AVs test against JPEG exploits

Hi,

An "old" (october 2004) but a new test files.
The next link is a recent test of some AVs (on Virus Total and Jotti) against JPEG exploits.

I've verified the test and Kaspersky and Norton was the only ones to detect the infected file (on VirusTotal/Jotti) and i attached the resultat the end of the post.
Anyone can do the same test with his AV.

http://www.hiddenbit.org/jpeg.htm

On the disclosure, the author said that AV vendors "prefer "playing cat and mouse" and not improve heuristic engines".

Regards

 

timely post kareldjag last nite kav 6 prototype found 2 instances of this backdoor trojan programm win.32 after my korean boarder went for a cruise to her chinese /korean sites. I ran a scan after getting home and let kav disinfect/delete file. Nice to see a comfirmation here.

Kav6 also disinfects it before download.

 

Tested on 3 Pc's
PC 1 - KAV 5 Per. (v.146 I believe), it was missed it on execution(Update!), but got it on the OD scan. 227 got it on access of the zip.

PC 2 - Gdata, caught it at Download.

PC 3 - McAfee 8.0i with scan archives on caught before download, and without Zip scan on access.

HTH

 

I agree with that.

Best regards,
Firefighter!

 

Also Ewido 3.0 was able to detect that.

Best regards,
Firefighter!

 

What heppend if you run that "picture"? Does it display a picture or just damage a system.

Does it depense of which program you use to open "picture"?

Thanks

 

The problem is that the antivirus programs are currently only detecting the shellcode inside the example exploit JPEG - not the exploit itself. If you replace the shellcode with another, it will go undetected.

I changed our scan engine yesterday, this "new" exploit example uses a Photoshop specific extension of the JPEG format to "hide" the exploit.

 

Both F-Secure and McAfee found the virus here...

 

Now it detected, but 2 days ago it didn't...

 

how did avast do with this?

 

I just downloaded the latest avast! beta (4.6.614) with today's definitions and it did not detect it.

 

Same here... Not good...