You’re totally right about Yara. Unfortunately I skimmed through the article pretty fast before commenting as I was on a rush when I read it and missed this part. Just finished a second read, great article and well detailed. But my point about detection is more about the good old VirusTotal submission.
As for Nuitka, I was not able to make it work but I will try again. The alternative I also tried in the past was using Cython to generate C code then compile it but because it requires packaging Python std libs Dlls it was too much trouble and I ran into crashes when running.
I also had bad experiences when using packers because they have a tendency to trigger AV detection just for being packers, like ASProtect. Python malware is definitely a topic that deserves more in depth dive.
The article mentions that Python malware comes with difficulties but in my experience it has the advantage to be an easy and simple way to write reliable malware. Packaging with PyInstaller to create a single (but large) executable is easy and helps avoiding detection as the interpreter is embedded in the PE (I never went in depth on this topic but it would be interesting to check out).
Shameless plug; I wrote a few popular articles on 0x00sec about Python malware on Windows just to show how simple and easy it is to build either using ctypes to call WinAPI functions or using pywin32 wrapper which makes the whole thing a lot faster.
There are better ways to hide. From experience (I work in security), the ones I would use are (individually or combined):
- Have the VPN set up in my router using OpenWRT (the R7000 is great for that) and drop all connections when VPN disconnects (with a script).
- Rent a VPS on a botnet friendly host that accepts Bitcoins (i.e Hostsailor).
- Then do all my shady stuff from the VPS or even better, configure Tor and proxychains on the VPS then use proxychains when doing anything on a remote host.
I think the guy was just lazy and preferred convenience.
> I won a free certification course as an EC-Council Certified Security Analyst, and it's the biggest joke I've ever seen. It's such a massive fucking joke that I decided to not even renew my certification for free because it would just have been a waste of time.
I've been in the field for a couple of years. I work for a global corporation with 10k+ employees and most of our team members in the security department are judge on their skills and various other factors and we filter potential candidates with a small CTF. Certs have very little importance for us, but we're the exception. Most big compagnies require certifications and oddly they are the ones getting hacked.
In the field, we all know that EC-Council certs are bullshit. They are, at best, the laughing stock in infosec because their "Ethical Hacker" certification is a multiple choice answer and requires little technical knowledge and no hands-on.
However, there are a few certs out there that need a lot of work and technical knowledge to be learn for passing it, such as OSCP. It might be easy to get for someone with 10+ years but for relatively new comers, it's a really good challenge to tackle. I started with their lab, thinking it was going to be a piece of cake for me but it's more difficult than I expected, which is a good thing.
But I see your point and I mostly agree.
Care to explain why you think intrusion detection is bullshit?
Pretty much. Unless highly technical (like hardware hacking, Windows internal, reverse engineeeing and such), most courses at Blackhat are way overpriced for the content. Moreover, I discussed with a few guys from FireEye at last year’s conference and they mentioned that they were not getting paid for teaching those course. If true (I’m skeptical) I wonder there that money goes.
I said it before and I’ll say it again, block size increase alone is not sustainable. The BCash boyz are stubborn and in denial. Might work for now but in the long term they will need another fork to increase the block size again and so on. They don’t have a Lightning Network either which is already available on Bitcoin Testnet and proved to be extremely fast (almost instant) at very low cost. I hold both but I’m realistic. I only hold BCash because I know the price is being pumped so I’ll make some money with it.
Trading just started and CBOE is not nearly as big and as active as CME.
Also, trading volume for futures in general is pretty low. You're rarely going to see volume above 100k a Sunday night. Coffee futures have around 23k volume right now.
I remember seeing somewhere that they mostly rely on Mountain Dew for hydration and even feed it to the baby, so bad that they have early tooth decay issues. Apparently the amount of people living in trailer parks is huge and constantly growing.
Troubling when you think that this is happening in the US. I saw that kind of situation in central america.
“The theme of this conference — developing a digital economy for openness and shared benefits — is a vision we at Apple share,” Cook said, in widely reported remarks. “We are proud to have worked alongside many of our partners in China to help build a community that will join a common future in cyberspace.”
I don't even know how to react to his friendly remarks towards China. Is it to keep the government happy and keep profiting from the Chinese market? That would make sense. But sometimes I feel like he's become too friendly.
They are and they will be even more. The bigger the Segwit adoption rate is, the lower the fees. The adoption still is under 50%, it was around 15-20% in October but it's getting there.
The alpha has been published in January. You can use it if you want, at your own risk.
The devs are working hard and the beta is likely to come in 2018. People think naively than increasing the block size will change something. It will in the short or mid term, but not in the long term and you can't keep increasing the blocksize. There needs to be a permanent, well implemented solution and that's what's coming and why it's taking so long.
As for Nuitka, I was not able to make it work but I will try again. The alternative I also tried in the past was using Cython to generate C code then compile it but because it requires packaging Python std libs Dlls it was too much trouble and I ran into crashes when running.
I also had bad experiences when using packers because they have a tendency to trigger AV detection just for being packers, like ASProtect. Python malware is definitely a topic that deserves more in depth dive.
Good work!