full-disclosure - RE: Full-Disclosure Digest, Vol 4, Issue 11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: randallm at fidmail.com (RandallM)
Subject: RE: Full-Disclosure Digest, Vol 4, Issue 11

Andrey,
Just to add to the concern you bring up is what VirusTotal also shows on the
"Detection failures".
http://www.virustotal.com/flash/graficas/grafica4_en.html

Of course for me that's job security but none the less its pitiful. And now
in steps Microsoft with "Billions" under its belt and I'll bet the odds
won't change much. That's where I get really confused.
We know that costs go in to the billions when networks go down due to
infections. I know of no one but the parity actors for AOL who welcome
infections. I'm just dumb founded on the abilities of virus companies to
battle this. 

I'm finding that my preconceived label of who the virus writers are and look
like are rapidly being changed. I used to envision this lad with a tattered
def leopard shirt sitting with an old laptop in the wee early dawn finishing
up his code and getting ready to test it on the old grey Pentium box in the
corner.

Is this the guy beating the pants off the billion dollar companies?

I would also like to add that what you've done is very impressive. I'm
reading your paper now. I could and will never be able do such so thanks for
this well written piece. Please tell me your not wearing a def leopard
t-shirt!

thank you
Randall M

"If we ever forget that we're one nation under God, then we will be a nation
gone under." 
- Ronald Reagan
_________________________________

Andrey so correctly acknowledged:
------------------------------

Message: 8
Date: Fri,  4 Mar 2005 15:03:10 -0600
From: Andrey Bayora <andrey@...denbit.org>
Subject: [Full-Disclosure] Bypass of 22 Antivirus software with GDI+
	bug	exploit Mutations - part 2
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com
Message-ID: <1109970190.4228cd0e27138@....hiddenbit.org>
Content-Type: text/plain; charset=ISO-8859-1

The first part is here:
http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0475.html

First, this post isn.t about .how dangerous GDI+ bug or malicious JPEG
image., but .how good. is your antivirus software.

The issue is: only 1 out of 23 tested antivirus software can detect
malicious JPEG image (after 6 month from the public disclosure date).

Here is the link to results, JPEG file and my paper (GCIH practical)
that describes how to create this one:
http://www.hiddenbit.org/jpeg.htm

This one vendor (Symantec) that can detect it, obviously do it with the
.heuristic. detection (I don.t work for them and didn.t send them any
file, moreover I know cases when Symantec didn.t detect a virus that
.other. vendors do).
ClamAV antivirus detected this JPEG file 4 month ago, but strangely
can.t detect it now.
What happened?
What about 22 antivirus software vendors that miss this malicious JPEG?
The pattern or problem in these JPEG files is known and still many
antivirus software vendors miss it, did it can represent the quality of
heuristic engines?

OK, we know that any antivirus software can provide 100% protection.

P.S.  After my first post (October 14,2004) about this problem . all
antivirus software vendors added detection to the demo file provided by
me in couple of hours. Sadly for me, but it seems that they prefer
.playing cat and mouse. and not improve heuristic engines.

Regards,
Andrey Bayora.
CISSP, GCIH

-----------------------------

And so ends his thoughts