full-disclosure - AV Naming Convention

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: jan.m.clairmont at citigroup.com (Clairmont, Jan M)
Subject: AV Naming Convention

IT would be an automated naming based on first time of discovery and reporting, there could be aliases added for the bugger.
This could be for searching for Mydoom.b Mydoom.c etc. variant rather trying t search for a name like Virus20040908.19:24:31.8843 time stamped variants.

Similar or equal virus would later be eliminated or archived for
information.  Standard record stamping for a database like Oracle.  Maybe Oracle could be persuaded to provide an
international database, great public service, providing needed
information to reduce spam, and virus spreading etc.

Good questions, good answers out there.
Jan Clairmont
Firewall Administrator/Consultant

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Randal, Phil
Sent: Tuesday, August 10, 2004 11:07 AM
To: full-disclosure@...sys.com
Subject: RE: [Full-Disclosure] AV Naming Convention

> I have to agree with Todd, the naming convention is now right 
> useless for the normal population and make keeping up with 
> viruses on a corporate level that much harder. AV companies 
> are always trying to beat the other company and this leads to 
> very little information sharing between the companies on new 
> viruses, etc.
> 
> Maybe a foundation should be created. This foundation could 
> give a seal of approval to all AV corporations that join in. 
> We are starting to make rules for patch management over at 
> patchmanagment.org. Why couldn't a group work with AV names 
> and the first company that finds and IDs it correctly gets to 
> name it in the foundation. Just a dream, I would guess.

This completely misses the point.  When a new virus is discovered, it is
essential that there is a RAPID response to the threat.  The idead of
handing the critter over to a committee to decide it's name is, quite
frankly, plain bonkers.  I for one would rather all the antivirus
vendors came up with their own names if it meant that
detection/disinfection patterns came out hour earlier.

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html