bugtraq - Bypass of 22 Antivirus software with GDI+ bug exploit Mutations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1109970190.4228cd0e27138@www.hiddenbit.org>
Date: Fri,  4 Mar 2005 15:03:10 -0600
From: Andrey Bayora <andrey@...denbit.org>
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com
Subject: Bypass of 22 Antivirus software with GDI+ bug
	exploit Mutations - part 2

The first part is here:
http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0475.html

First, this post isnt about how dangerous GDI+ bug or malicious JPEG
image, but how good is your antivirus software.

The issue is: only 1 out of 23 tested antivirus software can detect
malicious JPEG image (after 6 month from the public disclosure date).

Here is the link to results, JPEG file and my paper (GCIH practical)
that describes how to create this one:
http://www.hiddenbit.org/jpeg.htm

This one vendor (Symantec) that can detect it, obviously do it with the
heuristic detection (I dont work for them and didnt send them any
file, moreover I know cases when Symantec didnt detect a virus that
other vendors do).
ClamAV antivirus detected this JPEG file 4 month ago, but strangely
cant detect it now.
What happened?
What about 22 antivirus software vendors that miss this malicious JPEG?
The pattern or problem in these JPEG files is known and still many
antivirus software vendors miss it, did it can represent the quality of
heuristic engines?

OK, we know that any antivirus software can provide 100% protection

P.S.  After my first post (October 14,2004) about this problem  all
antivirus software vendors added detection to the demo file provided by
me in couple of hours. Sadly for me, but it seems that they prefer
playing cat and mouse and not improve heuristic engines

Regards,
Andrey Bayora.
CISSP, GCIH

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html