Hello, welcome to the Thursday, August 10th, 2017 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and I am recording from Jacksonville, Florida.

Virus Total is a great service operated by Google that allows everybody to upload binaries to the service and have them scanned by a number of different anti-malver tools.

Now, the problem with Virus Total, of course, is that once you upload the particular file to Virus Total, it stays with Virus Total, and Virus Total does provide access to files uploaded to researchers and to anti-malware

companies. Apparently some people are still not aware of this and security company

direct defense did note that a large number of files were uploaded via Carbon Black. Now, Carbon Black

is an endpoint security solution. It has its own analysis of files, runs them in sandboxes,

does various signature scans on any file that it encounters, and it does offer the option to users to upload these files to

a virus total.

Apparently this option is not enabled by default.

The user has to enable it in order to make the tool upload the files, but it looks like a lot of large companies went ahead and enabled it.

By default, Carbon Black does take a more secure approach in that it only sends

hashes of files to a virus total in order to check if they are known malicious files.

Of course sending the hash to virus total only works if the identical file was already identified as malicious.

It won't work if a slight variation of the file is being investigated, but that again is something that the user has to figure out

whether or not they think it's worthwhile to risk leaking data to virus total by sending complete

binaries. Carbon plaque does display a privacy notice when you enable the virus total feature,

but then again, who reads those privacy notices?

So regardless, this specific case, my recommendation is always, if you do want to do some

wholesale scanning with virus total, let's say scan every single attachment that you're receiving

via email and I have seen people do that.

Only send the hash to a virus total. Do not send the full attachment to virus total.

...