App Review Quick Follina test ;).

[Kongo]

No offence to either @danb or @Andy Ful as my knowledge on this topic is very limited. But the way you both interact with each other is just childish and not helpful. The thread should be about helping your users to protect themselves and not about your differences of opinion and the exposure of a product of the "competition". That’s not really the best way to promote your products.

 

[Digmor Crusher]

No offence to either @danb or @Andy Ful as my knowledge on this topic is very limited. But the way you both interact with each other is just childish and not helpful. The thread should be about helping your users to protect themselves and not about your differences of opinion and the exposure of a product of the "competition". That’s not really the best way to promote your products.

Yes, but its fun reading.

 

[dinosaur07]

Yes, but its fun reading.

Yes, i second that, plus we learn something new always. From this idea "battle" i learnt that OSArmor is great. Joking.

 

[danb]

I second that as well. There is absolutely nothing wrong with a spirited conversation, as long as it does not become personal or shady.

Discussions are actually a great way to learn, and there was definitely some good that came out of it.

The funny thing is that if HC would have logged the powershell "block", it never would have been included in the video. Maybe Andy will test HC and find out why the powershell event was not logged. In all fairness, as far as testing goes, if an event is not logged, then it didn't happen.

BTW, make sure to watch Leo's new video on Follina, it is one of his best videos yet.

 

[Kongo]

I second that as well. There is absolutely nothing wrong with a spirited conversation, as long as it does not become personal or shady.

Discussions are actually a great way to learn, and there was definitely some good that came out of it.

Please don't twist my words, I absolutely agree with you that discussions of any kind are very helpful and a great way to learn new things, but you both represent your products here on MT and the way you both handle your different opinions is far from professional. Anyway, I also find it quite entertaining but I just think that it doesn't make a good impression. So please don't take it as an offence.

 

[danb]

Please don't twist my words, I absolutely agree with you that discussions of any kind are very helpful and a great way to learn new things, but you both represent your products here on MT and the way you both handle your different opinions is far from professional. Anyway, I also find it quite entertaining but I just think that it doesn't make a good impression. So please don't take it as an offence.

I wasn't twisting your words at all, I apologize if it seemed that I was. I was just giving my opinion. BTW, I tried to be as professional as possible, but please feel free to post or pm me specific instances that were unprofessional, or that I could have done better. I would be curious to know so that I can do better in the future. Thank you!

 

[Kongo]

I wasn't twisting your words at all, I apologize if it seemed that I was. I was just giving my opinion. BTW, I tried to be as professional as possible, but please feel free to post or pm me specific instances that were unprofessional, or that I could have done better. I would be curious to know so that I can do better in the future. Thank you!

Alright, no worries. I just think your video is exposing @Andy Ful tools like H_C or SWH even tho they are not even any real competition for VoodooShield as they are based on completely different approaches. So in my opinion it wasn't really necessary to show the flaws of the tools of NVT and Andy in public yet, especially on this forum that has many users of Andy's and NVT's software. This just casts a bad light on their tools, rather than highlighting the strengths of your product. Maybe it would have been better if you discussed this in a private chat instead of a public thread. After that, you could have still published it if you didn't come to an agreement. I hope you get my point.

 

[cruelsister]

it's really annoying that all of the servers dishing out the interesting payloads from Follina disappear so quickly. How do the blackhats expect us to become infected when they don't have the courtesy to leave the malware active?

 

[wat0114]

it's really annoying that all of the servers dishing out the interesting payloads from Follina disappear so quickly. How do the blackhats expect us to become infected when they don't have the courtesy to leave the malware active?

If you can find something that works, please post it. Your contributions will be highly valued.

 

[Trooper]

If you can find something that works, please post it. Your contributions will be highly valued.

What are you running to mitigate this @wat0114 Feel free to PM. Cheers!

 

[wat0114]

What are you running to mitigate this @wat0114 Feel free to PM. Cheers!

Hi Trooper,

nothing has changed for me; I still run good old dependable H_C and OSArmor. I think it's probably important to remember that as home users, we have far less to be concerned about than a Government or enterprise entity. Ultimately I place tremendous faith on what @Andy Ful has to say, although I greatly appreciate the contributions of @danb and @cruelsister , because they are obviously, at least in my estimation, incredibly talented and knowledgeable in cyber security. Whatever may have happened in this sometimes acrimonious thread between the main combatants as we all know who they are, they spent their time, efforts and expertise to the best of their abilities, and I for one learned a lot from them. As always, it's been a lot of fun and a great learning experience.

 

[Trooper]

Hi Trooper,

nothing has changed for me; I still run good old dependable H_C and OSArmor. I think it's probably important to remember that as home users, we have far less to be concerned about than a Government or enterprise entity. Ultimately I place tremendous faith on what @Andy Ful has to say, although I greatly appreciate the contributions of @danb and @cruelsister , because they are obviously, at least in my estimation, incredibly talented and knowledgeable in cyber security. Whatever may have happened in this sometimes acrimonious thread between the main combatants as we all know who they are, they spent their time, efforts and expertise to the best of their abilities, and I for one learned a lot from them. As always, it's been a lot of fun and a great learning experience.

Nice. I was just curious what you were doing personally. At work I took more evasive action because I had to. At home I have not done anything about it. Nice to see that you are using H_C and OSArmor.

