Hacker News Reader

Comment by FrostKiwi | Hacker News Reader

Great deep dive! Always wondered about the details around this topic.

Did a bit of red teaming around the topic of reverse shells and privilege escalation and was pleasantly surprised, how much Windows Defender catches. Our IT Department recently switched away from a paid McAfee service doing end point security, which failed to detect unauthorized access in many instances.

Also, I totally read the intro as "addressing the ERP use-case"

View on HN

ERP being "erotic roleplay"?

You mean all those finetunes on huggingface aren't SAP copilots?

McAfee sold it's Entrerprise division in 2021. Ever since they have primarily focused on scaring boomers into subscription plans. They used to have an on-prem EDR platform called McAfee EPO but I think that was replaced with some cloud hosted subscription garbage. I won't use cloud based security products. On-prem security should have an on-prem solution. Anyone who says otherwise gets their paycheck by hawking servitization or hosting data. The reasons for outsourcing are weak.

To your point about reverse shells, last time I tried about 2 years ago, meterpreter was still sneaking past almost everything. There are some tools on Github for detecting it, but it is very good at evading detection in general.

Highly doubt that... to be certain about dates as these things move fast, I refer to the OSEP course from Offensive Security, which is mostly about evasion. Course released in 2021, and which became necessary after the infamous OSCP, since most payloads became detected by antivirus, which is basically the starting point of that course: a default MSF payload, even with various encoding, will trigger 50% or more of AVs on virustotal.

So you describe a 50% failure rate and you doubt me? I believe you have a false sense of confidence in your suppliers and their products. Have fun rebuilding your house of cards over and over again. Being dismissive about security is the lowest hanging fruit there is.

I describe 50% of AV products detecting something you said was "sneaking past almost everything".

McAfee ePO is the product that became Trellix ePO after McAfee Enterprise was sold off.

> which failed to detect unauthorized access in many instances.

Did something else detect them in a timely manner, or did you find evidence later as part of some sort of audit?

(or was the inadequacy found via staged penetration testing?)

Reply on news.ycombinator.com