full-disclosure - Antivirus detection after malware execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0947b464b80a59b595ca1408a9eb015d@localhost>
Date: Mon, 18 Oct 2010 14:58:31 -0700
From: "jason@...bz.net" <jason@...bz.net>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Antivirus detection after malware execution

The purpose of this writeup is to detail the execution of malicious code
via a protocol handler (hcp) prior to being 
detected by Anti-Virus Technology.  It should be noted that detection does
occur by AV however only after the code is 
executed and placed into memory. 

Using this technique, an attacker can effectively bypass the protections
of AntiVirus technology.  Being able to bypass 
AntiVirus technology allows an attacker to drop and execute known
malicious files (Zeus for example).

The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter)
released by Tavis Ormandy.  While this exploit 
is used, this is NOT a rehash of the Microsoft Helpcenter Exploit.  The
purpose of this write up is to walk though the 
discovery and document the method used to effectively bypass AntiVirus and
execute a malicious payload on a victims 
machine. 

http://www.n00bz.net/antivirus-cve

CVE-2010-3496- McAfee
CVE-2010-3497- Symantec/Norton
CVE-2010-3498- AVG 
CVE-2010-3499- F-Secure

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/