Security Incidents mailing list archives
Re: Possible Mail server compromise ?
From: Jon Oberheide <jon () oberheide org>
Date: Tue, 19 Feb 2008 21:14:46 -0500
Bob, On Tue, 2008-02-19 at 12:35 -0500, Bob Toxen wrote:
On Mon, Feb 18, 2008 at 08:19:41PM +0100, Faas M. Mathiasen wrote:Dear All, Since I got a storm of e-mail to my last post, I'd like to summarise some of them and have something more structured:Jon Oberheide send me some impressive statistics with regards of vulnerabilities within AV Software, interesting enough most of them are remotely exploitable :OMost? I would expect most to offer patches quickly.
In the context of Faas' mail server, most are remotely exploitable as they can be triggered by the attachments of remote unsolicited emails.
"Protects your company from malware threats (Worms, Virus, Trojans..), aps-AV reuses your existing Anti-Virus software and supports multiple Anti-Virus engines. aps-AV increases the malware detection rate through the diversity and heuristics of these multiple engines. However unlike the competition, aps-AV does not increase the remotely exploitable attack surface."That sounds like "snake oil". The more code (i.e., adding their product) the greater the "remotely exploitable attack surface".
False, it's simple privilege separation. By separating the acquisition of candidate files from the actual analysis of them, you significantly reduce the attack surface as you've introduced an isolation barrier between the host requesting analysis of a file and the host that is actually performing the analysis. I'm not sure how n.runs implements their system, but our system uses Xen VMs for the detection engines. When it is determined that a piece of malware has exploited the AV software (through non-whitelisted process spawning, any network activity, or other unexpected system behavior), the VM is simply trashed and restored from a clean snapshot. This isolation and disposal mechanism effectively eliminates the risk of using vulnerability-ridden antivirus engines.
Is anybody using that system ?I hope not.
Hmm? Regards, Jon Oberheide -- Jon Oberheide <jon () oberheide org> GnuPG Key: 1024D/F47C17FE Fingerprint: B716 DA66 8173 6EDD 28F6 F184 5842 1C89 F47C 17FE
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: Possible Mail server compromise ?, (continued)
- Re: Possible Mail server compromise ? Bob Toxen (Feb 19)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 19)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 20)
- Re: Possible Mail server compromise ? Bob Toxen (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Eygene Ryabinkin (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 21)
- Re: Possible Mail server compromise ? Paul Schmehl (Feb 21)
- Re: Possible Mail server compromise ? Jon Oberheide (Feb 20)
- Re: Possible Mail server compromise ? Valdis . Kletnieks (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Peter Kosinar (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 21)
- RE: Possible Mail server compromise ? Richard C Lewis (Feb 22)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 26)
- Re: Possible Mail server compromise ? Eduardo Tongson (Feb 20)
- Re: Possible Mail server compromise ? Faas M. Mathiasen (Feb 20)
- Re: Possible Mail server compromise ? Eduardo Tongson (Feb 21)