 

[wat0114]

At work I took more evasive action because I had to.

Sorry I went off on a tangent, but please know it's sincere and from the heart In your case in a work environment, I agree you would have to take far more evasive actions. Sorry I don't have the expertise to help in your quest. Where I work it's a very large employee base of several thousand, and the IT department uses strategies that are vastly way beyond my scope of knowledge. I do know they have full control of every employee's COE workstation/laptop, and smart phone. Best of luck to you

 

[Trooper]

Sorry I went off on a tangent, but please know it's sincere and from the heart In your case in a work environment, I agree you would have to take far more evasive actions. Sorry I don't have the expertise to help in your quest. Where I work it's a very large employee base of several thousand, and the IT department uses strategies that are vastly way beyond my scope of knowledge. I do know they have full control of every employee's COE workstation/laptop, and smart phone. Best of luck to you

No problem with the tangent. I did not even think you went off on one to be honest. I was just curious since you have been actively involved in discussion both here and on the other forum. I was thinking of checking out H_C but I think that needs to be installed correct? I prefer Andy's ConfigureDefender tool which allows for usage without the installation of any programs. Cheers!

 

[wat0114]

No problem with the tangent. I did not even think you went off on one to be honest. I was just curious since you have been actively involved in discussion both here and on the other forum. I was thinking of checking out H_C but I think that needs to be installed correct? I prefer Andy's ConfigureDefender tool which allows for usage without the installation of any programs. Cheers!

Thanks! True H_C is installed but there are no running drivers or processes once it is configured and then closed.

 

[Trooper]

Thanks! True H_C is installed but there are no running drivers or processes once it is configured and then closed.

Good to know. Thank you!

 

[danb]

Alright, no worries. I just think your video is exposing @Andy Ful tools like H_C or SWH even tho they are not even any real competition for VoodooShield as they are based on completely different approaches. So in my opinion it wasn't really necessary to show the flaws of the tools of NVT and Andy in public yet, especially on this forum that has many users of Andy's and NVT's software. This just casts a bad light on their tools, rather than highlighting the strengths of your product. Maybe it would have been better if you discussed this in a private chat instead of a public thread. After that, you could have still published it if you didn't come to an agreement. I hope you get my point.

You know, when VS first started and other devs were testing VS, it initially appeared they were viciously attacking VS for no reason. I quickly discovered that they were not attacking VS at all, quite the opposite, they were actually just trying to help. Once I discovered this, I truly appreciated them spending their time testing VS for bypasses.

Testing takes a lot more time than you could possibly imagine. Often times it is difficult to find a working sample, or something else goes wrong, and you end up spending 5-20 hours on a single test. So the thing is, once the test is fully working, it only takes a few minutes to test other security products, so why not test them as well? It helps other devs, end users and the entire malware community as a whole.

Sure, I could have reached out to Andy, but when I have done so in the past he has always had the same reaction. Andy is a great guy, but sometimes two people will simply never see eye to eye.

Sooner or later every dev will discover that other devs are simply trying to help by testing their software.

 

[danb]

it's really annoying that all of the servers dishing out the interesting payloads from Follina disappear so quickly. How do the blackhats expect us to become infected when they don't have the courtesy to leave the malware active?

This totally reminds me of a something from a few years ago, I think it was during WannaCry. I found a US map of all of the WannaCry infections that had a red dot wherever an infection had occurred. And I remember thinking, “You know, I bet half of the infections in the north east are actually CS testing WannaCry.”

 

[danb]

If you can find something that works, please post it. Your contributions will be highly valued.

This is the best one I have found so far. If I am not mistaken, I believe it is the one Leo used in his test as well.

GitHub - chvancooten/follina.py: POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes

POC to replicate the full 'Follina' Office RCE vulnerability for testing purposes - GitHub - chvancooten/follina.py: POC to replicate the full 'Follina' Office RCE vulnerability for...

github.com

 

[Kongo]

You know, when VS first started and other devs were testing VS, it initially appeared they were viciously attacking VS for no reason. I quickly discovered that they were not attacking VS at all, quite the opposite, they were actually just trying to help. Once I discovered this, I truly appreciated them spending their time testing VS for bypasses.

Testing takes a lot more time than you could possibly imagine. Often times it is difficult to find a working sample, or something else goes wrong, and you end up spending 5-20 hours on a single test. So the thing is, once the test is fully working, it only takes a few minutes to test other security products, so why not test them as well? It helps other devs, end users and the entire malware community as a whole.

Sure, I could have reached out to Andy, but when I have done so in the past he has always had the same reaction. Andy is a great guy, but sometimes two people will simply never see eye to eye.

Sooner or later every dev will discover that other devs are simply trying to help by testing their software.

Thanks a lot for the detailed explanation. As long as there is no bad blood between you two everything is fine. You both have great tools and just shouldn’t have to diss each other. But as you said, if you were actually just trying to show up the security flaws of Andy's tools rather than badmouth them, then I take back what I said earlier. It just seemed to me that the discussion went in a toxic direction for no reason. Personally I think you should discuss this further in a PM and clear any misunderstandings away.
I hope that you didn’t take it the wrong way and cancel my VoodooShield subscription now.

I just want peace and harmony