The title is not clickbait. Yesterday I got tricked in an unexpected way into downloading
a malicious PowerShell script that actually tried to auto-execute. But what saved me was
my paranoid overkill security policies in Windows using a feature called AppLocker,
which most people don't use, and even I only set up recently.
So what I'll do is explain how exactly I got bamboozled and what you should watch out for,
also the lucky reason why I was able to dodge it, as well as taking a closer look at the
malware to see what would have actually happened had it not been stopped. Oh,
and be sure to stick around for the test where I ran the virus on a real physical computer.
And I will go over how you can protect yourself against similar attacks without
having to go full paranoid security like me. So here's the story. I was working on a project in
Visual Studio. It was a C# project, and you can download packages for that from
something called NuGet. And I was looking for the OpenAI package, which is chatGPT.
So I searched the different packages for OpenAI,
and I saw one that claimed to be an official one with 250,000 downloads. It had the most
out of any, so I thought that was the one. So I clicked to have Visual Studio download it,
and at that point I had already been tricked, but I had not realized it yet.
But next I saw what was the first sign that something was off, and that was that Visual
Studio produced an error that there was an invalid character in the package name. It said the E was
invalid, which I thought was weird. So I copied the name and put it into a Unicode inspector,
and saw that the E was a Cyrillic E, and the N was an Armenian N, not Latin characters like the rest.
I obviously thought that was weird, so then I looked at the info page on the NuGet site
for the package, and the account was called NuGet Solutions, all right,
and then I noticed that it had other packages, also all of them with hundreds of thousands of
downloads, but they all claimed to be popular packages like Xbox and Discord,
and they also had weird characters in them, and that's when I was like, "Oh, these are fake."
Oh, and if you were wondering, basically all those downloads are fake. If you actually go
to the full statistics on the NuGet page, you can see they're all unknown download sources. So I'm
pretty sure not that many people are actually falling for this, fortunately. At this point,
I knew the package was probably not just fake, but also malicious, though I hadn't
actually used the package yet, so I wasn't sure if I had been infected with anything.
So immediately, I googled "malicious NuGet packages" and found a few articles that told me,
yes, they are a thing. The article talked about how these malicious packages use a PowerShell
script called init.ps1, and it takes advantage of some legacy feature where Visual Studio,
if it sees that file name for a PowerShell script in that directory called tools,
it will just automatically execute it immediately upon downloading the package,
and anytime you open the project, too.
So I did a search on my computer, and yes, sure enough, in the package directory,
there was a PowerShell script called init.ps1. And when I looked inside it, yep, what it did was
download and run a file called anthrax.bat, which was the actual malware payload. Now,
me knowing that potentially the script could have been blocked by my AppLocker policies,
I immediately rushed to the Windows Event Viewer and looked at the logs,
and I was relieved to see that AppLocker had indeed prevented the script from running.
And what's crazy and scary is I might not have even realized what had happened if it hadn't
been for that error message about the invalid character that caused me to look more into it.
So for this specific scenario, if you do use NuGet with Visual Studio, what you should do is
before you download any of the packages, even through Visual Studio, go to the actual NuGet
Gallery and look at the page for that package, and then look at the Package Explorer feature,
and that'll show you what files are in it. And look for a tools folder,
and specifically, again, in there, look for init.ps1, and that could be malicious.
Just look what that file does. Now, many of you are wondering what exactly is AppLocker anyway,
and it's basically a security feature in Windows that you set through the Group Policy Editor,
and therefore requires Windows Pro or higher version. But later, I will go over another
feature that for most people is actually way easier, and just as secure, if not more so.
Anyway, the way that AppLocker works is it lets you decide what executable files
and scripts are allowed to run on your computer through a whitelist or allow
list model. You see, normally when using Windows, you can basically run any file,
and if it's malicious, unless it's on a list of known malware signatures,
you just have to hope after the fact that your antivirus will detect the behavior.
In other words, it's a policy of innocent until proven guilty for apps and scripts.
