bugtraq - Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 26 Oct 2005 18:41:39 +0200
From: "Andrey Bayora" <andrey@...urityelf.org>
To: "Andreas Marx" <gega-it@....de>, <bugtraq@...urityfocus.com>
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through


Hi Andreas Marx,

It is ironic that now the AV programs implemented the "smart" file format
checking, but "forgot" about file extensions :)
I think, that "smart" file format checking must be complemented with the
"smart" file extension checking.

Regards,
Andrey Bayora.


----- Original Message ----- 
From: "Andreas Marx" <gega-it@....de>
To: "Andrey Bayora" <andrey@...urityelf.org>; <bugtraq@...urityfocus.com>
Sent: Wednesday, October 26, 2005 12:50 PM
Subject: Re: Multiple Vendor Anti-Virus Software Detection Evasion
Vulnerability through


>
> Hi!
>
> Thanks, that's interesting to read. In 2000, I've found and suggested the
following in an article I've written for the Virus Bulletin magazine
<http://www.virusbtn.com> :
>
> "[...] Some scanners do not actually scan all files even when set to "scan
all files" or when the mask "*.*" is used. Most of the time at least some
infected .BAT, .VBS and .COM files will be missed if they have non-standard
extensions. This happens when the scanner checks the file extension, not the
content, in order to scan solely for this kind of virus. It would be a good
idea for vendors to make a "smart" scan to find out the (hopefully) correct
file format. If there is more than one possibility (like ASCII text or a
.COM file), all possible supported formats should be scanned. [...]"
>
> You can find this (Title: "The Usual Suspects ? Part 1", Dec 2000) and
more related articles here:
> <http://www.av-test.org/sites/references_papers.php3?lang=en>
>
> cheers,
> Andreas Marx
> CEO, AV-Test.org
> <http://www.av-test.org>
>
>
> > Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability
through
> > forged magic byte.
>
> > AUTHOR: Andrey Bayora (www.securityelf.org)
>
> > For more details, screenshots and examples please read my article "The
Magic
> > of magic byte" at www.securityelf.org . In addition, you will find a
sample
> > "triple headed" program which has 3 different 'execution entry points',
> > depending on the extension of the file (exe, html or eml) - just change
the
> > extension and the SAME file will be executed by (at least) THREE
DIFFERENT
> > programs! (thanks to contributing author Wayne Langlois from
> > www.diamondcs.com.au).
>
> ______________________________________________________________
> Verschicken Sie romantische, coole und witzige Bilder per SMS!
> Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193
>
>
>