Full Disclosure mailing list archives
Re: A worm...
From: Brett Hutley <brett () hutley net>
Date: Fri, 27 Jun 2003 11:46:28 +1000
At approximately 'Thu, Jun 26, 2003 at 07:37:12PM -0500' 'M. Osten' warbled:
On Thu, 2003-06-26 at 10:14, ATD wrote:Yes, And this was my point. Are the crafty "worm gods" creating worms that evade detection by using compression and other methods? If they are doing this, and if they are creating the "stealth worms" whats next. Zip files would be just one of hundreds of ways to hide worms. Maybe the virus scanning technology needs to be kicked up a notch or two.Do most virus scanners *not* scan compressed files? We scan all incoming mail using Amavis (on linux) with the NAI engine which does scanning of all the common compression schemes.
Most virus scanners I believe DO scan compressed files. Worm gods use techniques like code morphing to make it harder to detect the worm rather than compression. Note that true worms propogate WITHOUT user intervention, so I think you are talking more about email viruses here. Worms that propogate without user intervention normally have defined attack vectors/exploits, and can be detected/screened by IDS/Firewall. -- Brett Hutley [M.App.Fin., CISSP, SANS GCIH] mailto:brett () hutley net | "My other computer is ALSO a *nux box" http://hutley.net/brett | PGPkey:http://hutley.net/brett/pupkey.txt _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: A worm..., (continued)
- Re: A worm... ATD (Jun 26)
- RE: A worm... Richard M. Smith (Jun 26)
- RE: A worm... Ron DuFresne (Jun 26)
- Re: A worm... Roy S. Rapoport (Jun 26)
- Re: A worm... morning_wood (Jun 26)
- SV: A worm... Peter Kruse (Jun 26)
- Re: A worm... ATD (Jun 26)
- RE: A worm... ATD (Jun 26)
- RE: A worm... M. Osten (Jun 26)
- Re: A worm... Brett Hutley (Jun 26)
- RE: A worm... Nick FitzGerald (Jun 26)
- Re: A worm... morning_wood (Jun 26)
- RE: A worm... ATD (Jun 26)