With AppLocker policies, it's the opposite. Nothing is allowed to run unless there is
a rule that specifically allows it. And I can show you some of these rules that I have here,
the main one being that an executable file, whether it's an .exe or other kinds,
can only run if it has been signed by an EV or Extended Verification code signing certificate.
If you don't know what that means, I don't really want to get into it, but basically to get one of
those, you have to go through a whole bunch of verification to prove who you are legally,
and then a root certificate authority will give you a signing certificate,
and the ending result is it is extremely rare to see malware that is signed by an EV certificate.
And then if there is an executable that is unsigned, but I know I can trust, I need
to specifically create a rule to allow it, such as adding the hash of the file to one of the rules,
which means that it doesn't just go by file name. It's literally that exact file,
no matter what it's called, will be checked for whether it can run or not.
Now you can add more lenient [rules] like allowing executables within a certain path
and even using wildcards. So maybe if I'm writing my own software and I'm compiling the code into
the same file name every time that I want to test, I could create a rule with an exception
for any executables with this exact name in that exact directory only, and that way it'll allow
those so I don't have to add a new hash exception every time I compile a new version of the program.
Now one thing I really wanted to know is if I didn't have AppLocker set up,
then would the antivirus I personally use have saved me? So for a true test, I decided to
literally take an old laptop, wipe it clean with a fresh Windows install, and run the virus on
it. I really needed to know. And I guess I sort of have to spoil the result early because afterwards,
I suggested to that same antivirus company that they sponsor this video, and they did.
So today's sponsor is Bitdefender. But hold on, I'm not jumping into an ad right
now. Just want to mention it up front so it doesn't seem like the test is some kind of
sham. It's not. I really do use Bitdefender on my own computer. So that's what I tested
the virus against. And again, I did the test before they sponsored the video.
Anyway, let me explain how I set up the test because I don't want you to think I
half-baked it either. I was personally invested in the result. So for this, I had this laptop,
which I wiped with a reformat, and clean installed Windows 10 and Bitdefender
Total Security. And I had these two files I wanted to test, anthrax.bat and anthraxa.bat.
They were both hosted at the same address next to each other, directory-wise. And from what I
understand, the anthrax one is apparently the so-called loader. It's what the PowerShell
script tries to download and run. And that one is just to kind of get its foot in the door,
and then it would download the anthraxa batch file, which I guess is like the big daddy malware.
And it is about 60% larger file size. Oh, and there's a whole other story with me setting up the
test, but I'll just put that on the screen because it's kind of long, so you can pause and read
if you want. But my main point is that I'll be testing the heuristic capability of Bitdefender,
so how it can handle fresh new malware strains, which apparently this one was.
So finally for the test, I'll tell you right off the bat, the second one is more
interesting because I ran the first one and nothing. Just some weird error message and
it created an empty file. Ironically, I could not get this one to execute. Again,
I'll put all the things I tried on the screen to save time, but I do know it didn't just
secretly run in the background because you'll see what happened with the second one next.
I clicked to run the second one and alright, it does run. It shows a blank
command prompt window for a bit, so I was getting kind of anxious,
but then Bitdefender did indeed step in and block it. But here's something I only
noticed after watching the video. The command prompt window is blank for about five seconds.
So I'm not sure if it was a delay on purpose to avoid detection or whether it was decrypting
itself because it was so obfuscated, but the instant you see it say copying one files,
that is when Bitdefender's notification shows up. So I really think the virus was
just sitting there and Bitdefender caught it as soon as it actually tried to start going.
Anyway, then it showed this little notification for like a minute or so,
so I'm not sure what it was doing, but eventually it finished and said I was
good. Now I did notice it left over this exe file, but when I uploaded it to VirusTotal,
it apparently just said that it was a renamed copy of Windows PowerShell.
I guess it was trying to use that to execute commands, but it wasn't inherently harmful. So
considering everything I just saw, I'm pretty satisfied. And if you liked what you saw,
definitely pay attention for this next part. Again, Bitdefender did
sponsor this video. So let me tell you more about it. As you might have guessed by now,
Bitdefender Total Security is more than just an antivirus program, but a complete security suite.
