bugtraq - Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 28 Oct 2005 19:41:14 +0200
From: "Andrey Bayora" <andrey@...urityelf.org>
To: <mgotts@...ads.com>
Cc: <bugtraq@...urityfocus.com>
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through


Hello Mark,

> vulnerability is limited in our products to one specific type of potential
> virus file
It is .bat files (if I remember).

>which is not commonly allowed in most IT systems
Yes, I think organizations must implement good e-mail policy that blocks all
executable file types (or allow some file types that needed for business and
block the rest).

>and needs to be executed manually
Maybe it is not always true if some virus drops locally .bat file and then
executes it.

I did not check this issue with the current definitions and updates, but
important point is that I used .bat, .html and .eml file types with the
magic byte of .exe file - I believe that such vulnerability can be
implemented with other file types and possibly with other magic byte. The
vendors must patch the LOGIC (algorithm) of the scanning to address this
issue.

Best regards,
Andrey Bayora.



----- Original Message ----- 
From: <mgotts@...ads.com>
To: "Andrey Bayora" <andrey@...urityelf.org>
Cc: <bugtraq@...urityfocus.com>
Sent: Friday, October 28, 2005 6:52 PM
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion
Vulnerability through


> > > Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability
> through
> > > forged magic byte.
> >
> > > AUTHOR: Andrey Bayora (www.securityelf.org)
> >
> > > For more details, screenshots and examples please read my article "The
> Magic
> > > of magic byte" at www.securityelf.org . In addition, you will find a
> sample
> > > "triple headed" program which has 3 different 'execution entry
> points',
> > > depending on the extension of the file (exe, html or eml) - just
> change the
> > > extension and the SAME file will be executed by (at least) THREE
> DIFFERENT
> > > programs! (thanks to contributing author Wayne Langlois from
> > > www.diamondcs.com.au).
> >
>
> Below I copied Trend Micro's response to the "magic byte" vulnerability in
> their products:
>
> ========================================
> Dear Valued Client,
>
> Greetings!
>
> My name is <removed>. I will be the one handling your case.
>
> Please correct me if I left some issues or if I misunderstood your
> concern.
>
> Trend Micro is aware of a potential vulnerability related to the "forged
> magic byte" in certain file types. Based on our analysis, this
> vulnerability is limited in our products to one specific type of potential
> virus file which is not commonly allowed in most IT systems and needs to
> be executed manually. Trend Micro customers are currently able to detect
> such files -- should they be created -- through our virus pattern file,
> 2.915.00.
>
> Please make sure that you regularly update your virus definitions. Hope
> this information helps.
>
> ========================================
>
>
> Any comments on their response?
>
> -- Mark
>
>