New Update VoodooShield CyberLock 7.0

VoodooShield
1,418 Replies 307,371 Views
Azazel said:
What are the benefits of enabling WhitelistCloud if I have Cyberlock in Autopilot?
Click to expand...
The main benefit is that WLC will alert you when a file that is not known as Safe is detected. This can be useful in supply chain attacks for example. Thank you!
 
@danb

Hi I recently had an encounter with some custom / obfuscated malware. I was doing a Windows Update, Cyber Locked detected it, it said it was almost safe (around 70%) but I blocked it. Apparently it must have re-tried downloading while I was looking at the CL dialog, because it was installed. ( I remembered the package name and went looking for it in Data Store \ Repositories ) The thing was signed by a RealTek cert. So anyways I uploaded it to VirusTotal. It said no AV vendor detected it, but upon clicking on the Behavior tab, it revealed Log Key Strokes and Anti-VM . That is enough to prove to me that it was malicious. I had long known that my red team is capable of inserting stuff into Windows Update. Perhaps the capability is due to their presence in my LAN using a Bell modem exploit.

Anyways, I just want to notify you that the malware successfully downloaded and installed while I was pondering over one CL dialog. Perhaps some multi-threading is needed.
 
Victor M said:
@danb

Hi I recently had an encounter with some custom / obfuscated malware. I was doing a Windows Update, Cyber Locked detected it, it said it was almost safe (around 70%) but I blocked it. Apparently it must have re-tried downloading while I was looking at the CL dialog, because it was installed. ( I remembered the package name and went looking for it in Data Store \ Repositories ) The thing was signed by a RealTek cert. So anyways I uploaded it to VirusTotal. It said no AV vendor detected it, but upon clicking on the Behavior tab, it revealed Log Key Strokes and Anti-VM . That is enough to prove to me that it was malicious. I had long known that my red team is capable of inserting stuff into Windows Update. Perhaps the capability is due to their presence in my LAN using a Bell modem exploit.

Anyways, I just want to notify you that the malware successfully downloaded and installed while I was pondering over one CL dialog. Perhaps some multi-threading is needed.
Click to expand...
Actually, VS / CL is multithreaded and each block / prompt is handled independently, so there is no chance this is what happened.

Can you please send me your C:\ProgramData\CyberLock\DeveloperLog.log? It should tell us why that file was allowed.

I promise you... nothing "snuck past" VS / CL ;). Something else happened and the log might tell us.
 
BTW, I just thought of a scenario that might have happened to you. If there was another item on the whitelist that matched the same Realtek certificate, then it could have auto executed, but only if the certificate was verified, and only if it matched a certificate from an item in the whitelist. If this is the case, and if the file is malware, then we need to remove Realtek from the list of certificates that can be auto allowed if already whitelisted. I do not think this is the case though... I bet something else happened.
 
Is it possible to disable Action: Auto Allowed and have only Action: Rule Allowed from Autopilot.
For example, Auto allow only binaries of Windows System (C;//Windows) signed by Microsoft,
But everything else be subject of Autopilot checks?
 
rhythm said:
Would VS / CL notify me of any new or unknown files? I've tested it and found it helpful. I want to use it without an antivirus as a standalone program. (All I care about is being alerted to every unknown file.)
Click to expand...
Yes, as @Freki123 suggested. You certainly can use it alone as long as you have some type of web protection for you browsers.
 
Freki123 said:
You may consider activating the "whitelistcloud" in CL. It's whole purpose is to make sure that only safe files are running. // Atleast to my understanding that's the point of it :D
Click to expand...
oldschool said:
Yes, as @Freki123 suggested. You certainly can use it alone as long as you have some type of web protection for you browsers.
Click to expand...
I have enabled WC and prefer browser protection. Will CyberLock notify me of any unknown software or malware? Also, are there any known legitimate bypasses?
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top