full-disclosure - A worm...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030627014628.GD15802@hutley.net>
From: brett at hutley.net (Brett Hutley)
Subject: A worm...

At approximately 'Thu, Jun 26, 2003 at 07:37:12PM -0500' 'M. Osten' warbled:
> On Thu, 2003-06-26 at 10:14, ATD wrote:
> > Yes, 
> > 	And this was my point. Are the crafty "worm gods" creating worms that
> > evade detection by using compression and other methods?  If they are
> > doing this, and if they are creating the "stealth worms" whats next. Zip
> > files would be just one of hundreds of ways to hide worms. Maybe the
> > virus scanning technology needs to be kicked up a notch or two.
> 
> Do most virus scanners *not* scan compressed files?  We scan all
> incoming mail using Amavis (on linux) with the NAI engine which does
> scanning of all the common compression schemes.

Most virus scanners I believe DO scan compressed files. 
Worm gods use techniques like code morphing to make it harder to detect
the worm rather than compression. Note that true worms propogate WITHOUT
user intervention, so I think you are talking more about email viruses
here. Worms that propogate without user intervention normally have 
defined attack vectors/exploits, and can be detected/screened by
IDS/Firewall.

-- 
Brett Hutley [M.App.Fin., CISSP, SANS GCIH]
mailto:brett@...ley.net | "My other computer is ALSO a *nux box"
http://hutley.net/brett | PGPkey:http://hutley.net/brett/pupkey.txt