Hackers Looking Hard For Anti-virus Software Vulnerabilities

Looks like signature based file scanners are about to be under attack.

 

Thank for keeping us all posted on current news Ronjor - cant get any worse can it!!?

To be honest along with some of the other news you have posted this week, is there ever going to be a time when people can feel safe online without worrying about security.(internet 2 maybe?)

take care T

 

Hi, tom772

Use someone else's computer. [remotely, that what I do much cheaper. ]

Take Care,
TheQuest

PS: It my JOKING

 

I feel perfectly safe online without worrying about security. You should too!

-rich
________________
~~Be ALERT!!! ~~

 

After reading the article, I have come to the conclusion that it is security software as a whole that is coming under attack. People are trying to find flaws in them, much as they do for Windows, browsers, email clients etc.

The examples given are for main stream security software which are naturally antiviruses. But I have no reason to believe that security software based on other non signature based methods are immune to exploits.

In fact, given their nature, I think they are even more vulnerable than signature based file scanners.

 

Why do you think behavior based software is more vulnerable than scanners? I am interested in hearing the weaknesses of using this method since everyone only talks about the strenghts.



Starrob

 

There always have been AV vulnerabilities. Most notoriously in decompressing engines.

I don't see a widespread exploit of these vulnerabilities for the following reasons:
- Most AV engines automatically update itself.
- There's no generic AV. Eveyone uses as different AV product.
- AFAIK most vulnerabilities are of DOS nature and not remotely exploitable.

This could change when Microsoft launches or bundles it's security suite

The article discusses fooling signature based scanning on file types and recursion in archives files. I don't know how they want to fool file types. Maybe be masking an an executable as .doc, which usually passes through? Compressed file types remain the weak spot, see the My-Doom outbreak and the vulnerabilities in decompressing engines.

If the AV industry can't address these weak spots, we can always consider quarantaining or blocking compressed files.

 

Thanks for the insight diginsight....Always love to learn new things.



Starrob