4 ms·

Tell us more about "I don't aee anything suspicious". How exactly do you know it's not a binary that hashes all your files using a key and asks for btc to rever

Tell us more about "I don't aee anything suspicious". How exactly do you know it's not a binary that hashes all your files using a key and asks for btc to revert?

peddling-brink 3y ago
There are libraries that would be useful for cryptography that you wouldn’t likely need in an audio codec. If the binary imports those libraries, it may be visible with a bit of prodding.
- p-e-w 3y ago
  Unless they are statically linked. Or the binary uses executable compression. Or obfuscated dynamic loading. Or about a million other techniques that can thwart dependency analysis, and which have been well-known for decades.
  - TylerE 3y ago
    And precense of those things is basically the first thing any malware heuristic looks at. Why are you so emphatically stating them as if they are news?
    - 0xDEADFED5 3y ago
      i think they were just examples of how simply looking at imports isn't good enough, and it's true. on the plus side, by hitting HN there are more eyes on it and hopefully more consensus on how safe/interesting this is
userbinator 3y ago
Open in hex/text editor, scroll through and look for anything suspicious like network, crypto, obfuscated sections (major red flag), strange strings, etc. The #1 most reliable sign of malware is if it's unusually large and packed/obfuscated, but this isn't. The guy even has his full name and contact info in there. This is harmless. If you don't trust me you could upload to an online malware multiscanner (which tends to invite false positives, but better than nothing).
- p-e-w 3y ago
  It's not about whether this particular announcement, with these particular executables, is trustworthy or not. It's about the whole process of regularly downloading and running executables uploaded by individuals to a BBS-type forum being unimaginable in most other parts of the software world, and violating every security "best practice" written about in the past 30 years. I know that this is how things were once done everywhere. But that was a long time ago.
  - Dalewyn 3y ago
    Are we even in the same universe? The vast majority of the world still downloads and runs executables uploaded by individuals, albeit perhaps not on a bulletin board or forum (most of those have been killed and replaced by social media).
    - wokwokwok 3y ago
      This argument comes up reasonably regularly. No, the majority of the world does not download and run binaries from non-reputable sources. The distinction between reputable and non-reputable varies, but broadly easily spoofable user uploaded content falls into the non-reputable. Most people download software from trust worthy websites like the official chrome website. Indeed, the fact that people are continually scammed by this sort of attack is why Apple now refuses to run unsigned binaries by default. To pretend nothing is wrong here is like pretending JavaScript supply chain attacks don’t exist because you don’t want them to exist. …and yet. They do exist; wanting it not to be true does not make it so. Likewise, downloading and running arbitrary binaries from a forum is naive. You simply want nothing bad to happen. That does not mean nothing bad will actually happen. Even if you trust the authors of the posts, how reputable is the forum itself? Are the binary hashes posted? (No, they aren’t). > I'm new in this forum ^ does not inspire confidence.
      - HakanAbbas 3y ago
        Yes, I'm new in hydrogenaud.io. However, I have been active since 2018 in "encode.su". This year, "3rd Global Data Compression(gdcc.tech)" organized by Huawei and Barcelona Autonoma University was held. In this competition, I have the world 3rd place in the "Professional Task 6 - Ultra Fast" category(JABBAR). And I spent only 2 weeks of the 5-month competition process for this degree. We can only share and test such a specific work in specific environments.

Tell us more about "I don't aee anything suspicious". How exactly do you know it's not a binary that hashes all your files using a key and asks for btc to revert?

peddling-brink 3y ago

There are libraries that would be useful for cryptography that you wouldn’t likely need in an audio codec. If the binary imports those libraries, it may be visible with a bit of prodding.

p-e-w 3y ago
Unless they are statically linked. Or the binary uses executable compression. Or obfuscated dynamic loading. Or about a million other techniques that can thwart dependency analysis, and which have been well-known for decades.
- TylerE 3y ago
  And precense of those things is basically the first thing any malware heuristic looks at. Why are you so emphatically stating them as if they are news?
  - 0xDEADFED5 3y ago
    i think they were just examples of how simply looking at imports isn't good enough, and it's true. on the plus side, by hitting HN there are more eyes on it and hopefully more consensus on how safe/interesting this is

userbinator 3y ago

Open in hex/text editor, scroll through and look for anything suspicious like network, crypto, obfuscated sections (major red flag), strange strings, etc. The #1 most reliable sign of malware is if it's unusually large and packed/obfuscated, but this isn't. The guy even has his full name and contact info in there. This is harmless. If you don't trust me you could upload to an online malware multiscanner (which tends to invite false positives, but better than nothing).

p-e-w 3y ago
It's not about whether this particular announcement, with these particular executables, is trustworthy or not. It's about the whole process of regularly downloading and running executables uploaded by individuals to a BBS-type forum being unimaginable in most other parts of the software world, and violating every security "best practice" written about in the past 30 years. I know that this is how things were once done everywhere. But that was a long time ago.
- Dalewyn 3y ago
  Are we even in the same universe? The vast majority of the world still downloads and runs executables uploaded by individuals, albeit perhaps not on a bulletin board or forum (most of those have been killed and replaced by social media).
  - wokwokwok 3y ago
    This argument comes up reasonably regularly. No, the majority of the world does not download and run binaries from non-reputable sources. The distinction between reputable and non-reputable varies, but broadly easily spoofable user uploaded content falls into the non-reputable. Most people download software from trust worthy websites like the official chrome website. Indeed, the fact that people are continually scammed by this sort of attack is why Apple now refuses to run unsigned binaries by default. To pretend nothing is wrong here is like pretending JavaScript supply chain attacks don’t exist because you don’t want them to exist. …and yet. They do exist; wanting it not to be true does not make it so. Likewise, downloading and running arbitrary binaries from a forum is naive. You simply want nothing bad to happen. That does not mean nothing bad will actually happen. Even if you trust the authors of the posts, how reputable is the forum itself? Are the binary hashes posted? (No, they aren’t). > I'm new in this forum ^ does not inspire confidence.
    - HakanAbbas 3y ago
      Yes, I'm new in hydrogenaud.io. However, I have been active since 2018 in "encode.su". This year, "3rd Global Data Compression(gdcc.tech)" organized by Huawei and Barcelona Autonoma University was held. In this competition, I have the world 3rd place in the "Professional Task 6 - Ultra Fast" category(JABBAR). And I spent only 2 weeks of the 5-month competition process for this degree. We can only share and test such a specific work in specific environments.