Hacker News Reader

Comment by wyldfire | Hacker News Reader

What does it mean for the backdoor to be "poorly detected"? I would think "poorly implemented [thus easily detected]" makes sense but not "poorly detected." Unless maybe this means that the backdoor is so well hidden that it's not detected by backdoor-detectors?

EDIT: yes this does seem to be the case:

> A distinctive feature of SessionManager is its poor detection rate. First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services.

I still can't help thinking that the detection capability lies in the detector(s) and it's not a credit to SessionManager as much as it is a fault of the detectors. Is it just too new to be fingerprinted/identified?

View on HN

Of the variants listed:

https://www.virustotal.com/gui/file/2a0b83c316219ed8c7ce1d14... 25/66 detection. Detected by Windows Defender free version if you do nothing but leave it in a default configuration and don't install a competing product.

https://www.virustotal.com/gui/file/40de45ea45d352703a19c4a5... 30/64, as above detected by Defender

https://www.virustotal.com/gui/file/500905187d6b2d387fed36c8... 31/67, as above Defender

2410D0D7C20597D9B65F237F9C4CE6C9 - never seen by Virustotal. So yes, it probably has poor detection.

Isn't detection by about half of the engines the normal state of things on Virustotal?

Yes, but many of these products are meme products. I'd like to say "No enterprise is running SUPERAntiSpyware on their Microsoft Exchange cluster" but I'm aware of one that is. In general though, half the engines is actually a place where I'd dispute the "poorly detected" description.

This what poor detection looks like after an IR investigation and opening tickets with several vendors two months ago.

https://www.virustotal.com/gui/file/d8ac4f43a5279e3aa33b2a74...

The key sentence is

> First discovered by Kaspersky researchers in early 2022, some of the backdoor samples were still not flagged as malicious in most popular online file scanning services.

Of course by now majority of AVs detect those files, detections spread rather quickly between AVs.

Sadly, VirusTotal seems to show detection history only to registered users. I can confirm that at least second sample still had 0 detections in April.

It seems "poorly detected" means "(many of) those who have it don't know about it"

> it is still possible to discover related malicious activities months or years later, and this will probably be the case for a long time

I mean, a poorly-detected virus has always been one that doesn't get caught by many detectors. It's normally a call for other vendors to pay more attention to it and implement detection.

Or maybe its calling people out for intentionally not detecting this backdoor because of whom it benefits?

Possibly, but it depends on who we are talking about here. Care to elaborate?

Reply on news.ycombinator.com