-1

When I tried to install Go programming language, Kaspersky AV in my system detected a path to file: C:\Go\pkg\tool\windows_amd64\trace.exe as suspicious and triggered a virus alert.

Shall I consider this as a false positive alert or are there any threats associated with the detected object?

|improve this question
  • I would ask Kaspersky for support. – Mark Saelic Apr 26 at 10:44
1

If you downloaded the installer from a trusted site via https connection then it's almost definitely a false positive. This is a known problem.

|improve this answer
  • Yes it is.I downloaded the same from a trusted source and alert triggered after that. Anyway , considering it a s a false positive. Thanks for your answer mate. – PentestLover Jul 21 '18 at 13:20
  • "If you downloaded the installer from a trusted site via https connection then it's almost definitely [...]" - that's incorrect. File could be tampered on the server or the HTTPs certificate could be counterfeited. The only way to be 99% sure that the file wasn't tampered are digital signatures. And even those does not exclude the case where file was tampered on the developer machine, before signing. – Mark Saelic Apr 26 at 10:22
  • @MarkSaelic that’s why I said “almost”. Digital signatures use precisely the same crypto as https: both have private keys that need to remain confidential and public keys, that could be tampered with in transfer. Both include certificate authorities that could be compromised. There's no end to paranoia, but I use threat modeling to cope: if your adversary is powerful enough to compromise CAs or hack distribution servers, then it's definitely capable of avoiding AV detection (it's almost trivial to do so). – Andrew Morozko Apr 26 at 10:43
  • It does not have to be an CA compromise, check this grc.com/fingerprints.htm for example. Also it's harder and harder to tell if site is trusted in the rise of new TLD's and cases like SourceForge. That's why we can relay only on digital signatures (which do not necessarily involve CA's). – Mark Saelic Apr 26 at 10:46
  • @MarkSaelic Yeah, https could be man-in-the-middle'd, but only if your browser/OS have malicious certificates already installed. Otherwise the attempt to switch the certificates would result in huge red error messages in your browser. In most security questions I have an implicit assumption that the user's machine is not already compromised, for obvious reasons. – Andrew Morozko Apr 26 at 11:00
0

Programs that inspects other programs are almost certainly under heavy watch by antivirus softwares, because inspection allows stealing data and altering process execution logic.

This include debuggers (e.g. your "trace.exe"), and cygwin1.dll (which use debugging system functions to implement the fork() system call, the memory-refilling part to be specific) among others.

However, major commercial software vendors are often whitelisted (e.g. MS Visual Studio).

|improve this answer
0

Kindly check with https://www.virustotal.com/gui/home/upload by uploading the file. If it is hash\signature based detection, you will be able to see intelligence from different vendors.

If the detection is behavior-based detection and you are sure that the executable behavior is expected, you can add the path to the scan exclusion list.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.