full-disclosure - Re: McAfee VirusScan vs Metasploit Framework v2.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Dec 12 16:58:37 2005
From: gautam.bipin at gmail.com (Bipin Gautam)
Subject: Re: McAfee VirusScan vs Metasploit Framework
	v2.x

The sad thing is AV vendor don't have a proper boundary on their
products work-scope. Though, giving a clean chit to products like
Claria/Gator is a big shame... I still strongly support the move of AV
vendors to classify product like nmap, netcat, metasploit as POTENTIAL
THREATS; though it's childish to treat those product equv. as
hack-tools. What AV vendor currently lack is a proper and CLEAR way to
let the users choose the level of security they want. All AV vendors
still lack even basics as, proper & basic common standards that are
followed by all AV products.

BUT guys common? so you want to share the stupid flames of users over
your security product with the AV vendors as they have classified it
as a BAD-TOOL. Will that make you feel better?  It's more of your
headache & responsibility to let the users know before download that
your security product might be classified by AV as potential threats
as, YOU KNOW they may be used for either good or bad purpose. I don't
suppose Fyodor will take any responsibility for the action of a
malicious user if nmap is used for some malicious purpose??? How AV
software would know whether software's like netcat, metasploit or nmap
found in a machine is put there by a legitimate user or by a malicious
person willing to some further evil deeds. So as a proactive measure
they rate the software's as a threat. DEFAULT DENY. Makes sense to me?
( but I agree AV vendors lack proper classification ) hey... User
always has the option to ask their AV to ignore the particular
file/directory if they own the privilege in the machine anyways.

So what's the point in discussing such stuffs??? oOo ya... a proper
and CLEAR classification from the vendors side so that the user can
easily choose the level of protection he/she wants. But that needs
some design changes not just on the AV signatures. Let's hope we'll
see those on some upcoming version.

>>>Would you yank out Canvas, and Core Impact products as well?
>>>oh, wait... there probably isn't a sig for those so you wouldn't know.
Is that just I or everyone is hearing the whispering words;
Partiality? shortsightedness?????

best regards,
-Bipin Gautam