Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 707266" data-attributes="member: 7463">Evjl- I tried Chrome portable with OSA build 27 at default and it worked fine I must assume that you have enabled some optional settings that blocks process spawning, Stas- There is no discernible difference between the build I used in the video and the current 27 build. And regarding Signed malware- any Blackhat worth her salt (like Ophelia) has a throwaway certificate that can can be used to sign malware. Although crap like this would be blocked by any decent AV, it would easily bypass any Rule in place.OpCode- Really superb post. It&#039;s important for folk to understand that OSA is Rule Based and not some sort of a BB. It is a very elegant way of stopping scriptors in their tracks (ie JScript, Powershell, VB) no matter what the ACTUAL payload is (ransomware, Bankers, etc), but it will not stop other malware that work by arcane mechanisms UNLESS a plethora of Rules are put in place that may make the system unusable for day-to-day purposes (Evjl&#039;s issue with Chrome Portable). NVT- you have a lovely and elegant security product. Please, please do not overthink it in reaction to posts.</blockquote>

[QUOTE="cruelsister, post: 707266, member: 7463"] Evjl- I tried Chrome portable with OSA build 27 at default and it worked fine I must assume that you have enabled some optional settings that blocks process spawning, Stas- There is no discernible difference between the build I used in the video and the current 27 build. And regarding Signed malware- any Blackhat worth her salt (like Ophelia) has a throwaway certificate that can can be used to sign malware. Although crap like this would be blocked by any decent AV, it would easily bypass any Rule in place. OpCode- Really superb post. It's important for folk to understand that OSA is Rule Based and not some sort of a BB. It is a very elegant way of stopping scriptors in their tracks (ie JScript, Powershell, VB) no matter what the ACTUAL payload is (ransomware, Bankers, etc), but it will not stop other malware that work by arcane mechanisms UNLESS a plethora of Rules are put in place that may make the system unusable for day-to-day purposes (Evjl's issue with Chrome Portable). NVT- you have a lovely and elegant security product. Please, please do not overthink it in reaction to posts. [/QUOTE]

Verification