Malware False Positive Attack

  • 🐕 I am attempting to get the site runnning as fast as possible. If you are experiencing slow page load times, please report it.
So the miner is gone? I see no difference from when it was here and when it isn't. Yesterday I was running 80%, never had any problems of any kind., never had any alarms.
 
  • Disagree
Reactions: BoredAtHome
uBlock Origins only just now threw a wobbly for me.

Whitelist or disable for Kiwi Farms and business as usual.

Fuck that certain someone Null mentioned.
 
  • Disagree
Reactions: BoredAtHome
Don't forget about hpHosts through US-CERT. so you can blame Stefan from the emergency response team for the EMD malware domain classification.

tfaqmu.PNG
 
  • Informative
Reactions: BoredAtHome, knux, A Cold Potato and 1 other person
Ruin said:
How did this happen exactly? Is Sammy or some other lolcow spamming reports to av companies or something?
Click to expand...

I prefer to use the KISS technique. What's the simplest explination? That would probably be some adblocker or AV with webshield feature detected something on the page eating a boatload of CPU cycles, and went "oh they're hijacking brower cpu cycles for coins" and it propagated from there. Because this kind of thing is done constantly on many sites suffering from ad revenue problems now, just they don't TELL you they're doing it and ask your permission. And an automated flagging system isn't gonna read the TOS.

Hell I've seen poorly coded flash players trigger some of the more aggressive heuristics just because how shitty and bloated they are. Just as I've seen homebrew dwarf fortress plugins do it because they technically function the way a hijacker would to inject changes into the game.
 
  • Informative
  • Agree
Reactions: BoredAtHome, FataBataRang, Lurkette and 5 others
Had to completely Whitelist the site through uBlock Origin. Which means that it's gonna be blocked by Adblock Plus and all the apps that use that framework. Someone did a hell of a smear-job on the site.

For people having trouble understanding what happened...

Basically, some butthurt lolcow somewhere got the site added to a ton of "Master Lists" of malware-sites-to-block. They cited the bitcoin miner as "Malicious Code Injection" to justify it, even though the miner is harmless and optional.
 
  • Feels
Reactions: BoredAtHome, The Valeyard, Lackadaisy and 3 others
Echo_Ender said:
Basically, some butthurt lolcow somewhere got the site added to a ton of "Master Lists" of malware-sites-to-block.
Click to expand...

Stefan from hpHosts/US-CERT who added the initial entry doesn't seem like a lolcow.

I help manage cybercrime-tracker.net but we did not include this entry as we don't yet track domains for mining. Just don't start controlling any botnets using this domain as a callback server and we're gucci.
 
  • Informative
Reactions: BoredAtHome, A Cold Potato and FataBataRang
Xylitol said:
Stefan from hpHosts/US-CERT who added the initial entry doesn't seem like a lolcow.

I help manage cybercrime-tracker.net but we did not include this entry as we don't yet track domains for mining. Just don't start controlling any botnets using this domain as a callback server and we're gucci.
Click to expand...
So, are you saying that Stefan is patient zero, and where it all began?
 
  • Disagree
Reactions: BoredAtHome
JSGOTI said:
So, are you saying that Stefan is patient zero, and where it all began?
Click to expand...

Depends. This entry appeared on the first day alongside MalwareDominList which are both high up there on the totem pole. MalwareDomainList accepts tips/suggestions, hpHosts does not. He's the actual employee who performed the analysis and made the entry. So it's his job.
 
  • Disagree
Reactions: BoredAtHome
Xylitol said:
Depends. This entry appeared on the first day alongside MalwareDominList which are both high up there on the totem pole. MalwareDomainList accepts tips/suggestions, hpHosts does not. He's the actual employee who performed the analysis and made the entry. So it's his job.
Click to expand...
If he just flagged it for "Code Injection" without looking at the site or seeing what code it actually injects, then this is pretty possible.

Really unfortunate, though. It's apparently a massive pain in the ass to get this blacklisting reviewed/removed.
 
  • Feels
Reactions: BoredAtHome, The Valeyard, Lackadaisy and 4 others
Echo_Ender said:
If he just flagged it for "Code Injection" without looking at the site or seeing what code it actually injects, then this is pretty possible.
Click to expand...

They consider mining without 'informed consent' to be malware. Null needs some kind of redirect page that makes ppl click "Okay I understand" before they're allowed to use KF, because these aren't false positives ; it's getting flagged as malware because it fits the definition of malware these services are using.
 
  • Agree
  • Informative
Reactions: BoredAtHome, The 25th Cyberman, The Valeyard and 9 others
Xylitol said:
Depends. This entry appeared on the first day alongside MalwareDominList which are both high up there on the totem pole. MalwareDomainList accepts tips/suggestions, hpHosts does not. He's the actual employee who performed the analysis and made the entry. So it's his job.
Click to expand...

why don't you just
fix it
or like
talk to stefan
he's just in the next cubicle over right?
 
  • Optimistic
  • Agree
Reactions: BoredAtHome, lindsayfan, A Cold Potato and 3 others
Lurkette said:
why don't you just
fix it
or like
talk to stefan
he's just in the next cubicle over right?
Click to expand...

Because I have. It was a correct verdict. Since the script was pulled off recently they've reevaluated their entry on hpHosts. So the latest evaluation date is now 10-20.
However the classification remains the same.

Database Record
IP On Record: 104.24.17.94
IPOR PTR: Resolution failed
ASN: 13335 104.24.16.0/20 CLOUDFLARENET - CloudFlare, Inc., US
Added: 18-10-2017
Added By: Stefan
Updated: 20-10-2017
Classification: EMD (What is this?)


Given that the Admin here is saying the script is coming back in essentially the same implementation code-wise, I guess it doesn't matter. Was not interested in code I provided.

Dynastia said:
They consider mining without 'informed consent' to be malware. Null needs some kind of redirect page that makes ppl click "Okay I understand" before they're allowed to use KF, because these aren't false positives ; it's getting flagged as malware because it fits the definition of malware these services are using.
Click to expand...

And this is why. Thread title could use an update.

I emailed Admin here initially a few days ago reiterating this exact point. This is why CoinHive released their new 'AuthedMine' variation after consulting with AV vendors. Non-AuthMine implementations were open season for malware classification following that Oct 17th release. I advised this too but was told in reply by Admin that it was not possible because of some sort of cyberbully?
 
Last edited:
  • Informative
Reactions: BoredAtHome and Luigi
You must log in or register to reply here.
Back