Hacker News Reader

Hacker News

Comment by progval | Hacker News Reader

Full thread

progval

According to their report [1], "critical vulnerabilities" include:

* coin miners, including images designed to mine coins, eg. kannix/monero-miner

* images for "Hacking Tools"

These two categories account for 64% of the 51%.

[1] https://prevasio.com/static/Red_Kangaroo.pdf

View on HN

Just remember, this is not limited to official images, and it's not weighted in any way based on usage/downloads. So a crypto image that's pushed and never downloaded has equal weight with the ubuntu:18.04 image

No, those are not out of the 51%, but of the 0.16% "Malicious / potentially harmful images"

which is not a vulnerability or malicious if people are looking for that

didn’t realize crypto ignorance was still that pervasive and discriminatory

I can see “potentially harmful” to a place the image was deployed on without authorization or against terms of use, or if the image contained a miner and didnt tell the user.

Yes, I think if you offer e.g. auditing of all containers a company runs flagging even above-board crypto miners as "potentially harmful" is fair (I doubt very many companies intentionally deploy those parallel to other workloads, and if they do it's easily cleared), but otherwise it would make sense to differentiate between them and maliciously hidden ones.

I hate the "hacking tools" category. I can't have a copy of netcat on my work machine because it gets flagged as a "hacking tool" and automatically deleted.

Reformat your work machine and regain control.

This is terrible, terrible advice and it's going to get someone fired. I got fired for similar behavior back in 2016. If your company's device policy is preventing you from doing your work, talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates, and then -- either you'll come to a solution, or you'll have to deal with a device policy that slows you down, or you can line up a job elsewhere and resign. Unilaterally breaking the device policy will get you fired, which is a lot more stressful than resigning on a date of your choosing.

I'll add that if you're doing work on managed hardware, you really want IT to be your friends, and this is not a good way to accomplish that. Certainly talk to them too about the impact the device policy is having on you, but don't treat them as the source of your problems, treat them as colleagues who are themselves under various regulatory/policy restrictions and who may be able to help you.

> talk to your manager, talk about the work on your plate and the way in which the device policy is slowing you down, make sure your manager understands in concrete terms how this affects your estimates,

Maybe if you’ve got a sympathetic manager. Otherwise you might just get a reputation as a whiny trouble maker.

Or get a company Mac, it comes with netcat by default :) It's simply part of the OS.

Until the paranoid antivirus tool is loaded on the machine at least.

I don't think it can mess with that. The macOS system files themselves are now on a readonly partition. Even AV can't delete files from that.

Every few months I get a new tool blacklisted and purged from my work machine. So far I've lost netcat, telnet, nmap, process hacker, several packers, cheatengine, and a few other re tools. And probably more that I haven't noticed yet. My favorite category is "program manipulator/riskware"

Can you build from source? This is often enough to get around automatic detection and/or will be in you're whitelisted development folder. It is also often not against any company policy that would get you in trouble.

Reply on news.ycombinator.com