follow what we taught you and follow the material we gave and blah blah!!!!

I believe in coincidence,destiny and lot of other variables that define human lives. There are people who can code brilliantly without even having a PC or reading a SW development manual whereas trained developers find it difficult. That's a fact

So, I'm re-learning most programming language from scratch just like a baby(for best concrete base of operations) because anything newer PL I learn I start typing C/C++/JSP constructs in python,rust and HTML. My hands simply goes on auto mode and simply writes some stuffs which I don't even understand most of the times.

So, it depends on your thirst for knowledge that keeps you going. If you're not good at making application software delve into System software, Compilers, firmwares etc... Everyone won't be application SW developers because if that happens OS and low level stuffs will be ancient because there are none to fill that hope.

Which programming language is good for beginner to start out? Javascript or C++?

Choose Python -> C -> Javascript,HTML/CSS -> C++ -> Java/Android apps -> Rust/Go etc... Otherwise you'll mix up syntaxes of most languages.

 

[Fabian Wosar]

How old were you when you started exploring Windows\comp sci ?

Started when I was 11. I didn't start with comp sci though. Just started with programming and being interested in computers in general.

You had to work really hard at it, didn't you ? I mean you didn't type out a few lines of code, and voila, you instantly became the Anti-Malware King ? (We know you're brighter than most. You make it look so easy, but I know you had to have worked very hard to ascend to where you are today. You earned it by working your ass off.)

I am definitely not a king. There are plenty of much more talented people out there. There is a lot of practice involved, yes. But it never felt like work since I loved doing it. It helps that I have kind of an obsessive personality. I get really into things and don't stop pursuing them no matter how boring people find it.

Can you provide a brief outline of how you progressed with your learning ?

First time I saw a PC was at 7. My dad did some educational courses as he was unemployed and at least in Germany when there is little chance for you to get a job in what you previously did your apprenticeship/education in, they try to teach you new stuff to get you into other jobs. I visited him a few times at his school and they had PCs there. It was clear that I wanted one, but my family was incredibly poor. Plus I grew up in the GDR. So PCs weren't that common, to begin with. I spent the next 4 years with saving money. Like I collected bottles on the street, saved my allowance, did anything a small kid can do really to get a bit of money.
At 10/11 I bought my first PC. I was so happy. It was a pretty decent one as well for the time and served me well for the next 6 years or so. It didn't take long until I was infected by a virus though (Tequila.B). I got it from a game I copied from a school friend most likely. Back then it was normal to just trade floppies on the school campus.
I didn't know what to do so my first reaction was to just go to the local library and look up computer viruses. To my surprise, they actually had a couple of books there for me to read. So I did that. It became obvious quickly that I would need to learn assembly to truly understand what was going on. So I did that. Bought a book about assembly and wrote my first little tool to clean up my messed up files.
Assembly was nice, but it was kind of tedious to write programs in. So I asked my school's computer science teacher what he would suggest. I literally dumped all kinds of questions on him actually, none of which he could answer. I really struggled with pointer arithmetic for example, but I really wanted to write a memory scanner. But he recommended Pascal to me. So when I was 12 I started to learn Pascal.
From Pascal the natural transition was to Delphi which I used almost exclusively and still do from time to time. On the road, I picked up C (which I thought was stupid in the beginning, as I had an irrational hatred for curly braces), then later C++. Then came the transition to Windows 95 and my interest in that.

How did you motivate yourself when you weren't progressing along, having difficulty finding learning resources,, or subject matter that was tough to learn ?

Stubbornness. The same kind of attributes that get me regularly into trouble with people in real life.

I think most people struggle with this... they want to learn, but there are only a few good resources to gain competency and "Googling it" is highly inefficient if not ineffective.

For malware research there are a lot of great resources now, that didn't exist before. OpenSecurityTraining is a good one. MalwareUnicorn has a nice tutorial for basics as well. There are some amazing books as well. I can recommend these:

Amazon.com: Low-Level Programming: C, Assembly, and Program Execution on Intel® 64 Architecture eBook : Zhirkov, Igor: Books

Buy Low-Level Programming: C, Assembly, and Program Execution on Intel® 64 Architecture: Read Books Reviews - Amazon.com

www.amazon.com

Amazon.com: C++ Primer (5th Edition): 9780321714114: Lippman, Stanley, Lajoie, Josée, Moo, Barbara: Books

Amazon.com: C++ Primer (5th Edition): 9780321714114: Lippman, Stanley, Lajoie, Josée, Moo, Barbara: Books

www.amazon.com

Pretty much everything related to C++ written by Bjarne Stroustrup, Herb Sutter, Scott Moyer and Andrei Alexandrescu.

Malware and reverse engineering specifically:

Art of Computer Virus Research and Defense, The: Szor, Peter: 9780321304544: Amazon.com: Books

Buy Art of Computer Virus Research and Defense, The on Amazon.com ✓ FREE SHIPPING on qualified orders

www.amazon.com

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation: 9781118787311: Computer Science Books @ Amazon.com

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation: 9781118787311: Computer Science Books @ Amazon.com

www.amazon.com

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software: Sikorski, Michael, Honig, Andrew: 8601400885581: Amazon.com: Books

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software [Sikorski, Michael, Honig, Andrew] on Amazon.com. *FREE* shipping on qualifying offers. Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

www.amazon.com

Which programming language is good for beginner to start out? Javascript or C++?

I would start with C. From there transition to C++. Don't bother learning old C or C++ standards. They will only teach you bad habits. If your book/material starts to tell you to use new and delete for memory management, toss it and get a better one. Modern C++ (starting with the C++11 standard) is one of the most beautiful and expressive languages there is. Also Python is incredibly useful as well.

