lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <000701c3e785$4b7aee00$0201a8c0@fosi> From: steve.wray at paradise.net.nz (Steve Wray) Subject: MyDoom download info > From: full-disclosure-admin@...ts.netsys.com > [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of > first last > > > Given that its possible for a program to detect that its > > being run under a debugger, > > wouldn't it be possible for a virus to behave differently in > > the debug environment? > > Yes. But todays computer viruses are very simple and very > weak. Wait a few years and they should be a lot more powerful. I've often thought that none of the viruses so far encountered on the net are actually serious. What worries me are the viruses that have been around for a while and which have, so far, not been detected; these are the serious viruses (I'm assuming that they exist). Viruses that *don't* send vast amounts of email and hence get detected; viruses that *don't* run under a debugger, that *don't* give themselves away. > [...] > >IE: how do you know that the behavior you see in the lab reflects > >behavior in > >the real world? (I get a kind of 'schrodingers cat' deja vu). > > You can always disassemble the virus, which is what people > will do if it's a real "popular" one such as MyDoom. IIRC there are viruses that are encrypted and are almost impossible to disassemble? Would that be true?
Powered by blists - more mailing lists