It has a wide array of protection features such as Network Threat Prevention,
which can stop network attacks before they begin by blocking malicious attempts on system
vulnerabilities and brute force attacks. And like you saw previously, it can protect even
against new malware by analyzing their behavior, not just relying on signatures.
Though of course it can detect them that way too. At this point, it's probably clear to everyone
that hackers and scammers are getting really clever, and not just when it comes to malware
either. You've got phishing, fraudulent scam sites, even obnoxious spam emails.
But Bitdefender Total Security can handle all of those things while protecting you online.
It does anti-phishing to block websites that steal your passwords or even credit card info. It also
has advanced filtering systems to detect fraud and warn you whenever you visit websites that
may try to scam you. There was over $8 billion lost to internet fraud in 2022 alone, and you
might be surprised that 34% of young adults are more likely to get scammed than people over 60.
Because sometimes common sense isn't enough. Just like this video proves, all it takes is
one slip-up. So definitely visit the link in the description to check out Bitdefender Total
Security. And with all that being said, let's continue on to more about AppLocker rules. Now
even though the default is to block, and you set allow rules, you can also set explicit deny rules.
For example, I also have a rule that just does a blanket block on all .com executable
files because those things sketch me out. Also, they're relatively rare,
so I just have an exception for those that are signed by Microsoft or Adobe's
certificates. I also have a rule that blocks all .scr screensaver files, no exceptions.
Many people don't realize that screensaver files are actually executables and are very commonly
used to deliver malware. And I don't know about you, but I haven't used a screensaver since like
1999, so I don't need any of those running. I'll also point out that there are separate sections
for rules about executables, as well as scripts and like MSI installers, that sort of thing.
And in the scripts one, I have even more strict rules. For scripts, I do not have
a blanket policy to allow EV signed scripts. I only allow those signed by Microsoft themselves.
I also have a redundant deny rule that blocks all VBS scripts specifically, with exceptions
for Adobe and Microsoft. Again, because those are commonly used to deliver malware.
And after this recent incident, I went and added another redundant rule to block anything called
init.ps1 to prevent Visual Studio from ever again executing one, or trying to at least. And yes,
I know that my rules already show that they protect against that, but I wanted to be
doubly sure. At this point, a lot of you are thinking, "Wow, that sounds like a real pain."
And yes, it is. There's plenty of times where I go to download or install a program,
and for whatever reason, they haven't signed one
of their files. So I get a message that pops up saying that it can't run this,
it's blocked. So then I have to go into the Event Viewer log, see which file exactly is blocked.
Then I have to go find that, go into the AppLocker rules, add a hash exception to it,
and then it'll run. And my thinking was, I want to always be sure that I'm not somehow
accidentally running some file that I don't realize is an executable or a script. But I
wasn't really anticipating this scenario where a program I do trust is going and downloading
third-party scripts and executing in them willy-nilly without my knowledge at all.
So that is why I would consider myself lucky in this case. Now,
some of you probably are still wondering how you can set up AppLocker yourself,
though that would take a separate video. And I do plan on making one actually relatively
soon. For most people, it would be overkill anyway. And there actually is another feature
in Windows 11 that is way easier for most people and arguably just as safe.
That feature is called Smart App Control, and it makes it so automatically Windows
will only run known safe, good files, meaning apps, scripts, and that sort of thing. And the
reason it's easier than AppLocker is Smart App Control, in addition to trusting EV-signed files,
which are basically guaranteed safe, it also allows files that have a reputation built up to
the point where Microsoft's SmartScreen cloud system knows that it is safe.
So basically how it works is Microsoft uses all the Windows telemetry data that it collects across
all the computers in the world and checks to see how many times maybe that executable file has
been run and its behavior afterwards, or if it's been detected as being malware. And eventually,
after enough time of the SmartScreen system realizing, "Alright, this file has been run
enough on enough computers, I know it is safe," then it will be allowed to run on
systems with Smart App Control enabled, even if it is not EV certificate signed.
