| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 18 Oct 2010 14:27:46 -0600 From: jason@...bz.net To: bugtraq@...urityfocus.com Subject: Antivirus detection after malware execution The purpose of this writeup is to detail the execution of malicious code via a protocol handler (hcp) prior to being detected by Anti-Virus Technology. It should be noted that detection does occur by AV however only after the code is executed and placed into memory. Using this technique, an attacker can effectively bypass the protections of AntiVirus technology. Being able to bypass AntiVirus technology allows an attacker to drop and execute known malicious files (Zeus for example). The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter) released by Tavis Ormandy. While this exploit is used, this is NOT a rehash of the Microsoft Helpcenter Exploit. The purpose of this write up is to walk though the discovery and document the method used to effectively bypass AntiVirus and execute a malicious payload on a victims machine. http://www.n00bz.net/antivirus-cve CVE-2010-3496- McAfee CVE-2010-3497- Symantec/Norton CVE-2010-3498- AVG CVE-2010-3499- F-Secure
Powered by blists - more mailing lists