bugtraq - RE: [Full-disclosure] RE: when will AV vendors fix this???

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <002001c6ba62$60495da0$0201a8c0@data>
Date: Mon, 7 Aug 2006 22:45:10 +0200
From: "Thomas D." <whistl0r@...glemail.com>
To: "'Dude VanWinkle'" <dudevanwinkle@...il.com>
Cc: "Bipin Gautam" <gautam.bipin@...il.com>,
	<full-disclosure@...ts.grok.org.uk>, <bugtraq@...urityfocus.com>
Subject: RE: [Full-disclosure] RE: when will AV vendors fix this???

> -----Original Message-----
> From: Dude VanWinkle
> Sent: Monday, August 07, 2006 8:49 PM
> > So I might be able hide something, but I can't do anything.
> 
> Well, there would be an access denied message for most AV scanners
> when it hit the file in question and couldnt even get a read.
> 

As I said before:

1.) An attacker has to transfer a bad file.
Every One-Access Scanner should detected the threat, if it is known (if it
is unknown, it is a zero-day attack...)

2.) If you have transfered the file (as I said before: This isn't easy...),
you can only hide the file, because, If you run it, it will be detected.

If it won't be detected, it is an unknown file, so it is a zero-day
attack...

And even if you hide the file, if it hide the way you describe, you aren't
able to execute the file, until you give access to yourself. If you do this,
the anti-virus program will also have access....

Keep in mind: If it is an unknown file (zero-day), you don't even think
about hiding, because it isn't necessary. You have other problems...

=> I don't think it is a security related problem nor a problem itself.