Proofpoint's security team publishes threat research on malware, phishing, and attacks on cloud, email, and IoT systems.
HN links it as a source of threat analysis, such as TikTok permissions and PowerShell attacks. One commenter notes an author is a marketing executive.
See this: https://www.proofpoint.com/us/corporate-blog/post/understanding-information-tiktok-gathers-and-stores
A quote:
TikTok app permissions include personal information and device control
First, our researchers examined the permissions TikTok requires on Android and iOS devices following installation. While some of the permissions detailed below are to be expected, all of this is consistent with TikTok’s written privacy policy. However, when you see all that TikTok gathers it can still be of concern. In summary, these permissions allow TikTok to:
Access the camera (and take pictures/video), the microphone (and record sound), the device’s WIFI connection, and the full contact list on the device
Determine if the internet is available and access it
Keep the device turned on and automatically start itself when the device restarts
Secure detailed information on the user’s location using GPS and other apps that are running
Read and write to the device’s storage, install/remove shortcuts, access the flashlight (turn it off and on), request additional installation packages
Our researchers found that TikTok has full access to the audio, video, and address book on the device, which isn’t surprising given that TikTok is an audio-visual app by design.
However, the GPS tracking is surprising, especially as TikTok videos don’t obviously display location information. TikTok does call out their collection of location information in their privacy policy.
Recap:
TikTok does not need…
> You own your machine but not the text.
You don't get to own the text just because you can read it, see if you read this - it is still my text (because I wrote it!).
>what would be your opinion if the major websites would put a T&C that you have to enable (Let's say it was safe JS) ads to view content.
And how would I know it's safe?
I don't even let the closest friends on the wifi because they don't run adblockers on their phone and I don't want my router to get pwned [1] just because someone like Forbes is making a buck using Ads.
> Would you still say "it's my machine and I view what I want when I want"?
It is still my machine, so long as I physically own it. If I run a virtual machine in the cloud it's not mine you see, because then I'm just renting it. If ad networks want to remove the ability to block ads they would have to own the machines and rent out those computers to users, they are free to do this.
[1] https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices
> Microsoft is the Microsoft of the enterprise security market, more or less. They completely dominate email, largely dominate identity, have a plurality if not a majority on endpoint, but don't compete in network.
The most recent figures I’ve seen are that Microsoft has around 25% of the endpoint market[0], which is a plurality because the market is so fragmented. Proofpoint claims around 24% of the email security market[1].
The only security market you can say they “dominate” is identity, if you ignore the MFA market. AD is, at least, almost everywhere.
> This was a dedicated effort by CrowdStrike working with analysts back in 2017-2018.
That’s one interpretation of events. It’s also completely orthogonal to what I wrote.
0 - https://www.microsoft.com/en-us/security/blog/2024/08/21/microsoft-again-ranked-number-one-in-modern-endpoint-security-market-share/
1 - https://www.proofpoint.com/us/blog/email-and-cloud-threats/proofpoint-overall-market-leader-frost-radar-email-security-2024
I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share.
Majority of information about Windows malware I get from big computer security companies' research blogs like:
https://www.trendmicro.com/en_us/research.html
https://www.proofpoint.com/us/blog
https://research.checkpoint.com/
https://blog.talosintelligence.com/
https://www.welivesecurity.com/en/
Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/
Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques.
Here is for example good compilation of malware's anti-debugging and anti-VM techniques:
https://anti-debug.checkpoint.com/
https://github.com/CheckPointSW/Evasions
Relevant context: The author, Ryan Kalember, is an executive at Proofpoint. His title says "Cybersecurity Strategy", but he's really in marketing and PR.
I know Ryan and would say he's a great guy and by far the best marketing executive I've worked with, but marketing is marketing. This piece is marketing.
Proofpoint competes with Microsoft in the email security space, less and less effectively as time has gone on. They're partners with CrowdStrike and George Kurtz in the Spectra Alliance [1], and CrowdStrike also competes with Microsoft (in the EPP/EDR space), so it's not surprising to see them team up against a common competitor.
All that said, the criticisms of Microsoft aren't without merit. There's definitely some truth to them.
1. https://www.proofpoint.com/us/partners/spectra-alliance
Numbers are a bit loose, but even a Fermi style estimation suggests malware in general is worse than phishing. Phishing is on the order of tens of millions [1] to a few billion [2]. Ransomware alone probably causes upwards of many billions [3]. Equifax breach (XML exploit) alone has cost billions. Heartbleed, spectre, meltdown, those are at least 1B each.
[1] https://www.cybersecuritydive.com/news/phishing-cost-enterprise/605110/
[2] https://www.proofpoint.com/us/corporate-blog/post/fbi-reports-125-billion-global-financial-losses-due-business-email-compromise
[3] https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/