So for most average users who are only going to
be running programs from big companies that are obviously going to be signed,
or also popular open source projects that even if they're not signed, they're popular enough
to have a reputation, it should cover pretty much everything an average user would use.
And actually, even AppLocker does not have this option to allow SmartScreen trusted files,
though it would make things a lot easier. There is another Windows security feature
called Windows Defender Application Control, but that is a whole other
can of worms to set up. There's like no GUI for it. Not going to get into that.
Now, Smart App Control may sound great, but there are two major caveats for why it might
not be for everyone. First, you can only enable the feature on a fresh install of
Windows shortly after installing it. So unless you are installing Windows on a new computer,
you will need to reinstall Windows from scratch to use it on your current computer.
Otherwise, if you go to the setting, you'll see that you just can't enable it at all. I
guess the reasoning is they want to be sure that if you have the feature enabled, then you know
the computer is clean. Though I really wish there was at least something similar you could enable
at any time. The second major caveat is with Smart App Control, there are no exceptions.
So that is unlike AppLocker where you can go and manually add exceptions. And importantly,
no, you cannot just go and temporarily disable Smart App Control and turn it back on. Once you
disable it, you cannot re-enable it without reinstalling again. Finally,
you're probably wondering more about this malware that I potentially got infected with.
Well, I went into a virtual machine and downloaded that anthrax.bat file, though I wasn't
going to run it myself even inside a virtual machine. Instead, I uploaded it to VirusTotal,
which if you didn't know, has a behavior tab which runs the file inside virtual machines
designed to analyze malware and see exactly what they do, which we'll take a look at in a second.
At the time I uploaded the file, it had never actually been seen before,
so there really weren't many signatures for it. So in cases like that,
you would have to rely on your antivirus's heuristics detection, which basically looks
at its behavior after it executes and tries to determine whether what it's doing is malicious.
Though now many more do detect it via signatures automatically without running it. Anyway,
it turns out that this batch file was actually a renamed executable file and a pretty nasty malware
at that. One called "Seroxen", which is a remote access trojan or RAT. And more specifically,
it's apparently a plugin for Seroxen called "Nugeta" that I guess targets Nuget repositories.
So yes, even malware these days has plugins. I also happened to find a page advertising this
Nougeta malware and it described itself as a stealer. So presumably it would be going
for things like cryptocurrency wallets and also session tokens from web browsers and
stuff. So yeah, my channel was pretty close to turning into an Elon Musk crypto scam stream.
Looking further into the behavior on the VirusTotal behavior tab,
you'll see a ton of information. I'll put a link in the description if you wanted
to look at this yourself. But it shows things like the various techniques it
uses. You can see it creates a scheduled task, probably to auto run at startup.
It runs various PowerShell scripts and also downloads additional files to run.
It'll also give you some interesting details like exactly which files it tries to open or look at,
which files it dropped, which means extra files it downloaded or created.
And there's quite a few, including some that it put in the Windows directory.
But one interesting thing I saw is that it actually fetches another file called anthraxa.bat
from the same place as the original anthrax.bat file. This other file is actually a batch file,
though it's extremely obfuscated. You can really only see at the top where it says,
"@echo off" and then the rest is made to just be indecipherable.
So of course I uploaded this to VirusTotal too, and this one also does a whole bunch
of stuff. I'll put a link to this one in the description too if you want to look through
this analysis yourself. Anyway, hopefully everyone found this pretty interesting and
it didn't make you too paranoid. Thanks again to Bitdefender for sponsoring.
Again, be sure to check out the link in the description to protect yourself against all sorts
of malware, scams, and frauds with Bitdefender Total Security. If you enjoyed this video,
also be sure to give it a big giant thumbs up for the YouTube algorithm. And if you want to
keep watching, the next video I'd recommend is where I was talking about the hidden,
forgotten F13 through F24 keyboard keys that you can actually probably still use and find useful.
And I'll put that link right there. So thanks so much for watching,
and I'll see you in the next one.