| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
From: brett at hutley.net (Brett Hutley) Subject: A worm... At approximately 'Thu, Jun 26, 2003 at 07:37:12PM -0500' 'M. Osten' warbled: > On Thu, 2003-06-26 at 10:14, ATD wrote: > > Yes, > > And this was my point. Are the crafty "worm gods" creating worms that > > evade detection by using compression and other methods? If they are > > doing this, and if they are creating the "stealth worms" whats next. Zip > > files would be just one of hundreds of ways to hide worms. Maybe the > > virus scanning technology needs to be kicked up a notch or two. > > Do most virus scanners *not* scan compressed files? We scan all > incoming mail using Amavis (on linux) with the NAI engine which does > scanning of all the common compression schemes. Most virus scanners I believe DO scan compressed files. Worm gods use techniques like code morphing to make it harder to detect the worm rather than compression. Note that true worms propogate WITHOUT user intervention, so I think you are talking more about email viruses here. Worms that propogate without user intervention normally have defined attack vectors/exploits, and can be detected/screened by IDS/Firewall. -- Brett Hutley [M.App.Fin., CISSP, SANS GCIH] mailto:brett@...ley.net | "My other computer is ALSO a *nux box" http://hutley.net/brett | PGPkey:http://hutley.net/brett/pupkey.txt
Powered by blists - more mailing lists