Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to latest YARA Forge release (2024-04-07) #106

Closed
wants to merge 23 commits into from

Conversation

tstromberg
Copy link
Collaborator

@tstromberg tstromberg commented Apr 10, 2024

As per the new makefile rule in #105

Contrary to the huge diff, there are only a few new rule additions:

+BINARYALERT_Hacktool_Windows_Cobaltstrike_Artifact_Exe
+ELASTIC_Linux_Exploit_Log4J_7Fc4D480
+ELASTIC_Linux_Trojan_Merlin_55Beddd3
+ELASTIC_Linux_Trojan_Xzbackdoor_74E87A9D
+RUSSIANPANDA_Win_Mal_Koi_Loader
+RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted
+RUSSIANPANDA_Win_Mal_Koistealer_PS

tstromberg and others added 19 commits April 10, 2024 07:43
One of the most common sources of diffs we are seeing comparing the filesystems of APKs is when there is an ABI change, but not an actual capability change.  This shows up as a potentially noisy Deleted / Added with the full capability listing.

This change adds a post-pass to the reporting computation that walks the Added/Deleted file lists, and if two paths are a >90% match, then we treat them as a "move" and combine their reports in a similar fashion to modifications.

This also incorporates the notion of moves into the report and adjusts some of the rendering to surface these as moves with the similarity score (so we can tune this).

Signed-off-by: Matt Moore <mattmoor@chainguard.dev>
I think the test was wrong, because I see the combo/backdoor/py_setuptools
when I run this:

```
➜  bincapz git:(fix-tests) ✗ go run . third_party/yara-rules-full.yar testdata/Python/valyrian_debug_setup.py | grep combo/backdoor
3/HIGH  combo/backdoor/py_setuptools  python library installer that executes external commands: "os.system( setup( setuptools"
```

And the other one seems like it does indeed just print `.` instead of the full path:

```
➜  bincapz git:(fix-tests) ✗ go run . -diff testdata/macOS/libffmpeg.dirty.dylib testdata/macOS/libffmpeg.dylib
Changed: .
Previous Risk: 🚨 4/CRITICAL
New Risk:      ✅ 2/MEDIUM
```

Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
…v#97.

Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
* add boilerplates and ci jobs for lint

* install deps

* install deps

* fix lints
Bumps [golang.org/x/term](https://github.com/golang/term) from 0.18.0 to 0.19.0.
- [Commits](golang/term@v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Move to clog, plumb context through as necessary.

Signed-off-by: Ville Aikas <vaikas@chainguard.dev>

* fix lint.

Signed-off-by: Ville Aikas <vaikas@chainguard.dev>

---------

Signed-off-by: Ville Aikas <vaikas@chainguard.dev>
@cpanato
Copy link
Member

cpanato commented Apr 10, 2024

there is some lint errors, can you take a look @tstromberg ?

@tstromberg
Copy link
Collaborator Author

It seems to be part of some woke linter I'm not familiar with:

 Running woke with reviewdog 🐶 ...
  reviewdog: This GitHub token doesn't have write permission of Review API [1], 
  so reviewdog will report results via logging command [2] and create annotations similar to
  github-pr-check reporter as a fallback.
  [1]: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#pull_request_target, 
  [2]: https://help.github.com/en/actions/automating-your-workflow-with-github-actions/development-tools-for-github-actions#logging-commands
  reviewdog: Reporting results for "woke"
  Error: [woke] reported by reviewdog 🐶
  Warning:  `whitelist` may be insensitive, use `allowlist`, `inclusion list` instead
  
  Raw Output:
  Warning: ty/yara-rules-full.yar:8686:7: [warning] `whitelist` may be insensitive, use `allowlist`, `inclusion list` instead
  Error: [woke] reported by reviewdog 🐶
  Warning:  `whitelist` may be insensitive, use `allowlist`, `inclusion list` instead

This linter won't work well with third party code. I'll see if there is a way to turn it off for the third-party directory.

@tstromberg tstromberg closed this Apr 10, 2024
@cpanato
Copy link
Member

cpanato commented Apr 10, 2024

I think we can add the .wokeignore and add the path there

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants