Malware Hub Report VoodooShield 6 - December 2020 Report

[harlan4096]

I recall in the past We had a signed jar in the Hub...

 

[danb]

Very interesting... you might be on to something there. When VS is ON it should block it either way, but we better test AutoPilot just to be sure.

I will sign one right now and see what happens. If you guys have a sample you want me to sign and test, I would be happy to.

Edit: my sig will not let me sign a .jar file, so hopefully we can find some already signed.

 

[danb]

I just looked at this code segment in VS, and we would have to test to be sure, but the way the code is written for AutoPilot, if the sig can be verified then it will be auto allowed (bypass). If the sig cannot be verified it will be blocked. There are obviously other checks in place for AutoPilot, but for this particular scenario, it looks like it all comes down to whether the sig can be verified or not. Ultimately we need to test to be sure, but I love the way you guys are thinking!

 

[harlan4096]

@danb: it would be interesting if quarantined files are stored with some kind of encrypting or compressed:

 

[danb]

Great point, thank you @harlan4096! What do you guys think is better, encrypting or compressing?

 

[harlan4096]

Or compressed with a private key only known by the application

 

[danb]

Thank you for the suggestion @harlan4096, I added encryption of quarantined files in this version...

VS 6.06e

https://voodooshield.com/Download/InstallVoodooShield606e.exe

SHA-256: c6721bdb861b9c772f1e1edf67686d75cecd9fe3d0fafb9e264d55b548013b80

There were a few other minor changes, but nothing that should affect testing.

 

[harlan4096]

Ok, the 1st testing week just finished with Mode Free + AutoPilot...

@danb: would You like any specific VS mode to be tested? I just enabled Registered Mode... Always On? SmartMode?

 

[danb]

Sounds great, thank you! Maybe if you are just testing a couple samples a day, it might make sense to first test in Smart ON, then switch to AutoPilot and test again? But if you were just testing one one, I think AutoPilot makes the most sense.

 

[oldschool]

I think AutoPilot makes the most sense.

I agree because it's the mode most like an AV.

 

[danb]

Now that they are testing the Pro version, just for fun, they should try AutoPilot on the Relaxed Security Posture .

 

[harlan4096]

Do You mean this?

 

[danb]

Hehehe, yeah, exactly... VS is quite relaxed in this setting, and I have always been curious how well it would do .

 

[harlan4096]

Ok, done

 

[harlan4096]

It seems today was not a good day for VS in the last malware pack testing, it had problems to stop some signed malware exe files...

Results coming soon...

 

[Gandalf_The_Grey]

It seems today was not a good day for VS in the last malware pack testing, it had problems to stop some signed malware exe files...

Results coming soon...

Can that be caused by the change to "Relaxed Security Posture" in VS settings?

 

[harlan4096]

I still don't know, the truth is that VS tagged them as Safe in static scan, so when executed seems it let do them "almost" everytthing...

 

[oldschool]

@harlan4096 would you please indicate VS mode and posture in your test results? That would help readers to evaluate results. TIA!

 

[Freki123]

Even with relaxed mode the file has to be labeled from whitelist cloud as safe. Atleast thats what the "relaxed mode" discription says. And since whitelist cloud should only allow known safe files im curious what happened

 

[harlan4096]

@harlan4096 would you please indicate VS mode and posture in your test results? That would help readers to evaluate results. TIA!

Done!