Submitted 5 days ago by atrielienz@lemmy.world to technology@lemmy.world
https://cybersecuritynews.com/researchers-bypassed-windows-defender-antivirus-using-direct-syscalls/
“According to the research published by Hackmosphere, the technique works by avoiding the conventional execution path where applications call Windows API functions through libraries like kernel32.dll, which then forwards requests to ntdll.dll before making the actual system call to the kernel.”
According to the research published by Hackmosphere, […]
I cannot find a link to the original research, anybody has the link to the original research?
hackmosphere.fr/bypass-windows-defender-antivirus…
hackmosphere.fr/bypass-windows-defender-antivirus…
This is what I could find.
Wasn’t there something a few months ago about Microsoft handing out secret API calls to developers of other antivirus products so they can quietly disable Defender during the installation of their product? Some guy had this reverse engineered from an installer…
It’s not a secret. It’s a regkey. You need privs to do it though.
Saw this attack in the wild this week. Huntress MDR detected and shut it down.
That Vitus must be pretty bad.
Thanks! Fixed!
Cephalotrocity@biglemmowski.win 5 days ago
Anything like this for the typical home user?
0x0@lemmy.zip 5 days ago
Sure, bring back Crowdstrike, that went well…
Btw I wasn’t aware XOR was encrytion…
Neverclear@lemmy.dbzer0.com 5 days ago
XOR cleartext once with a key you get ciphertext. XOR the ciphertext with the same key you get the original ciphertext. At its core this is the way the old DES cipher works.
A bit of useful trivia: If you XOR any number with itself, you get all zeros. You can see this in practice when an assembly programmer XOR’s a register with itself to clear it out.
heavydust@sh.itjust.works 5 days ago
en.wikipedia.org/wiki/One_time_pad
XOR may be the only encryption system that cannot be cracked. The length of the key is a PITA though.
Zwuzelmaus@feddit.org 5 days ago
It’s even better than ROT13, because you always need to apply ROT13 twice for getting the good results…
atrielienz@lemmy.world 5 days ago
It technically counts. It’s a cipher that uses the same key for encryption and decryption.