[Case Study] BinJumper side-effects

[arcanis]

What package is covered by this investigations?

Binjumper, that we use to spawn processes without triggering the abort confirmation prompt.

Describe the goal of the investigation

#798 (comment)

Our company has some process-monitoring software installed, and while it's not 100% all-encompassing, it frequently blocks "unknown" executables from executing at all. In this case, the .exe files in the temp folder are all getting killed before they can start, so the post-install steps all fail.

[markerikson]

@arcanis : was literally just about to open a new issue for this :)

@merceyz: I don't know all the heuristics the corporate security software uses. FWIW, this particular tool is CarbonBlack/Bit9. In this case, the error message that pops up indicates that it sees the original path of node.exe, and that the process is signed. But, something about the fact that there's a binary being executed out of the user temp folder triggers it and it gets blocked.