Jump to content

itman

Most Valued Members
 View Profile  See their activity

  • Posts

    12,172

  • Joined

  • Last visited

  • Days Won

    319

 Content Type 

Posts posted by itman

    Whitelisted Malware

    in Malware Finding and Cleaning

    Posted · Edited by itman

    Appears "the message is not getting across."

    Again. LiveGrid Reputation status has nothing to do with Eset whitelist status of the process. With a few exceptions I will get to later, LiveGrid reputation is based on number of Eset users of the process.

    I will use an HP monitor driver installer as an example. Most people never install a driver for their monitor; using the Win default driver instead. Also, this installer is specific to one HP monitor model. I have used this installer previously and its been sitting in my Downloads folder for a few years. Finally, this installer is validity code signed by HP. Let's see what LiveGrid's Reputation ranking is for this installer;

    Eset_Rep.thumb.png.97944b4c75872d91bdf9c01ef1113ba5.png

    Now for those LiveGrid process Reputation usage exceptions.  One is anything Microsoft code signed has high reputation status. Also as this malware example shows, anything code signed with an EV cert. is given high reputation status. This assignment parallels that done by Win SmartScreen processing.

    As far as what Eset uses process whitelisting for is given below;

    Quote

    ESET LiveGrid®

    Additionally, it implements a reputation system that helps to improve the overall efficiency of our anti-malware solutions. A user can check the reputation of running processes and files directly from the program's interface or contextual menu with additional information available from ESET LiveGrid®. When an executable file or archive is being inspected on a user’s system, its hashtag is first compared against a database of white- and blacklisted items. If it is found on the whitelist, the inspected file is considered clean and flagged to be excluded from future scans. If it is on the blacklist, appropriate actions are taken based on the nature of the threat. If no match is found, the file is scanned thoroughly. Based on the results of this scan, files are categorized as threats or non-threats. This approach has a significant positive impact on scanning performance. This reputation system enables effective detection of malware samples even before their signatures are delivered to the user’s computer via an updated virus database (which happens several times a day).

    https://help.eset.com/glossary/en-US/technology_livegrid.html

    Whitelisted Malware

    in Malware Finding and Cleaning

    Posted · Edited by itman

    Following up on @Peter Randziak above posting, VT analysis shows the .exe was signed using a stolen Micro-Star root certificate that had been subsequently revoked;Eset_Cert.png.286ef926a89d367a54d5d70f3b36e6eb.png

    Assumed is the Digicert  cert. assigned to the .exe was an EV one. Appears Eset Reputation scanning, like Win SmartScreen, will auto trust an executable signed with an EV cert.. However, SmartScreen does validate the cert. chain path. SmartScreen will also block the process from executing in the instance of cert. chain validation failure. I have not seen Eset Reputation scanning having like capability. Finally with Eset HTTP/HTTPS scanning enabled, Eset fails the EV cert. validation test at badssl.com;

    Eset_EV.thumb.png.53c3d769be1503587f48b6a714d74cb8.png

    The Eset Reputation issue aside, it does not explain why Eset could not detect this malware when 40+ vendors at VT did. It appears most of the detection's at VT were behavior based. One malicious behavior observed was an AMSI bypass deployed by this malware.

    It has been repeated stated in the forum that a process's signing status does not factor into Eset's scanning "at-first-sight" upon creation/startup/etc.. It would be "revealing" if this is not done for EV signed processes.

    License problem - wrong region?

    in ESET NOD32 Antivirus

    Posted · Edited by itman

    4 hours ago, Bryszak said:

    I bought it legally in Poland on Allegro.pl. Everything was fine for over 2.5 years and suddenly there was such a problem?

    It appears Eset has tightened its license validation processing and now performing locality checks on previously installed installations.

    Whitelisted Malware

    in Malware Finding and Cleaning

    Posted · Edited by itman

    56 minutes ago, AnthonyQ said:

    It is not true.

    Quote

    Reputation—In most cases, ESET Internet Security and ESET LiveGrid® technology assign risk levels to objects (files, processes, registry keys, etc.) by using a series of heuristic rules that examine the characteristics of each object and then weigh their potential for malicious activity. Based on these heuristics, objects are assigned a risk level from 1 – Fine (green) to 9 – Risky (red).

    The ranking color is based on prior Eset "first sight" status of the .exe.

    For example after a Win OS cumulative update resulting in many  OS files being changed, LiveGrid will show many of these files with a yellow color; i.e. low reputation. You will observe that as time elapses, the color of these files will change to green.

