full-disclosure - Re: detecting targetted malware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <003201c73e8f$9200cd40$b60267c0$@com>
Date: Mon, 22 Jan 2007 19:41:14 -0600
From: "Randall M" <randallm@...mail.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: detecting targetted malware

 [
[----------------------------------------------------------------------
[
[Message: 1
[Date: Mon, 22 Jan 2007 12:42:43 -0000
[From: "lsi" <stuart@...erdelix.net>
[Subject: [Full-disclosure] detecting targetted malware
[To: Full-disclosure@...ts.grok.org.uk
[Message-ID: <45B4B143.31827.4B9D873@...art.cyberdelix.net>
[Content-Type: text/plain; charset=US-ASCII
[ [
[While mass-produced malware remains an issue for a most users, an
[significant threat is also posed by malware customised for a specific
[victim (so called 'targetted malware').  This threat is potentially
[worse as an organisation cannot rely on traditional AV or anti-
[spyware scanners to detect the targetted malware; as the malicious
[code is customised it does not have an entry in AV/AS signature
[databases.
[
[Despite this, detecting customised code should be easy.  All that's
[needed is a scanner.  It simply finds every piece of executable code
[on a system.  It then compares each piece with its list of known-good
[executables.  Any executable that is found but is not on the list is
[an intruder.
[
 [***********************************************

Lsi,
You hit it right on the head. There are some scanners out there doing
something similar. What you made me think about though is "Customized"
Company proprietary scanners. At my place of work we "clone" the
workstations. "We" know what is there. A central scanning solution with a
"ok" list audits the workstations. Unusual programs are flagged and station
sent to "holding" then IT alerted! WOW this is getting so Star Trek! I want
one!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/