Standards and Policies on Packer Use

ronjor · Oct 27, 2010

By Peter Ferrie

For those people who missed my presentation at Virus Bulletin this year, I co-presented on the topic of "proper" packer usage. The idea of a “proper” way to use packers is two-fold:

(a) It reduces the prevalence of legitimate packers being used to pack malware.
(b) It makes it easier to identify packers which exist only to pack malware.

This is an industry-wide initiative, with backing from over a dozen security companies, including McAfee, Symantec, IBM, and Trend Micro. It also has the backing of some big packer vendors: Enigma, Obsidium, Oreans (the makers of Themida), and VMPSoft (the makers of VMProtect), but it's not limited to the people who sell packers - open-source packers will be supported, too. To quell any concerns, it's not being run by the anti-malware industry - we're just participants. The IEEE is in charge of it all.

Why do it at all? Imagine this situation: Alice is a packer vendor. She sells her product to Bob. Carol is an anti-malware vendor, and she also sells her product to Bob. Then along comes Dave, the malware author, who manages to steal Bob's copy of Alice's product, and uses it to pack malware. Carol now needs a way to identify the malware that is packed using Bob's stolen packer. How? Introducing "taggants."
Click to expand...

http://blogs.technet.com/b/mmpc/archive/2010/10/25/standards-and-policies-on-packer-use.aspx

dw2108 · Oct 30, 2010

ronjor, I SWEAR, Alice DID IT!

Dave

Log in or Sign up

Standards and Policies on Packer Use

ronjor Global Moderator

dw2108 Registered Member

Members

Useful Searches