HitmanPro.Alert BETA

Discussion in 'other anti-malware software' started by erikloman, May 30, 2017.

  1. markloman

    markloman Developer

    Joined:
    Jan 25, 2005
    Posts:
    578
    Location:
    Hengelo
    No worries guys, we're still alive and kicking. We've been working on several projects and are planning to release a new BETA version of HitmanPro.Alert soon. It will contain several new protections as well as an updated CryptoGuard 5 engine. Stay tuned!
     
  2. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,391
    Location:
    Under a bushel ...
    Good news, and a relief Mark! :thumb:
     
  3. markloman

    markloman Developer

    Joined:
    Jan 25, 2005
    Posts:
    578
    Location:
    Hengelo
    I have some information to share, about a protection that we've been working on over the last two years (and Wilder Security members have been enjoying it for that long too). It's about our Heap Heap Protect mitigation - called Dynamic Shellcode Protection in Sophos's flagship endpoint product Intercept X.
    If you haven't read it yet and have 10 minutes, be sure to read my blog about it: Covert code faces a Heap of trouble in memory – Sophos News
    Below a relatively short primer about why it's actually pretty bold.

    Heap Heap Protect is unique in the world. It basically puts a hard limit on any application to what memory they can allocate. It impacts every process on the box, even Windows’ own processes.

    How this works? Applications can ‘loan’ an extra memory region from the system for the purpose to run added code. But when the added code requests an additional ‘loan’ for the purpose to introduce and run even more code, we say NO.

    HeapHeapHooray.jpg

    The ‘freedom’ to use memory whenever an application sees fit has been a fundamental function of a computer since the invention of dynamic random-access memory in 1968. And thanks to segregation of data and code (enforced by the CPU hardware) we can now literally say NO MORE!

    We initially crafted Heap Heap Protect to counter unknown supply-chain attacks like CCleaner APT. So, although it's completely signature-less, you may notice it is especially effective against remote access agents like Cobalt Strike and Meterpreter, as these are typically loaded into memory by a ‘loader’ or ‘stager’. Particularly in human-operated ransomware attacks, these agents are a mainstay.
    To our surprise, when we tested the mitigation in the wild, it notably caught a lot of multi-packed malware too – including adware. This is because, before packed malware really works, the unpacker needs to allocate a region that can run the unpacked code. And multi-packed (layer over layer) malware will ‘loan’ such a region upon region – it unpacks like a matryoshka doll.

    Perhaps the most interesting part of our protection is that our discovery is highly compatible with legitimate applications. Simply because regular applications are not loaded in a staged manner and they are not packed either.

    If you want to know more, check out my blog. If you have, we'd like to hear your thoughts on this. Thanks!
     
    Last edited: Mar 14, 2021
  4. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    494
    Location:
    italy
    super_cool!! :thumb:
     
  5. Adric

    Adric Registered Member

    Joined:
    Feb 1, 2006
    Posts:
    1,477
    If Win7 ESU is still being supported, please test 32-bit a bit more thoroughly with the new cryptoguard engine because I still keep getting random crash dumps during the boot phase with the CRYPT32.dll. Reported back in Jan. 2020, but never fixed.
     
  6. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    14,569
    Location:
    The Netherlands
    Wow sounds very interesting! Especially the fact that with this stuff you could mitigate attacks like on CCleaner. :thumb:
     
  7. Moose World

    Moose World Registered Member

    Joined:
    Dec 19, 2013
    Posts:
    744
    Location:
    U.S. Citizen
    Hi,

    I am wondering if, Hitman Pro Alert Beta will work with Sandboxie, or have any conflicts with
    other security software?
     
  8. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    You guys are amazing keep up the good work ;)
     
  9. n8chavez

    n8chavez Registered Member

    Joined:
    Jul 19, 2003
    Posts:
    2,971
    Location:
    Location Unknown
    I've used them both for years and have never really experienced any issues, other than a sandboxed Vivaldi not getting along with HMP.A. But even that is easy to configure for. Just remember to add the HMPA template to sandboxie.
     
  10. Moose World

    Moose World Registered Member

    Joined:
    Dec 19, 2013
    Posts:
    744
    Location:
    U.S. Citizen
    @n8chavez,

    Thank you for the remember, appreciate.......
     
