Slashdot Mirror
Free Tools For Detecting Hacking Team Malware In Your Systems
An anonymous reader writes: Worried that you might have been targeted with Hacking Team spyware, but don't know how to find out for sure? IT security firm Rook Security has released Milano, a free automated tool meant to detect the Hacking Team malware on a computer system. Facebook has also offered a way to discover if your Mac(s) have been compromised by Hacking Team malware: they have provided a specific query pack for its open source OS analysis tool osquery.
So how do we know we can trust the hacking tools designed to tell us if the hacking tools have installed hacking tools?
If this shit isn't proof that giving governments backdoors to security and crypto is a terrible idea, I have no idea what is.
Lost at C:>. Found at C.
Milano is the spyware...
Three days from now?? Thats tomorrow!! ~Peter Griffin
How do I know that Milano isn't a trojan that will install the very thing I am trying to avoid?
The Gregory House / Fox Mulder combo: Everybody lies, trust no one.
As others have said, how do we know that these tools aren't malware themselves?
Get free satoshi (Bitcoin) and Dogecoins
C'mon guys don't be stingy, share your scripts for the linux
Thank you Apple Mac!
you dipshit
Without trolling about Facebook, OSX (or CentOS or the other OS's listed on the osquery page and omitted in the summary), or any form of relational or non-relational database, can someone explain to me the advantages of an abstraction layer that presents the operating system as a database to be queried by SQL? Is it to provide cross-compatibility to checks that need be written only once for many operating systems that differ in minor regards? Why use SQL instead of creating a programmatic API like virus scanners usually do?
...a way to discover if your Mac(s) have been compromised
Everyone knows that Macs are impervious to viruses/malware. Duh!
Hmm, some security firm I've never heard of, releases a tool I've never heard of, which is supposed to tell me if I've been got spyware with alleged government ties. Yeah, that sounds super trustworthy...
Oops, I left the sarcasm bit turned on. Sorry about that...
Like I said, those tools would need to be open source, otherwise what's the point, you might end up being jacked through your fear of being jacked...
...so, to see if I have undetected malware buried in my system, I should run an unidentified exe file from a company I've NEVER heard of?
Well, that sounds like a great idea.
-Styopa
Hate to break it to You, You look so pretty in your small little iSheep bubble. but their malware IS cross-platform and those platforms DO INCLUDE Mac.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion. -- Spazmania (174582)
Getting away from it all. Raise a few barns. Marry a few relatives. Have me a good old time. I'll be the one with the purple triangle on the back of the buggy.
When did the triangle stop being reflective orange?
Ohh, it's THAT kind of purple triangle.
Why would I check my Mac? Macs don't get malware, pshaw!
(derp)
2/54, could be false positives I've at least heard of Rook Security although I forget in what context ;)
I'll take my chances with the Hacking Team malware, I trust them more.
"Zero need...Thank you Apple..." The author believes he has zero need for malware detecting software, thanks to his use of Apple Macintosh.
Figured I'd take a look at the tools. Download what claims to be the software for windows (first link). Get presented with a Zip file, as expected. Open zip file and find.... OSX software. Thinking I clicked on the wrong link I went back to download a second time... Same file.
So... yeah.. ranking real high on the trust value right now.
https://github.com/botherder/d...
https://github.com/botherder/d...
https://resistsurveillance.org...
A shame their latest release was Dec 4, 2014.
This software has the potential for doing good, but it looks quite limited in scope at the moment. Someone needs to give the developer some cookies or something to push further development.
The first download link is broken and the second one was flagged by my antivirus. Great article checking, guys.
I have this faith in whatever is posted to /. good or bad, but if it's questionable (How to build weapons, JSTOR) I follow the safety in numbers rule which /. provides.
Two sites were called and I don't think it was RookMilano, while in hex, Microsoft was prevalent through out
onesettings-cy2.metron.live.com.nsatc.net ; vortex-cy2.metron.live.com.nsatc.net both are certificate sites.
It's fairly CPU intensive, something you'd run at night or downtime; yet the same thing as as malware detection, if you don't have any, you don't know what it's suppose to do when it finds it.
For windows it's a command window so a redirect to a text file is easy to do; as the only thing reported was "file fine" after each and every file.
Thank you for your comments!
.py script on GitHub can be leveraged. We have learned a lot during our releases to include, leaving '.DS_Store' within the zip, consistent folder/file names, etc.
In order to ensure full transparency and growth to the Milano tool we are releasing the source code on GitHub (link below). Our intentions are to give people a way to protect themselves. The executable was created with the lowest technical user in mind and now we want to make sure we are completely transparent with how our tool operates. In lieu of executing the binary the
This is the first time we have released tools to the public for free. We will continue to develop, improve, and grow our processes as these opportunities are identified. We truly appreciate the feedback and suggestions and will continue to take them into account with every release.
GitHub Repo: https://github.com/RookLabs/mi...
Blog Post: https://www.rooksecurity.com/w...
As requested. Thank you all for the feedback. https://www.rooksecurity.com/s...