Slashdot Mirror
Neutrino Exploit Kit Has a New Way To Detect Security Researchers (csoonline.com)
itwbennett writes: [The Neutrino exploit kit] is using passive OS fingerprinting to detect visiting Linux machines, according to Trustwave researchers who found that computers they were using for research couldn't make a connection with servers that delivered Neutrino. Daniel Chechik, senior security researcher at Trustwave's SpiderLabs division wrote that they tried changing IP addresses and Web browsers to avoid whatever was causing the Neutrino server to not respond, but it didn't work. But by fiddling with some data traffic that Trustwave's computers were sending to the Neutrino server, they figured out what was going on.
Until we get proper malware support there can be no year of the linux desktop.
For a second I thought sub-atomic particles were turning the tables on physicists.
(Seriously, we need more original names for these things.)
So a windows wanting to avoid infection from neutrino should spoof the TCP packets and pretend to be Linux?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Yet again, Linux fails to be properly interoperable with the Windows ecosystem. Heck, I'll bet you can't even get properly detected and infected by Neutrino when running WINE.
Sigh.
Would running, as it were, a scratch monkey Windows in a VM and setting it to bridge the network interface solve this, or would the outgoing traffic still be seen as Linux?
This is interesting though because it tells us that most malware writers actually are effectively stopped by Linux. Much like how the NSA doesn't seem to have an answer for proper crypto yet...
Malware devs are protecting malware researchers? Hey, thanks!
Can we stop it with silly news from CSO already.... are you guys getting paid to promote their crap?
Nobody cares what an exploit kit is, rather how its "creators" are avoiding researchers.
If the exploit kit won't talk to malware detectors, it's possible to spoof all computers so they look like malware detectors, and the exploit is rendered harmless.
your tinfoil hat certainly won't stop neutrinos
oh, we are not talking about the massless subatomic particle?
Can adblock+ do 16 things hosts do 4 speed, security & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnets + stop C&C talk
3.) Protect vs. dynamic dns botnets + stop C&C talk
4.) Protect vs. DGA botnets + stop C&C talk
5.) Protect vs. downed DNS (4 reliability)
6.) Protect vs. DNS redirect poisoning
7.) Protect vs. trackers
8.) Protect vs. spam
9.) Protect vs. phish
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up surfing (adblock & hardcoded favs)
14.) Works on anything webbound multiplatform.
15.) EZ data control
16.) Block ads better vs. addons more efficiently
* ANSWER ="NO" on ab+ doing it as well or @ ALL + hosts = on devices natively.
APK
P.S.=> Ab+ does less vs. hosts less efficiently - hosts do MORE w/ less + Hosts start w/ IP stack before REDUNDANT inefficient addons BEGIN operation (as 1st resolver).
---
Ab+'s a 128-151mb memory hog http://cdn.ghacks.net/wp-conte... (hosts use 3-11mb w/ my program initially). Even FireFox 41 adblock eats 65++mb http://www.ghacks.net/2015/06/...
---
ClarityRay defeats it seeing addons via native browser methods!
---
Ab+'s bribed not to work by default http://www.businessinsider.com... & ABP bought out adblock http://www.theregister.co.uk/2...
---
Ab+ adds complexity in slower usermode (w/ more messagepassing overhead + context switch vs. hosts in kernelmode).
---
AdBlock's SLOWER: http://superuser.com/questions...
---
What's best?
APK Hosts File Engine 9.0++ SR-4 32/64-bit http://start64.com/index.php?o...
MalwareBytes' hpHosts Admin (MalwareBytes employee who verified its source is safe http://forum.hosts-file.net/vi... ) hosts & recommends it http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
&
It's safe per 57 antivirus programs in BOTH its 64-bit model https://www.virustotal.com/en/...
+
a 32-bit model too https://www.virustotal.com/en/...
& Installer -> http://f.virscan.org/APKHostsF...
See subject: One that is paid by ads & doesn't mind crippled almostalladsblocked. Answer it (or your past posts will for you) as once you do I'll slice you to bits with it.
* IRONIC: Captcha = SUNLIGHT (& I'm going to use it on you... shortly!)
APK
P.S.=> I'm going to anyway, exposing you, so you might as well be truthful & DIE here publicly with some grace @ least, lol - because "the end cometh" for you chump... & "here 'tis", merely acting as the INSTRUMENT to do it!
... apk
Other than the usual browser based nonsense, the other way would probably be to convince you to gpgcheck=0 and infect you that way. Or the usual chubby twerp walking into your place and replacing your kernel.
Which sites & do you get paid by ads on them? Finish the answer & point them out so I can verify this... as I am fairly certain by this point that's your motivations for the bullshit you say about me more than anything else.
APK
P.S.=> Let's see your answer - I suspect you'll evade this to NO end... apk
3 days now! JustAnotherOldGuy'll never answer apk. You've seen right thru his petty motives for putting you down and his liking AlmostALLAdsBlocked that doesn't block ads he's paid by on his alleged websites. He gets messages from posts under his. He's seen this and is running.
Which sites & do you get paid by ads on them? Finish the answer & point them out so I can verify this...
Lol, like I would tell a scumbag like you specifically what sites I run. Thanks, but I don't need some shitbag like you trying to DDOS me or hack my sites.
To answer your second question, some some make money from ads, some some sell products.
Just cruising through this digital world at 33 1/3 rpm...
You've DDoS'd yourself webwally: Avoiding answering proves my point! You run ads NOT blocked by AlmostALLAdsBlocked (but they are by my program which YOU FEAR because of that). Did you think your doubletalk bs fools anyone other than your dumbass self? You fail. Is your favorite color TRANSPARENT? Must be. I see right thru you and so does everyone else webstooge!
Scumbag? LMAO - Did you think you could FINALLY answer & that Logan Abbott's WEAK PUNY "defense" could stop me and I couldn't continue to SHIT ON YOU? Guess again, you LOSE, loser.
APK
P.S.=> So much for you - thanks for letting me make others LAUGH @ U & Logan Abbott/whipslash too - nothing stops me - least of all, "webchumps"... apk