  11. focus

    focus Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    479
    Location:
    USA
    Could you provide the template please?
     
  12. HempOil

    HempOil Registered Member

    Joined:
    Jun 15, 2015
    Posts:
    197
    Location:
    Canada
    Looking forward to it, Mark!
     
  13. HempOil

    HempOil Registered Member

    Joined:
    Jun 15, 2015
    Posts:
    197
    Location:
    Canada
    Fascinating read...this and the blog. Makes me wonder why MS never redesigned Windows' memory management to do this after developing DEP.
     
  14. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Because they dont have the intelligence and ability to do this technology or other companies will be out of business this encourage competition in the market I guez:)
     
  15. n8chavez

    n8chavez Registered Member

    Joined:
    Jul 19, 2003
    Posts:
    2,971
    Location:
    Location Unknown
    Here it is. This is not my template, it's just the default template from template.ini

    Code:
    [Template_HitmanProAlert]
    Tmpl.Title=Hitman Pro Alert
    Tmpl.Class=Security
    Tmpl.Url=http://www.surfright.nl/en/alert
    #Tmpl.Scan=s
    #Tmpl.ScanService=hmpalertsvc
    OpenPipePath=\Device\NamedPipe\hmpalert
     
  16. focus

    focus Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    479
    Location:
    USA
    Thanks!
     
  17. markloman

    markloman Developer

    Joined:
    Jan 25, 2005
    Posts:
    578
    Location:
    Hengelo
    HitmanPro.Alert 3.8.9 Build 891 Release Candidate

    Changelog
    • Special maintenance release: this is the last build that supports Windows XP, Windows Vista and Windows 7 RTM (no service pack). These Windows versions only support SHA-1 for code-signing certificates. Microsoft decided to require SHA-2 for new drivers while it did not release SHA-2 support for these Windows versions. So, in other words, we cannot release new kernel-mode drivers (with new functionality) for these older operating systems. If you run one of these old Windows versions we urge you to upgrade. On these Windows versions, HitmanPro.Alert will no longer update itself after this build.
      Both 32-bit and 64-bit versions of Microsoft Windows 7 SP1, Windows 8, Windows 8.1 and Windows 10 remain supported and will soon receive a new HitmanPro.Alert version with new features.
    Download
    https://dl.surfright.nl/hmpalert3b891.exe

    Who of you are still using Windows XP? Let us know your thoughts, thanks! :thumb:
     
  18. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,391
    Location:
    Under a bushel ...
    Manually updated with no issue. Win 10 x64 Pro v20H2 19042.906.
     
  19. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    989
    No problems upgrading build 891 RC.

    Win10 21H1 build 19043.868
     
    Last edited: Apr 1, 2021
  20. abbs

    abbs Registered Member

    Joined:
    Sep 14, 2018
    Posts:
    35
    Location:
    Nederlands
    Updated manually and looked at for a few days and had no issues.

    Windows 10 Pro Versie 20H2 Build 19042.870
     
  21. osmandemi

    osmandemi Registered Member

    Joined:
    May 5, 2010
    Posts:
    79
    Hi can I use hitman pro alert and sophos home free together ?
     
  22. Adric

    Adric Registered Member

    Joined:
    Feb 1, 2006
    Posts:
    1,477
    @RonnyT

    Dumps posted for v889 and v891. Will expire in three days
     
  23. feerf56

    feerf56 Registered Member

    Joined:
    Feb 24, 2015
    Posts:
    248
    "add exclusion" button does not work. I click on it and nothing happens. The file selection window does not appear.

    2021-04-07_045100.jpg

    Blind alarm at Driver Booster software. https://www.iobit.com/en/driver-booster.php

    ~ Removed VirusTotal Results as per Policy ~

    2021-04-07_044748.jpg
     
    Last edited by a moderator: Apr 7, 2021
  24. Baldrick

    Baldrick Registered Member

    Joined:
    May 11, 2002
    Posts:
    2,592
    Location:
    South Wales, UK
    Have just tried here and works fine...would suggest that you try an uninstall/reinstall.
     
  25. RonnyT

    RonnyT QA Engineer

    Joined:
    Aug 9, 2016
    Posts:
    350
    Location:
    Planet Earth
    Yes that should work fine.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.