Hacker News Reader

Comment by ethbr0 | Hacker News Reader

I'd also be curious what happens if you rename them to {not-keygen}.exe

I'd hope it wouldn't make a difference, but my experience with IT security thinking makes me bet the other way.

I renamed it into {not-keygen}.{not-exe} instead. I didn't investigate the issue in details, but I think that Microsoft expects a more enterprisey file name for a legitimate keygen. I should have called it something along the lines of CredentialManager.exe instead :)

But I wonder whether it did auto-submit these files to Microsoft together with my private keys. I'm glad that the private keys were in config files outside of the executables, and this probably saved them from being compromised.

If everybody started renaming keygens to CredentialManager.exe, would the learning algorithms the AV companies are using start to flag and delete those .exes too?

No way, right? What could go wrong?

Yeah, I once circumvented gmail's antivirus detection by sending a (perfectly legitimate) installer executable as a txt file because gmail apparently just has/had a strict "no files with certain extensions" policy. And IIRC Zendesk applies the same rule to file attachments on support tickets.

I had pitched for my team to build a tiny widget that would send attachments to virustotal, but it would have required a license for commercial use and we never had a security incident with files coming into our support center so it never became a priority.

> we never had a security incident with files coming into our support center

...that you are aware of.

While this may sound like a dumb policy, the end result is exactly what you want, a system that makes it impossible to have you download executables without you being aware.

Can confirm that ServiceNow and Outlook have the same workaround.

It sadly doesn't make a difference. I have about a dozen keygens on my machine and they get quarantined unless they're zipped behind a password or zipped into a 7z.

Just downloading a zip with a keygens inside, it gets removed from the zip before even unarchiving it.

Also, AFAIK by spec, the manifest of a zip file is unencrypted, even if the zip "is".

Most scanners are too brain dead to care, but I have come across a few that still quarantine if the manifest lists a file with a blacklisted extension.

Easy solution? Compress to zip, then compress that zip to another zip, with a password.

(Yes, I've spent far too long trying to get work done underneath insane corporate security policies)

Gmail will block you from sending a a password-protected ZIP with anything potentially bad in it, like an EXE, because they can see the individual file headers and central directory, like you say. Unfortunately, if you have a ZIP inside a passworded ZIP it also gets considered dangerous and blocked.

Here's a workaround: rename the .exe file to a .txt file, then put that in a password-protected zip file. Now braindead security scanners have no choice but to believe that it really is a text file.

Reply on news.ycombinator.com