lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 27 Oct 2005 09:14:52 +0200
From: "Andrey Bayora" <andrey@...urityelf.org>
To: "Eygene A. Ryabinkin" <rea@....mbslab.kiae.ru>,
	"Debasis Mohanty" <mail@...kingspirits.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Multiple Vendor Anti-Virus Software
	DetectionEvasion Vulnerability through forged magic byte


I checked the "ZM" variant and got the same results as for "MZ" one.
Thus, I think that they indeed, detected as executables, but only AV vendor
can tell for sure.
Generally, there are many variants for this issue, as many various "magic
byte" variants exist.
In my case - I force AV to look at the TEXT file as to EXECUTABLE, but it's
possible that other "pairs" then txt<->exe exist as well.

Regards,
Andrey Bayora.



----- Original Message ----- 
From: "Eygene A. Ryabinkin" <rea@....mbslab.kiae.ru>
To: "Debasis Mohanty" <mail@...kingspirits.com>
Cc: "'Andrey Bayora'" <andrey@...urityelf.org>;
<full-disclosure@...ts.grok.org.uk>; <bugtraq@...urityfocus.com>
Sent: Thursday, October 27, 2005 8:25 AM
Subject: Re: [Full-disclosure] Multiple Vendor Anti-Virus Software
DetectionEvasion Vulnerability through forged magic byte


> > Especially in case of EXEs, AFAIK not all EXEs has the same 'MAGIC BYTE'
> > (MZ). MZ only appears in the first two bytes of Win32 executable files.
>
>  Just for the curiosity: if you'll change "MZ" to "ZM" then the 16-bit
> executables (MZ and NE executables) will still run and 32-bit (PE)
executables
> will execute their DOS stub part. It will be very interesting to check if
> such files will be detected as executables at all in all mentioned
antiviruses
> and what sections PE files will be examined.
>
>  The 'MZ' -> 'ZM' hack is the old feature of MS-DOS loader that still
lives in
> WinXP (at least, didn't tested others, but believe that they also carry
that
> feature). That's what is called 'interoperability between various
versions' ;)
> -- 
>  rea
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Powered by blists - more mailing lists