bugtraq - The incredible gayness of antivirus-vendors and their products (in this case, NAV corp. ed.)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9A3DE43902E1E045A6A7D979CBF6580B0DF40A@bangjohansen.telecomplus>
Date: Thu, 10 Jul 2003 10:37:50 +0200
From: Knud Højgaard <kh@...ecomplus.dk>
To: <full-disclosure@...ts.netsys.com>
Cc: <bugtraq@...urityfocus.com>
Subject: The incredible gayness of antivirus-vendors and their products (in this case, NAV corp. ed.)

On this wonderful morning what do my eyes see? 
A dialog box saying the following to me:

Scan type:  Realtime Protection Scan
Event:  Virus Found!
Virus name: Hacktool
File:  C:\Documents and Settings\kaka\Local Settings\Temporary Internet Files\Content.IE5\AVININWN\DSR-youbin[1].pl
Location:  Quarantine
Computer:  KAKA
User:  kaka
Action taken:  Clean failed : Quarantine succeeded : Access denied
Date found: Thu Jul 10 08:55:43 2003

The file in question is http://kokanins.homepage.dk/DSR-youbin.pl

The obvious retardedness of labelling my damn generic exploit as being a virus aside, it strikes me as 'funny' that I am still available to:

Select the text in my browser,
create a "new text document",
paste the contents and save it to disk,
and without any nagging from the puny AV-software:
access the file,
rename it (the "new text document") to the original filename,
still access it via an editor, 
and even execute it via my cygwin environment.

Let's turn our attention to http://kokanins.homepage.dk/rs_iis_xpl.pl

The same sort of bullshit as above except "Virus name: FreeBSD.Rootkit".
Uh, that's incorrect to say the least - this is no rootkit.

This time the antivirus software succeeds in its mission - it quarantines the file.
However, changing "$freebsd_string" to "$freelsd_string" is enough to fool the software, allowing execution of the file etc. as in the previous example.

Antivirus-software is protection for people against yesterdays threats. 
Antivirus-software is protection for moronic users against themselves.
Antivirus-software is crap. I say we kill the users and be done with it.

Datfile ver. 50709f // updated today 
NAV ver. 7.51.847 // oh no, I am exposing
Scan engine ver. 4.1.0.6 // dangerous info here

--
kokaninATdtors.net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html