Quantcast
Channel: Raspberry Pi Forums
Viewing all articles
Browse latest Browse all 8042

SDK • Re: Trojan in Windows 'pioasm'

$
0
0
  • Is it a false positive ?
    • What caused that ?
    • Why wasn't that detected in-house?
I've see the "Wacatac.B!ml" detection many times from user reports on projects I've been involved with - all of them false positives (and the files weren't modified). Never found a rhyme or reason as to why a specific executable was flagged and others were not, but it's definitely some kind of heuristic going berserk. Even just testing for it is completely impractical since it will randomly trigger on some windows systems but not on others. This may be by design as to make the life of malware authors harder?

Supposedly you can avoid this by buying a signing key from Microsoft and signing your executables with it, turning off the heuristic detections. These signing keys don't come cheap though.
With libraries built upon libraries, often with numerous dependencies on others, that may be no simple task, may take a lot longer than expected.
pioasm actually doesn't really depend on all that much. Mostly standard build tools, and if those would ever get compromised I guarantee you that wouldn't be caught by any antivirus.

Statistics: Posted by Tharre — Thu Aug 07, 2025 10:07 pm



Viewing all articles
Browse latest Browse all 8042

Trending Articles