    Likewise, a red color would be indicative of an unknown process; i.e. never seen by Eset previously.

    I will also add that the above Reputation description is deceptive in that it means a cumulative ranking of the number of times the process has been scanned on devices with Eset installed.

    Again, LiveGrid does not perform any cloud malware scanning other than for blacklist status.

    Can I disable the admin password for firewall alerts?

    in ESET Internet Security & ESET Smart Security Premium

    Posted

    Using a password to access Eset GUI settings is an optional setting and is not enabled by default. Therefore it is assumed you manually set password use.

    Using a password to access Eset GUI settings makes the product cumbersome to use where a feature such as Interactive firewall requires frequent access to the GUI. It is your choice here as to whether password use should be disabled or not.

    Whitelisted Malware

    in Malware Finding and Cleaning

    Posted · Edited by itman

    33 minutes ago, AnthonyQ said:

    Look at the first pic the OP shared. Before the detection was created, this malware sample had been whitelisted (indicated by the green color) in the LiveGrid.

    All that LiveGrid Reputation status display indicates is how many Eset installations the .exe has been installed on. Reputation status has nothing to do with whether the process has been white/blacklisted or the like.

    As such, I have always viewed LiveGrid Reputation display status as a useless feature.

    AV - Test

    in Malware Finding and Cleaning

    Posted

    As far as the AV-C Malware Protection test series goes, the only thing I pay attention to is the On-line versus Off-Line detection scores. It is not uncommon for malware to tamper with or disable a device's network connection. Hence, a high score in Off-line detection capability is a must.

    Web Access Protection and Encrypted Client Hello (ECH)

    in ESET Endpoint Products

    Posted · Edited by itman

    3 hours ago, SeriousHoax said:

    BTW, for Firefox one may have to manually set "network.dns.echconfig.enabled" to True.

    Still a no-go. All three tests show ECH not enabled.

    If I disable Eset HTTPS scanning, all three tests show ECH enabled.

    -EDIT- According to Mozilla, ECH in Firefox 118+ is based on existing DoH; DNS over HTTPS, processing. So assume Eset HTTPS scanning is also busting that.

    Web Access Protection and Encrypted Client Hello (ECH)

    in ESET Endpoint Products

    Posted

    1 hour ago, SeriousHoax said:

    Sites to test if ECH is working or not:
    https://tls-ech.dev/
    https://defo.ie/ech-check.php
    https://crypto.cloudflare.com/cdn-cgi/trace/

    Max Protection in Firefox doesn't appear to work.

    First, verified that Cloudflare DNS servers were being used;

    image.thumb.png.d92a5cb3fafdcee208851aa43fafe330.png

    However, above ECH test sites all show it is not enabled. So @SeriousHoax is correct; Eset's SSL/TLS protocol scanning busts it.

     

    Potential unsafe application

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by itman

    17 minutes ago, Tio said:

    Thank you very much for the reply, how often do you suggest an in depth scan should be performed if nothing suspicious happened ? 

    Eset recommends once a month in-depth scan at the minimum. A weekly default Smart scan otherwise should be sufficient;

    Quote

    We recommend that you perform regular (for example once a month) in-depth scans of your system to detect viruses not detected by Real-time file system protection.

    https://help.eset.com/ees/10.1/en-US/?idh_page_scan.html

    The above stated, Eset's real-time scanning will detect the vast majority of malware upon creation on the local device. Also of note is Eset performs default scheduled scans of known system areas where malware resides at system startup and after Eset update activities.

    Potential unsafe application

    in ESET Internet Security & ESET Smart Security Premium

    Posted · Edited by itman

    It appears the Eset scan cache was not cleared when the second on-demand scan was run. This resulted in results from the first scan influencing the detection's from the second scan. Running back to back full on-demand scans is not expected normal scan behavior.

    7 hours ago, Tio said:

    5. Why the pot. unsafe app was off by default ?

    This option detects exactly as stated. These apps are not malware per se, but exhibit undesirable behavior such as scams to purchase unneeded services and the like. Due to the fact users might be using such apps as you are, the option is not enabled by default at installation time.

    Block web with "URL list management" and "web control" on Eset endpoint security

    in ESET Endpoint Products

    Posted

    This posting about Facebook use in Vietnam is informative: https://www.washingtonpost.com/world/2023/06/19/facebook-meta-vietnam-government-censorship/ . It also might explain the different home web page. Also, assume Internet communication is being actively being monitored there.

    Since Eset appears to function properly in browsers with a Private mode, that is the mode that should be used for social media access.

×
×
  • Create New...