lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 12 Sep 2008 11:41:51 +0100 From: "Probably Shadowgamers" <notshadowgamers@...glemail.com> To: full-disclosure@...ts.grok.org.uk Subject: Re: "Zero-day catcher" for Windows available for sell I have the cure to cancer, but I'm not letting anyone have it. On 9/12/08, Zero-day catcher team <zerodaycatcher@...il.com> wrote: > Known buffer overflow prevention methods, Anti-Virus methods (including > heuristic and signature methods), > HIPS methods, Anti-rootkit methods can be more or less easily bypassed > (description of the methods of > bypassing exceeds the scope of this info). > Main principles of "Zero-day catcher": > - any malware (including trojans, viruses and worms, protected by > anti-heuristis methods)uses direct reading of PE headers of at least one > module for EAT/IAT/sections; > - any AV software (including heuristic and signature ways) can be > bypassed easily, AV methods are effective ONLY for known vectors of > attack and signatures; > - any HIPS software (based on heuristic and r0/r3 API hooks) can be > bypassed by in-depth inline hooks; > - any rootkit (including installed hooks) changes a control flow of > legal threads; > - any thread (including changed by rootkit) can not permanently and > directly control hardware timer behaviour (in context of interruption > control of its execution); > - any rootkit can not control DRAM, disabled by chipset MTRR as SMRAM; > - any rootkit can not change SMRAM_LOCK register behaviour (WRITE_ONCE > chipset future); > - any anti-rootkit methods (including r0/r3 API hooking and heuristic > scan of memory) can be bypassed by early loaded rootkit; > > There are three versions of "Zero-day catcher": > - SMM version (include hardware part and software part) - for rootkit > acquiring and prevention (including virtualization rootkits) > - kernel mode version (software part only) - for rootkit acquiring and > prevention (excluding virtualization rootkits) > - user mode version (software part only) - for userland malware only > (exploit-bot-worm-virus catcher) > > "Zero-day catcher" could be usefull for: > - zero-day threats detection and analyzing automation; > - acquiring exception environment; > - detection of undetectable (by heuristic and signature) malware in any > form; > - discovering of any vectors of malicious attack (browsers, mail > clients, etc) by corresponding plugins; > - prevention of all kinds of known and unknown attacks (implementation > of critical importance systems) > > There are no demo or trial version, "Zero-day catcher" targeted for > professionals only. > Questions and request for prices: zerodaycatcher@...il.com > <mailto:zerodaycatcher@...il.com> > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists