Virus scanning EE design tools and other EXEs you grab from the internet. - Page 1
Forum section: electronics / general

author: Psi
author_rank: Super Contributor
timestamp: June 16, 2024, 12:08:16 am
content: Just wondering what rules of thumb other EE's apply when downloading design tools from the internet with regards to checking for viruses before running.Obviously there is windows defender but I usually drag the EXE into virustotal.com before running.There are sometimes 1 or 2 detections which are probably just false positives but you never know.Here's the results i just did after downloading the Saturn PCB Design Toolkit.Would you run this?Do you have a maximum number of positives before you decide not to run it?

author: ataradov
author_rank: Super Contributor
timestamp: June 16, 2024, 12:43:18 am
content: Trust the vendor and don't download from sketchy places. And if MD5/SHA checksum provided, I usually verify that. Not so much for viruses, but to test integrity.If you don't trust the vendor, then you should just assume that malware is part of the functionality and is not going to be detected by outside tools.

author: IanB
author_rank: Super Contributor
timestamp: June 16, 2024, 12:46:41 am
content: Probably the best option is community feedback. If thousands of people have downloaded it and use it regularly and report it as being OK, then it is probably OK. If you don't have a community recommendation, and if it doesn't come from somewhere like GitHub, then it should be treated with caution.

author: Monkeh
author_rank: Super Contributor
timestamp: June 16, 2024, 12:49:29 am
content: Quote from: Psi on June 16, 2024, 12:08:16 amHeuristic crap from no-names. Yeah, I'd run it.

author: shabaz
author_rank: Frequent Contributor
timestamp: June 16, 2024, 01:59:53 am
content: Also, just an idea (no harm to do it), it's worth usingOpenDNS. It's free to use, and will at least protect from some malware sites. I've been using it for at least five years, to me it's completely unnoticeable during use. That, plus up-to-date Windows, with Windows Defender, and taking precautions/judgment of the types mentioned (e.g., community feedback), avoiding obvious dodgy sites/hack sites, etc., I've not noticed any issue, of course that doesn't guarantee it though.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 16, 2024, 04:31:52 am
content: I use ClamAV for scanning files.Regarding the Saturn PCB Design Toolkit program, I've been running it for years on Windows, and Linux (runs fine with Wine) and I can guarantee you that it doesn't embed any virus or malware.(Of course, only download it from the vendor's website:https://saturnpcb.com/saturn-pcb-toolkit/)

author: Halcyon
author_rank: Unknown
timestamp: June 16, 2024, 06:12:31 am
content: If the false positives come from lesser known agents, I wouldn't worry too much. Of course the safest option is always to run it in isolation (such as a VM) and treat all unknown programs as potentially malicious until proven otherwise.Signature-based ("traditional") AV is really limited in terms of the protection it offers. It's not unusual for a malicious executable to contain encrypted code, that only becomes unpacked into malicious code afterwards. This is where next-gen AV and XDR tools like CrowdStrike Falcon and SentinelOne have significant advantages. They monitor processes, network activity etc... continuously. Not just upon execution.

author: RoGeorge
author_rank: Super Contributor
timestamp: June 16, 2024, 08:01:10 pm
content: Quote from: Psi on June 16, 2024, 12:08:16 am1. First rule is never download from a 3rd party. Download from the original creator of that software.2. Second rule, is you always have to decide who do you trust. This is a daunting problem when one is really concerned, or feel threatened. You have to have a chain of thrust, or else you'll get crazy. Current software, firmware and hardware is so complex, that nobody on this planet can audit it, and guarantee it is safe.The only sane behavior from you is to always assume you are naked in a public square, 'cause that's exactly how you are when you a re online.Yes, safe downloads, good practices, encryption and so on are good advice to follow, but always assume you are naked in a public square, 'cause that's how you really are when you are online.I remember the army radio stations were having a metal plate written with "Beware, the enemy is always listening!" and this was true, and always will be, no matter how many safety measure you take. The more safety measures the better, but never assume you are safe. That's the rule number zero.

