full-disclosure - FW: JPEG AV Detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9E97F0997FB84D42B221B9FB203EFA27171636@dc1ms2.msad.brookshires.net>
From: toddtowles at brookshires.com (Todd Towles)
Subject: FW: JPEG AV Detection

 What exactly are the AV products detecting in the JPEG exploits? Barry
and I was talking about how impressed we were that the AV companies
jumped on this one and detection was pretty fast. But is the detection
so generic that a variant will bypass? Is the detection based on a
original exploit that could be modified in a way that makes it
"undetectable" right now?

-Todd

-----Original Message-----
From: Barry Fitzgerald [mailto:bkfsec@....lonestar.org] 
Sent: Tuesday, September 28, 2004 1:55 PM
To: Todd Towles
Subject: Re: [Full-Disclosure] Re: Full-Disclosure digest, Vol 1 #1933 -
20 msgs

Todd Towles wrote:

>Yep, really surprised. Just hopefully the invalid data that is being 
>detected can't be changed or worked in a work that would bypass normal 
>detection. Once the file is renamed to a BMP or a GIF, you confuse the 
>whole thing even more.
>
>Are the AV products hitting on a part of the original exploit? Can this

>part be changed in a future version to make it "undetectable". I am 
>very impressed at the work of the AV companines on this one, but I also

>know that is this detection is too simple, that it will be bypassed.
>
>  
>
I'm not sure what they're specifically detecting.  This may be a good
question for the list.

             -Barry