Multiple vendor antivirus .kz archive format evasion/bypass

hi

Original publication:
http://seclists.org/fulldisclosure/2012/Feb/42

More info about this kind of evasion/bypass method on t. Zoller site:
http://blog.zoller.lu/2009/04/case-for- ... sions.html

Looking for flaw in softwares is a boring game, but if this could help end users to be more protected...

Anyone can play with his av...

Rgds

 

Heh, "vulnerability"... right.

It's simply a matter of not supporting archive formats, either via documented implementation or through emulation/heuristic unpacking, nothing more.
A lot of AVs still don't support even the basic compression methods, like 7zip or zipx, so this is nothing new or something to be concerned about. The file will be detected upon extraction.

 

It does bypass things such as download scanners. It gets the malware onto the system, which is step one.

Not a big deal though.

 

hi
sorry for the link:
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

Thierry Zoller was confronted to same kind of answers: not a runtime detection problem.

But there is so many evasion/bypass methods...



Rgds