Slashdot Mirror
Old Malware Tricks Still Defeat Most AV Scanners
SkiifGeek writes "A year ago Didier Stevens discovered that padding IE malware with 0x00 bytes would happily slip past most of the scanners in use at VirusTotal.com. Revisiting his earlier discovery, Didier found that detection on his initial samples had improved, but not by much. For all the talk of AV companies moving away from signature based detection to heuristics, it is painfully obvious that not many of the tested engines can successfully handle such a simple and well known obfuscation method and the best of those that can detect the obfuscation can only detect it as a generic malware type. At least the scanning engines that can detect the presence of malware with the obfuscation aren't trying to claim each differential as a new variant."
Fir0x00st!
My first program:
Hell Segmentation fault
So padding it with nothing makes it undetectable? I never thought of that!
At least the scanning engines that can detect the presence of malware with the obfuscation aren't trying to claim each differential as a new variant.
Don't give the guys in marketing any ideas. "New and Improved! FoobarAV now detects an infinite number of viruses! Compare that with Norton's piddly 30,000."
This guy's the limit!
You know how you charge something, sign for it and no one looks at or cares about the signiture. There's a reason for that. Credit Card companies have figured out that verifying identity is impossible. Instead they try to verify by transaction by looking at the recent pattern of purchases for signs of theft.
Instead of trying to identify incoming virusses, they should be focusing on removal tools and monitoring. Watch the processes for unnusual behavior and flag the user if something is detected, then actually get rid of the virus if the user agrees with the analysis. Granted, unusual behavior is a pretty vaguely defined concept, but that seems a lot more adaptable to new threats than the current methods.
A few years back, Consumer Reports took some malware and made some trivial changes and almost all the AV vendors failed that simple test.
If you recall the AV vendors criticized Consumer Reports because they claimed it was the equivalent of producing new malware and that it was irresponsible.
Bottom line... this pretty much proves that AV has little or no value. You use it because everybody tells you that you have to use it, not because it provides any sort of comprehensive security (it doesn't even come close).
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Working in a repair shop, the most common infection I've seen in the past couple months has been the rogue antivirus/antispyware products. They usually pose as "Antivirus 2009" or "XP Antivirus 2009". They use extremely generic names. Its funny because every customer that has one of these infections, is usually running Norton, Mcafee, Trend Micro, AVG, or any of them. Not ONE of them from 2008 has been able to rid the rogue product. It's funny too because all you have to do is remove a couple lines in HiJackThis and remove the Program Files folder. Although it has made our repair shop a good amount of money, it is annoying having to tell customers why their AV software can't remove such a silly thing. I've been a strong supporter of Panda Antivirus for many years, and I've always thought all the others are extremely bloated. ESPECIALLY NORTON.. HOWEVER, Norton 2009 has literally done a 180 with its performance. It removed XP Antivirus in no time. It barely uses 1% of your CPU when it is idle, and it updates literally every few minutes. I've been extremely impressed with their latest release and would recommend the noobs out there to try a 15 day free trial. But of course, ultimately running any AV software is a joke if you know how to use your computer correctly and don't download goat pr0n and warez. but fyi, if you would of asked me a month ago about Norton, I would of told you it is ridiculous and extremely bloated crap software, just like the rest.
*plays the Apogee theme song music*
These0x00are0x00not0x00the0x00softwares0x00you0x00are0x00scanning0x00for.
.. paranoid crackpot leftover from the days of Amiga.