full-disclosure - Inside AV engines?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu Dec 15 02:52:33 2005
From: fosforo at gmail.com (Fósforo)
Subject: Inside AV engines?

About Morphine, I really dont know about the COMMERCIAL version - ppl
that sell it grant it wont be detected, and each one sold is different
from another.

cya

2005/12/14, AgentSmith15 <agentsmith15@...il.com>:
> I have to warn you about Morphine that if you use it AVs like KAV will
> detect and warn a user that this is a morphined file + scan inside. It's
> also open source in Delphi so with a couple modifications you should be good
> :)
> >
> >
> >
> >
> > On 12/13/05, F?sforo <fosforo@...il.com> wrote:
> > > ... or you can try one crypt/packer ($$$) called Morphine -
> > > http://hxdef.czweb.org/
> > > Assuming your company is going to support an exclusive antidetection
> > > tool like that
> > >
> > > 2005/12/13, Michael Tewner <tewner@....ac.il>:
> > > > Check The Art of Computer Virus Research and Defense (Paperback)
> > > > by Peter Szor. It is one of the foremost books in Virus detection,
> etc,
> > > > and I found it to be a valuable read...
> > > >
> > > > Examples are in C code, and there's a lot of memory dumping, etc.
> Check
> > > > slashdot's review if you want.
> > > >
> > > > Jeroen wrote:
> > > > > For penetration testing on Wintel system, I often use netcat.exe and
> stuff
> > > > > like pwdump. More and more I need to disable anti-virus services
> before
> > > > > running the tools to avoid alarms and auto-deletion of the
> applications. It
> > > > > works but it isn't an ideal situation since theoretically a network
> can be
> > > > > infected while the AV-services are down. Recompiling tools is an
> option
> > > > > since the source of many tools I use is available. The question is
> (before I
> > > > > burn useless CPU cycles): can someone help me getting info about the
> inside
> > > > > of AV engines? Will addition of some rubbish to the code do the
> trick (->
> > > > > other checksum), do I need to change some core code or is it a
> mission
> > > > > impossible anyway? Who can help for example getting some useful
> research
> > > > > papers on the subject of detecting viruses and how to bypass
> mechanisms
> > > > > used? Any help will be appreciated.
> > > > >
> > > > >
> > > > > Greets,
> > > > >
> > > > > Jeroen
> > > > >
> > > > >
> > > > > _______________________________________________
> > > > > Full-Disclosure - We believe in it.
> > > > > Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
> > > > > Hosted and sponsored by Secunia - http://secunia.com/
> > > > _______________________________________________
> > > > Full-Disclosure - We believe in it.
> > > > Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
> > > > Hosted and sponsored by Secunia - http://secunia.com/
> > > >
> > >
> > >
> > > --
> > >
> > > ----------------------------------------------
> > >
> > > "O  caminho  do  homem  de  bem  ?  cercado de
> > > todos os lados  pelas  iniq?idades do  ego?smo
> > > e tirania  dos homens maus.  Aben?oados os que,
> > > em  nome da caridade e  boa vontade,  conduzem
> > > os  fracos pelo  vale das  sombras, pois ele ?
> > > o  guardi?o  de seu irm?o e o  que encontra os
> > > filhos perdidos. E eu vou  atacar com vingan?a
> > > e f?ria  os que tentarem  envenenar e destruir
> > > meus irm?os. E quando minha vingan?a se abater
> > > sobre  eles,  saber?o  que  eu sou  o Senhor."
> > >
> > > (Ezequiel, 25, 17)
> > >
> > >
> ------------------------------------------------------------------------------
> > > Audit your website security with Acunetix Web Vulnerability Scanner:
> > >
> > > Hackers are concentrating their efforts on attacking applications on
> your
> > > website. Up to 75% of cyber attacks are launched on shopping carts,
> forms,
> > > login pages, dynamic content etc. Firewalls, SSL and locked-down servers
> are
> > > futile against web application hacking. Check your website for
> vulnerabilities
> > > to SQL injection, Cross site scripting and other web attacks before
> hackers do!
> > > Download Trial at:
> > >
> > > http://www.securityfocus.com/sponsor/pen-test_050831
> > >
> -------------------------------------------------------------------------------
> > >
> > >
> >
> >
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter:
> http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>


--

----------------------------------------------

"O  caminho  do  homem  de  bem  ?  cercado de
todos os lados  pelas  iniq?idades do  ego?smo
e tirania  dos homens maus.  Aben?oados os que,
em  nome da caridade e  boa vontade,  conduzem
os  fracos pelo  vale das  sombras, pois ele ?
o  guardi?o  de seu irm?o e o  que encontra os
filhos perdidos. E eu vou  atacar com vingan?a
e f?ria  os que tentarem  envenenar e destruir
meus irm?os. E quando minha vingan?a se abater
sobre  eles,  saber?o  que  eu sou  o Senhor."

(Ezequiel, 25, 17)