full-disclosure - "Zero-day catcher" for Windows available for sell

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 12 Sep 2008 10:59:42 +0400
From: Zero-day catcher team <zerodaycatcher@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: "Zero-day catcher" for Windows available for sell

Known buffer overflow prevention methods, Anti-Virus methods (including 
heuristic and signature methods),
HIPS methods, Anti-rootkit methods can be more or less easily bypassed 
(description of the methods of
bypassing exceeds the scope of this info).
Main principles of "Zero-day catcher":
 - any malware (including trojans, viruses and worms, protected by 
anti-heuristis methods)uses direct reading of PE headers of at least one 
module for EAT/IAT/sections;
 - any AV software (including heuristic and signature ways) can be 
bypassed easily, AV methods are effective ONLY for known vectors of 
attack and signatures;
 - any HIPS software (based on heuristic and r0/r3 API hooks) can be 
bypassed by in-depth inline hooks;
 - any rootkit (including installed hooks) changes a control flow of 
legal threads;
 - any thread (including changed by rootkit) can not permanently and 
directly control hardware timer behaviour (in context of interruption 
control of its execution);
 - any rootkit can not control DRAM, disabled by chipset MTRR as SMRAM;
 - any rootkit can not change SMRAM_LOCK register behaviour (WRITE_ONCE 
chipset future);
 - any anti-rootkit methods (including r0/r3 API hooking and heuristic 
scan of memory) can be bypassed by early loaded rootkit;

There are three versions of "Zero-day catcher":
- SMM version (include hardware part and software part) - for rootkit 
acquiring and prevention (including virtualization rootkits)
- kernel mode version (software part only) - for rootkit acquiring and 
prevention (excluding virtualization rootkits)
- user mode version (software part only) - for userland malware only 
(exploit-bot-worm-virus catcher)

"Zero-day catcher" could be usefull for:
 - zero-day threats detection and analyzing automation;
 - acquiring exception environment;
 - detection of undetectable (by heuristic and signature) malware in any 
form;
 - discovering of any vectors of malicious attack (browsers, mail 
clients, etc) by corresponding plugins;
 - prevention of all kinds of known and unknown attacks (implementation 
of critical importance systems)

There are no demo or trial version, "Zero-day catcher" targeted for 
professionals only.
Questions and request for prices: zerodaycatcher@...il.com 
<mailto:zerodaycatcher@...il.com>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/