So I have a piece of software that myself and my other dev have been building for the last 4 months.
Earlier today, he was working on fixing a few bugs that kept popping up. Our hopes were to launch this software as an SaaS product.
We have an updater module sewed into the starting function that checks as soon as the program opens whether or not changes have been made to the software on the server side of things. If it detects that changes have been made, it will proceed to update the software automatically until it matches that of the server version.
Well earlier he had made some changes, added them to github and updated the server accordingly. I open the software executable itself to conduct a UI test and the software goes ahead and starts updating. However, I instantly start getting notifications from Windows Defender warning me of threats that have just been discovered. Clicking on it, I see two files of high severity labeled as trojan malware.
I instantly go to malware bytes and start running a scan while frantically moving my important files onto google drive before deleting them.
Ultimately, I’ve had about 47 detected malware files when a few weeks ago, I had zero. I ran the scan an additional 3 times until I had 0 suspicious files and the rest have been placed into quarantine.
Typically, my OPSEC is on-point but I really wasn’t expecting my half-owned piece of software to suddenly launch an attack on me. I’m not sure whether my other dev was behind this but we’ve had a good working relationship for several months now, working 60 hour weeks together. I’m not sure why he’d suddenly turn around and purposely try to infect me as the only other user of this software.
Perhaps our AWS server got hacked into, with someone embedding a bunch of malware into our code but that seems quite unlikely as well given that we’ve kept it under lock quite diligently.
It seems that the attack has already occured and even if it was stopped in its tracks ahead of time, my computer is likely compromised forever now.
Not sure what to do now. This happened within the last hour and I’ve yet to hear from the other dev.
***UPDATE: So I took a more in-depth look at some of these quarantined files and many of them were derived from a “Trojan: Win32/Wacatac.B!ml” file, meaning they were picked up by a ML script and could very well be false positives.
The other dev replied saying that it’s likely a direct result of our obfuscator to keep the software safe from reverse engineering. Apparently, his anti-virus software didn’t pick up anything.
I’m still very much confused by as to why the defender suddenly categorized our obfuscator as a threat today when it’s been installed onto our software for a month and a half now. Why all of a sudden, after this menial update, would it instantly assume the software is malicious?
I ran the files through VirusTotal and some of the files have been marked as malicious by several companies.
Gridinsoft reported “Trojan.Heur!.03013681”
McAfee reported “BehavesLike.Win32.Generic.rc”
Cyberreason reported “malicious.45350d”
Cylance just said “unsafe”
The other dev said the files acted trojan-like because the updater kept trying to install it whereas my anti-virus was quarantining them as soon as they arrived, supposedly giving them the appearance of replicating.
I’m honestly not sure what the hell to think at this point. Even if it’s not actually malicious, I can’t foresee how we could ever monetize and distribute this software if it’s being regarded by several antivirus companies as being unsafe and harmful.
***UPDATE #2: Thank you guys for all your valuable insights.
I think I can say with 97% certainty that this was in fact a false positive due to several potential functions.
- As u/putarda pointed out, is the updater module itself. It actually made me rethink the process through which we’ll be updating our software in its entirety. What initially was meant to act as a fool-proof design to ensure nothing goes out of order actually ended up being a major security flaw.
If we had already been distributing this software and something of this nature occured and was NOT a false positive, this could’ve ended really, REALLY badly for all parties involved. To have the updater automatically install and overwrite files as soon as the executable is launched is just asking for trouble. From now on, updates will only be rolled out once the user manually confirms they want to update the software, ensuring they have a chance to test and confirm that the overwriting of files isn’t malicious in nature.
- It appears that the theory with the obfuscator is also correct. The issue that arises with the confuser modules is that every time one compiles the executable, it returns a completely new piece of code, even when the base code itself has undergone zero changes. It appears that there’s a matter of luck involved as to whether the AVs will actually brand it as a threat depending on how the end result actually looks like.
And 3., as u/vermyx and u/accidentannual pointed out, the primary reason behind the antivirus flags is because we hold no legitimate license and are unrecognized as a trusted software provider. Without the digital signature, I think there’s very little we can actually do without completely severing the connection to our server (which would render our licensing system completely useless and updates unviable) and removing our obfuscator (which would mean our source code can be easily replicated and subsequently stolen).
Neither of these scenarios sound particularly appealing so it seems that we’ll be needing to contact each of the AVs and requesting that they whitelist our product each time we add an update and recompile the software. It honestly sounds like a major pain in the ass but after scrounging the internet, it does seem like we’re not only ones being affected by this. NiceHash pleads with their clients to whitelist their software in Windows Defender as soon as they download and some of our competitors do so as well.
Although, if I’m being perfectly honest, if I were a consumer being told by the devs issuing you your software to disregard any potential virus flares, I’d be insanely sketched out and would likely never download any of their products. How we’re gonna get around this, I’ve yet to fully figure out but hopefully we’ll find a solution soon.
If this has showed me anything, it’s that the AVs weren’t necessarily wrong to warn users of the potential threat. At the end of the day, we’re a pretty low-budget SaaS that could easily have our product become compromised and become malware despite intending to be a clear-cut piece of software.
We’ll be implementing the changes over the coming weeks and submitting the final compile to each of the AVs as soon as we’ve done so.
Thank you all for the advice!