author: PlainName
author_rank: Super Contributor
timestamp: June 16, 2024, 08:48:41 pm
content: Don't care who the file is from (except likely dodgy sources are verboten) or what the app is, it automatically gets scanned by (non-MS, because Defender is actually shit) AV. And then either run in a VM or sandbox, depending on suspiciousness. I will check the sandbox to see just what it's going to drop and where, what it's going to modify (nothing, hopefully). Only after I am satisfied does it get an actual real install.Exceptions to that would be something I already have which downloads updates itself, or updates of same direct from the supplier.

author: MarkF
author_rank: Super Contributor
timestamp: June 16, 2024, 09:13:16 pm
content: "Virus scanning." I do none of that.The only thing I run now is the Windows Firewall built into Win7. (And yes, my machine is that old.)And I do exactly what @ataradov said: "Trust the source/vender you're getting it from."The few viruses I have had in the past came right through all the anti-virus running at the time.All the anti-virus does for me is sloooow down my machine.I gave them all up. They are just a false sense of security.To date, the last virus I had to deal with was maybe five years ago.Just don't download stuff from every Tom, Dick and Harry you find!

author: PlainName
author_rank: Super Contributor
timestamp: June 16, 2024, 09:24:24 pm
content: It's been known for the vendors to accidentally include malware. You can only trust that they are not intentionally infecting you.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 17, 2024, 02:28:29 am
content: Quote from: PlainName on June 16, 2024, 09:24:24 pmYeah, I've made it a habit to routinely scan outside files (using ClamAV mostly, as I mentioned). While I haven't run into viruses a huge majority of the time, occasionally (I'd say a few times, which may not look much) it has flagged files with malware, and after checking, it was false positives in about half of the cases. So while this happens rather rarely if you're reasonably cautious about what you download, it still happens, and a scan doesn't cost you much. It's like a seatbelt, it may not save your ass in all accidents, but you are still better off fastening it.

author: Infraviolet
author_rank: Super Contributor
timestamp: June 17, 2024, 02:34:58 am
content: There's the VirusTotal website which lets you upload a file to be scanned by every major antivirus package, but its always possible some viruses might not be recognised by any such scanner.If you're really desperate to try a tool there's always the option of running it in a VM, but that's still not 100% virusproof, every so often a very sneaky virus is designed to exploit vulnerabilities in VM hosting software so as to let itself escape on to the wider system. Still, a virus would have a hell of a time trying that if the host were Linux and the internal guest were Windows.

author: Halcyon
author_rank: Unknown
timestamp: June 17, 2024, 03:25:48 am
content: Quote from: MarkF on June 16, 2024, 09:13:16 pmI'm sorry, closing your eyes and hoping for the best is terrible advice. Antivirus tools aren't a false sense of security, but they also aren't completely infallible either. In many cases, they don't protect against stupid. How would you know if the last virus you had was 5 years ago since you "gave up" on AV? If AV had such a significant impact on your machine performance, either one of two things happened: You chose a crap AV program, or your hardware is severely lacking for the task you expect of it.I've said this for decades, antivirus is very important, regardless of platform. However, antivirus technology is vastly different to the old days of updating signatures and scanning files on write and execution. Malware has evolved far beyond that these days. In some cases, malicious code can execute without user intervention, such as Microsoft Outlook vulnerabilities that have been recently discussed.Quote from: Infraviolet on June 17, 2024, 02:34:58 amVirusTotal is a great resource, however should be used as an indicator only. I can think of one recent example of an Executable which VirusTotal flagged as a low level suspicion, but still phoned home to China and uploaded who knows what from the host machine.

