/tech/ - Technology

Also, here's a few other reports for anyone who's interested:

https://cdn2.hubspot.net/hubfs/270968/2015_cylance_website/assets/case_studys/prevention-vs-detect.pdf?t=1458251804413

Some Case Studies:

https://cdn2.hubspot.net/hubfs/270968/assets/PROTECT/case_studies/case-study-insurance.pdf?t=1458251804413

https://cdn2.hubspot.net/hubfs/270968/assets/PROTECT/case_studies/case-study-healthcare.pdf?t=1458251804413

Over 6.2 million code branches heating your CPU because you wouldn't use an OS with pledge() or seccomp()

>>545434

>Autism: the post

I didn't say I wanted to fucking use the damn thing, or that it was the best solution; I said I wanted to get more information on how it works and whether or not it will be able to improve malware detection capabilities.

feel free to ignore this thread and go back to fellating Theo the Rat and bitching about muh freedumbs if that's what you'd prefer, though.

I was interested in this, seeing as it's a new technology and all, but apparently /tech/ is all about endless "which Linux distro is the most autistic guise?," "install Gentoo!" and facebook bitching threads and not actual technical discussion.

>>545442

Calm the fuck down OP

>>545442

Then You should know most of /tech/ doesn't give a shit about proprietary products or windows antiviruses. Your post is like throwing yourself in the fire for anyone to eat you alive. Common sense is a lot better then "Brand new $thing that protects you from yourself!!"

>>545538

>common sense

What are drive by downloads?

What is rfi?

What is having stupid employees who didn't buy Common Sense Current Year Platinum Edition.

Maybe you don't have a reason for caring about malware, but there's plenty of reasons for people with control over data more important than frog maymays to worry, and so there is a reason for antivirus software to exist.

So I find it prudent to know about how different products work and how effective they may be.

Until we get a bunch of unbiased tests, it looks like marketing garbage to me. Spiceworks link reeks of shilling, there's way too many posts from Cylance staff and happy customers in the thread and I'm having hard times finding any negative replies there.

There is some random test that shows it's still not 100% reliable and has a lot more false positives than any other AV

https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2015/cylance-protect-1.2-154676/

Just stick to stricter policies, use MAC, etc.

>>545557

>proprietary antivirus

That's retarded. How can you know it's not malicious by itself?

SAGE YO

>>545581

I'm not personally considering using it at the moment, since it's only available for enterprises running Windows and I'm a single user running Linux.

I know the Spiceworks link has a lot of posts that sound like shilling, and I'm well aware that the company is investing heavily in advertisement (there's a bunch of ads for Cylance literally all over the place where I live; first time I've ever seen ads for antivirus products tbh). That's why I decided to ask here -- because the huge number of ads I've seen piqued my interest and I was wondering if Cylance is really worth it or as big of a deal as people are making over it.

What made me consider that it may be effective was the Virus Total test where Cylance detected all the malware whereas AVG only got seven. That would appear to be a pretty good test to me, since the malware samples were both new and random, so they couldn't have tampered with the detection rules to improve the chance that Cylance would detect it.

Still not sure it's as effective as they claim, though. Since it checks for discrepancies between reported file types and the actual data regarding similar files, couldn't virus authors simply modify their malware to look more like the files they're purporting to be -- i.e. not try to pass off a kernel driver as an .exe file or passing off malware as a service instead of a user executable so Cylance doesn't check if it has a UI? How effective would you think Cylance would be against malware like that?

deep neural networks used to detect malware

next up

deep neural networks used to hide malware from the deep neural network used to detect it

>>545599

Yes, but which side has the upper hand?

I've heard before that the people writing malware have the upper hand over antivirus providers, but what evidence backs that up (especially given the 97+% detection rate for zero day threats (i.e. not old cataloged malware)), and why is it the case?

You'd think that antivirus vendors, with all the resources at their disposal, would be able to get ahead of the malware producers -- why isn't that the case?

I could see antivirus vendors being easily overwhelmed back in the days when all AV did was signature checking that had to be updated manually, but you'd think that today with heuristics, neural networks, sandbox execution, inter-group collaboration, mathematical based discrepancy detection, and automated file analysis, it would be possible for antivirus vendors to keep up with the threat and find ways to defeat it.

>>545597

>>545608

I wouldn't speculate on how Cylance actually works because it's obviously their trade secret, but yeah, there is no 100% way to tell if the software is actual malware or not.

Malware does what end user does not want the software to do, but since end user is not the part of the system, AVs can only speculate if the program is malicious or not by detecting shady behavior. Simple program that deletes files on disk can be a program that cleans cache or program that tries to cause system malfunction. Don't know about 7-8-10, but XP allowed any random application to exhaust window handle pool, rendering UI unusable. Program that allows remote access to user PC may be set up by the user himself or may be an actual backdoor. Notice how Cylance detects 0-day better but gives a lot more false positives.

If you need protection you need actual access control, not analysis.

>>545616

But can't you use fine details about what a program is doing to tell if it's malware? For example, how common is it for a non-malicious program to inject itself into a browser? How common is it for a cache-cleaning program to not delete just a few files, but everything in your documents folder?

It seems like if you go for more fine-grained analysis, it should be easy to tell malware from normal software. Why isn't it that easy in reality?

And how feasible would it be for an antivirus to actually disassemble an executable and analyze the actual machine instructions? That would seem to be able to provide a very detailed analysis of how it operates, which could be useful.

It's just that. The only people who'd benefit are run of the mill windows users who otherwise still buy norton and mcafee. If it works better, then good, though wait to hear about false positives first.

But everyone who's serious about their security is already doing something stronger and this is just a novelty.

>>545557

>What are drive by downloads? What is rfi?

What is ublock, requestpolicy, noscript, chocolatey for winfags, wget, or curl?

Browsers are for browsing, package managers are for downloading/installing programs, and everything else that "needs" to be downloaded is best left to wget/curl

>What is having stupid employees

Try not encouraging them

>but there's plenty of reasons for people with control over data more important than frog maymays to worry

Desktop Viruses are 99% pebkec. Antiviruses are redundant when the user is in complete control.

>and so there is a reason for antivirus software to exist.

...no there really isn't. That's the same as saying "there should always be someone holding your hand before you walk across the street"

>>545426

What interests me more is how malware authors will subvert this method.

Computer security is an endless cat and mouse game and these faggots are selling their product as a final answer. Let it prove itself and we'll see how well it works in the real world.

>>545557

most viruses are obtained via the browser or an executable. to make firefox a lot more secure, change its default settings to sane ones (some good suggestions here: https://gist.github.com/haasn/69e19fc2fe0e25f3cff5), install ublock origin, request policy continued or umatrix or policeman, noscript, self destructing cookies, betterprivacy (if you use flash), https everywhere, and refcontrol. some of these require a little setup to use properly.

as for executables, the sane OSes have package managers and security software thats worth using, plus most viruses aren't made for them. on windows you're limited to chocolatey and common sense.

>>545426

>I don't give a flying fuck about how it's licensed or if Richard Stallman is going to throw a shitfit about it. I want to talk about how it works and if it's going to have an impact.

Sorry, but that's just dumb. I can accept that you're interested in it and willing to use it even though it's proprietary, but if you want to talk about how it works, you should at least care about whether or not you're allowed to study it.

>>545426

is no one going to point out that drivers are executables, but are linked to different libraries, at least on windows