bugtraq - Re: Let's have fun with EICAR test file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00f201c33cf5$6a8067c0$1500020a@bigdog>
Date: Fri, 27 Jun 2003 14:45:24 -0700
From: "Kurt Seifried" <bt@...fried.org>
To: <bugtraq@...urityfocus.com>, <keepitsecret@...h.com>
Subject: Re: Let's have fun with EICAR test file

>- - Detection of known viruses variants using only signatures has its
limits.
>- - Obviously, there are as many algorithms as there are AVs. But no one
>can claim the absolute truth.
>- - Emulation isn't always used or inneficient.
>- - Even with known viruses, AVs aren't absolutely reliable; just modify
>a few bytes and they are blind.
>- - In case of true harmful code, heuristics are aware. But there are some
>breachs...
>- - Signatures aren't always optimal.
>- - AVs have weird behaviors: often it's all or nothing, a good
identification
>or... the void. Above all, why not a common naming for viruses?
>- - Viruses research is a hard topic, whether it is for known or unknown
>viruses.
>- - Is RAV a good choice for Microsoft (don't kick my head!)?

These reccomendations and the test are largely meaningless. For all we know
some of the AV vendors look for that exact string, i.e. have a very
simplistic detection method. Had these tests actually been done using a
"real" virus (say one of the more recent mass mailers like klez or sobig)
they might be meaningful. Now I'm not saying AV products are perfect, who
knows maybe the NOP/JMP tricks will work with "real" viruses, but I wouldn't
assume so until actually tested.

In any event most AV is a reactive solution, bound to fail at some point
because of the time delay between virus in the wild and installaiton of
signature on user's platform.

Kurt Seifried, kurt@...fried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/