author: MarkF
author_rank: Super Contributor
timestamp: June 17, 2024, 06:21:56 am
content: Quote from: Halcyon on June 17, 2024, 03:25:48 amThat is NOT what I said at all. I said "be smart about what you download and where you browse".I ran different antivirus programs, maybe a total of 6 months over the last 20 years. The ones I remember running were Norton, McAfee, and Windows Defender. Not all at the same time of course.I've only had at most 4 viruses (that crashed or blocked the machine). They were all from not following my own advice. And one of those I got on a locked down military computer. Either, I'm extremely fortunate or there is something behind what I say. No, I can't be absolutely certain there weren't more I don't know about. But, I've had no adverse issues with my computers.I just don't do a lot of things people do. I guess that's from all the training that's been drummed into me over the years.I do tend to clean house every year or two by completely wiping the disk and building the operating system from scratch.By expecting too much, you mean: reading email, browsing the web, editing a photo, write/compile/run programs (i.e. 35+ years programming career before retiring), laying out PCBs, and making CAD drawings. Add to that, I'm NOT a gamer. That kind of expecting too much from a 2.6 GHz Dell XPS laptop w. hardware graphics???As far as emails, I only open the ones that I recognize the sender. I actually have a white-list filter which eliminates 80% of the trash.I do remember being shown a virus in MS-Outlook where you only had to open Outlook. You didn't need to actual open the email itself. I don't remember of ever hearing of its being exploited though.

author: Halcyon
author_rank: Unknown
timestamp: June 17, 2024, 09:01:04 am
content: Quote from: MarkF on June 17, 2024, 06:21:56 amNo you didn't. Could you point to where you said that?What you actually said was:"Virus scanning." I do none of that."and"The only thing I run now is the Windows Firewall built into Win7."and"I gave them all up [Antivirus programs]. They are just a false sense of security."None of those are particularly smart nor good advice. The fact that you are still running Windows 7 speaks volumes about your lack of security posture. These are precisely the kind of things why IT personnel don't give users local administrative access on work machines. This is exactly what we mean by people who know just enough to be dangerous.

author: hans
author_rank: Super Contributor
timestamp: June 17, 2024, 01:12:04 pm
content: Getting a bit off-topic..That reminds me of an interesting challenge: have Windows XP on a machine, just connect it to the internet without firewall, and observe how long it takes to get hacked while you are not using the machine at all. Spoiler: it's not long..Not downloading random crap is a good advice to keep bad EXEs out. But 'trusting vendors' is sailing blind: websites get hacked all the time. Developers get social engineered as we saw with xz earlier this year. ISP routers with crap remote management functionality get hacked left and right.If you don't think security patches aren't important (e.g. running an unsupported OS like Win8 or older), then you're an easy catch. Average consumers aren't going to be single-targetted by a hacker because we hold military information, because all they can expect is cat and dog pictures.No, most hackers are interested in exploiting zero-days, because for example: if Firefox or Chrome has 100M daily users, and 0,01% are still vulnerable 3 years after a patch, then you're still talking about 10000 users on which they could attempt to steal creditcard information, identity theft, or use in botnets and whatnot. Still way too many to target manually!Just take a look at e.g. Shodan. Then question if your PC should be listed on that website.

author: Sensorcat
author_rank: Regular Contributor
timestamp: June 17, 2024, 08:36:01 pm
content: In addition to what is mentioned above, I use waiting as a security feature in the process of getting new software or updating it. Because we always know more at a later time. Like this:Download, check file signature, etc.Wait a few weeksCheck if the file signature has changed at the download siteDo the scanningSearch for info about security issues of the softwareIf no problems are detected, installThat way, I avoid falling victim to security issues that are brand new at the time of downloading.

author: Halcyon
author_rank: Unknown
timestamp: June 18, 2024, 01:19:09 am
content: Quote from: hans on June 17, 2024, 01:12:04 pmBased on the incidents I'm seeing come across my desk every week is that the bulk of "hacking" by your average hacker, is going after the low-hanging fruit. Usually that means individuals, sole traders and small business. Never fall into the trap of "I have no government secrets, therefore I'm not a target" as that is demonstrably false. Most of these guys are usually financially motivated, which means stealing your crypto, accessing your bank account, obtaining your credit card details or misdirecting funds some other way. Some just do it for "sport". There are very few hackers out there with those high-level skills to be going after 0-days. It's like the IT industry in general, lots of people are part of it, but only a small percentage are experts.Generally speaking, the ones going after sensitive government information and critical infrastructure are the state-sponsored actors. Not the guys sitting in call centres in India, or in their mother's basement.