App Review Voodooshield Free vs EternalBlue/DoublePulsar/Peddlecheap

[Deleted member 178]

The video I sent shows that ETERNALBLUE exploit is successful, it can install the DOUBLEPULSAR backdoor. DOUBLEPULSAR can install the PEDDLECHEAP malware payload. Some functionality of PEDDLECHEAP works, some not. E.g. one cannot start a command shell. But one can steal password hashes as far as I remember. And clearly it can steal information from the system. If the NSA is hacking someone with ETERNALBLUE/DOUBLEPULSAR/PEDDLECHEAP where VS installed, they will come up with a way to shutdown VS easily. I had no time to demonstrate this, but it is possible.[

Same happened when VS was configured for white-list mode.

WannaCry Exploit Could Infect Windows 10

 

[Visa]

Great video, superb.

Easiest explanation:
No process spawn = no anti-executable involvement.

Can't be explained more straight forward than that!!

 

[danb]

Great video, superb.

Easiest explanation:
No process spawn = no anti-executable involvement.

Can't be explained more straight forward than that!!

Hehehe, I wouldn't be doing any back slapping yet .

WannaCry Exploit Could Infect Windows 10

Stay tuned!

 

[Andy Ful]

Can VoodooShield in Autopilot mode (used in video) block rundll32.exe?
In Dan's video test, VoodooShield was set to Always On.

 

[danb]

Yeah, but it is a little more relaxed on what it will allow when on AutoPilot, although it is still quite secure when on AutoPilot.

See, VS uses a special algorithm that compares strings, and if there is a "close enough" match, then VS will auto allow it. It is hard to explain without giving away any trade secrets... but I can tell you, on no uncertain terms, that there is a lot more going on under the hood than anyone would ever expect.

If you put VS on AutoPilot and run the following command line, VS will block it. I reserved this one Rundll32 command line for testing (I did not hardwire this one in ).

Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

 

[_CyberGhosT_]

See, VS uses a special algorithm that compares strings, and if there is a "close enough" match, then VS will auto allow it. It is hard to explain without giving away any trade secrets... but I can tell you, on no uncertain terms, that there is a lot more going on under the hood than anyone would ever expect.

That's good to know, DeepArmor delves into the "Strings" as well. I often use it in concert with VS.
I am now wondering Dan if I should be running DA with VS or not ?

 

[danb]

That's good to know, DeepArmor delves into the "Strings" as well. I often use it in concert with VS.
I am now wondering Dan if I should be running DA with VS or not ?

Yeah, and they probably extract the strings from the PE as well, as a feature for their ML/Ai. It is interesting stuff .

Sure, if they run great together, I would keep them both. I am not sure how many models they use, but I am guessing probably 3, so you would then have 6 ML/Ai models protecting you... and that is pretty cool!

 

[_CyberGhosT_]

Yeah, and they probably extract the strings from the PE as well, as a feature for their ML/Ai. It is interesting stuff .

Sure, if they run great together, I would keep them both. I am not sure how many models they use, but I am guessing probably 3, so you would then have 6 ML/Ai models protecting you... and that is pretty cool!

Yeah I haven't noticed any issues at all and I got in early with the DA beta so I have had them side by side for some time now.
Thanks for the input I will leave it "as is"

 

[S3cur1ty 3nthu5145t]

Can VoodooShield in Autopilot mode (used in video) block rundll32.exe?
In Dan's video test, VoodooShield was set to Always On.

In the link Dan just posted himself
https://www.wilderssecurity.com/thr...infect-windows-10.394550/page-11#post-2687554

Zoltan states that the same thing happened when he tested it in White-Listing Mode.

 

[danb]

In the link Dan just posted himself
WannaCry Exploit Could Infect Windows 10

Zoltan states that the same thing happened when he tested it in White-Listing Mode.

Yep... start reading at that point, scroll down, and stay tuned .

 

[Andy Ful]

In the link Dan just posted himself
WannaCry Exploit Could Infect Windows 10

Zoltan states that the same thing happened when he tested it in White-Listing Mode.

Always On = White-Listing ???

 

[S3cur1ty 3nthu5145t]

Always On = White-Listing ???

You know as much as me at this point, Zoltan would need asked over at the other forum. It would either be Always On or the default Smart Mode.

 

[Deleted member 178]

Always On = White-Listing ???

You know as much as me at this point, Zoltan would need asked over at the other forum. It would either be Always On or the default Smart Mode.

Dan said yes, so if the dev said it himself, should be true.

 

[Deleted member 178]

Voodooshield Free on "Always On" mode failing to protect data exfiltration (password stolen) from EB-DP-PC