bugtraq - Re: [Full-disclosure] Re: when will AV vendors fix this???

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <44E0DE0B.6030504@utdallas.edu>
Date: Mon, 14 Aug 2006 15:33:15 -0500
From: Paul Schmehl <pauls@...allas.edu>
To: Andreas Marx <gega-it@....de>
Cc: bugtraq@...urityfocus.com, Bipin Gautam <gautam.bipin@...il.com>
Subject: Re: [Full-disclosure] Re: when will AV vendors fix this???

Andreas Marx wrote:
> At 22:35 07.08.2006, Paul Schmehl wrote:
> 
> [...]
>> This is similar to the problem of alternative data streams. Essentially, the work needed to solve this problem isn't worth the expenditure of time and effort, because the file, in order to infect the system, has to be executed.  Once the file is executed "normal" on-access scanning will catch the exploit *if* it is known.  (If it's unknown, it doesn't matter anyway.)  Yes, on-demand scanning won't "see" the file, but even malicious files are benign until they are run.
> [...]
> 
> No, that's not the case. On-Access scanner *might* be able to catch the malware (if it's a known variant), but it could be that the scanner is missing the file, depending on it's implementation. The same applies to the On-Demand scanner: it might or might not detect it, even if the *known* malware can still run on a system, as many tricks exists to get the file executed. Here are two articles showing this with ADS, including some test results:
> 
You've got my curiosity now.  Are you saying that no AV product will 
"see" exploit once it enters memory?  Granted, that's one step further 
than on-access, but I thought that all AV products (now) were looking at 
memory for file accesses.

-- 
Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5268 bytes)