I am really excited for the cloud console, as I am really into centralized management. From what I understand, currently the focus will be on the Windows version of EAM, but I was wondering if there are any plan in the future to include the Android version as part of the cloud console? I think it would be really good to be able to not only setup, monitor and control the Windows machines, but also your mobile Android devices as well.

I wouldn't rule it out, but probably not for a while.

Another question that came to mind, is what are your thoughts on sandboxing AV's to protect the OS from any potential vulnerabilities in the AV/AM program, that aren't yet patched? I know Tavis Ormandy has been preaching this for a while now and with Microsoft adding this to WD, do you feel like it is necessary?

Can't talk about it yet. But it is a valuable feature.

Furthermore, I was listening to a Security Now podcast where Steve Gibson was talking about this (after Microsoft stated that they were implementing this) and he said that Microsoft is really the only one who is able to do such a thing, is this true, or can other vendors like yourselves also implement something like this if needed?

You will see.

I think EAM's processes are not using Protected Processes and Control Flow Guard. Is that true ? If not used, what is the reason?

They require certain groundwork that isn't in yet, because it is specific to Windows 8/10 only and we still need to support Windows 7.

What do you think about adding Webcam Protection feature to EAM?

Security theatre. Only reliable way is sticker or some kind of cap to put over your webcam.

Is it possible for you to tell just about a few criterias, which Emsisoft uses to define a program as a Pup?

Download wrappers
A download wrapper is an installation program that is wrapped around the actual program a user wants to install. It often contains sponsor offers which are optional, but often presented in such a way that a user is persuaded to install these additional features.
Download wrappers will be detected when one or more of the following conditions are true:

• There is no (clear) link to, or description of the EULA and/or Privacy Policy of the product(s) presented before the installation starts.
• There is no (clear) option to decline the installation of sponsor applications/features present or the way this option is presented is misleading or third-party options are prechecked.
• During installation the browser settings (e.g. homepage, search settings) are modified without user consent and/or notification.
• Sponsor applications/settings are installed/changed without user consent.
• The included application(s) does not have an uninstall option.

Toolbars/Browser Helper Objects/Browser Extesions
A toolbar/BHO/Extension is an addition to an internet browser that can have a variety of functions. They will be detected when one or more of the following conditions are true:

• (One of) the objective(s) of the toolbar/BHO/extension is to track personal data and/or transmit this to third parties without sufficiently informing the computer user about this.
• There is no (clear) link to, or description of the EULA and/or Privacy Policy of the toolbar/BHO presented before the installation starts.
• During installation the browser settings (e.g. homepage, search settings) are modified without user consent and/or notification outside the scope of the toolbar/BHO.
• The toolbar/BHO/extension is installed silently (without asking for user consent).
• The toolbar/BHO/extension does not have an uninstall option.

PC Optimizers
PC Optimizers are applications that pretend to scan for problems on a computer (this can be malicious content, outdated drivers, performance issues and so on). This type of program will be detected when one or more of the following conditions are true:

• The application presents fake or non-existent threat detections and removal or does not present details about found objects.
• The application is installed without user consent.
• The application does not have an uninstall possibility.
• The application presents alerts/pop ups meant to scare the user into purchasing the product without such alerts being warranted by the severity of the found issue(s).
• The program is not able to address detected problems but requests payment to unlock this feature nonetheless even though no form of trial is available.

Risktools
Risktools are applications that provide a functionality that in itself is non-malicious but can be used by third-parties to conduct malicious activities. Applications will be detected when one or more of the following conditions are true:

• The application facilitates the monitoring/capture of networks or network traffic.
• The application facilitates the monitoring/capture of text input.
• The application facilitates modification of access levels/policies on a computer in an insecure manner.

Remote administration tools

• Remote administration tools are applications that can be used to access a computer from a remote location. This type of application is detected when one or more of the following conditions are true:
• The application allows a connection from/to a remote computer insecurely and/or without requiring consent/authentication from the (remote) user.
• The application is installed silently (without asking for user consent).

In general, we allow our analysts certain freedoms and to use their common sense though. These standards are also regularly updated.

Does the Emsisoft behavioral engine is able to recognize Pup behaviors?Or is it just dependent on signatures. Thank you.

The behaviour blocker is able to detect a whole bunch of them. But especially removal is heavily driven by signatures.

Usual top SEO ranks list fake crack software that are malware 99% of the time. You can switch to MSFT defender and use configure defender for max protection as well, still it detects and removes Microsoft Toolkit or KMS pico.

Mostly because especially enterprises don't want their users to use cracks/pirated software.

 

[tsunami]

@Fabian Wosar Will Emsisoft release a public blocklist for malicious domains/ip's ?

 

[Fabian Wosar]

@Fabian Wosar Will Emsisoft release a public blocklist for malicious domains/ip's?

Probably not.

 

[Vasudev]

Started when I was 11. I didn't start with comp sci though. Just started with programming and being interested in computers in general.

I did get a second hand B/W PC at the age of 7 and then it went kaput! The actual PC I had was visiting Cyber cafe's for another 8 years until first Core 2 Duo laptop from Sony and that went kaput too because I gamed a lot on it and never understood anything about OS, AV etc..... Then at the age of 21 I actually got a pentium laptop for coding and I still use it more often than my somewhat new laptop.

 

[Fabian Wosar]

I did get a second hand B/W PC at the age of 7 and then it went kaput!

My first PC was a 486 DX2 with 66 MHz, 8 MB of RAM, 400 MB of HDD and an SVGA graphics card. It was a beast at the time.