Re: A worm...

[Brett Hutley <brett () hutley net>]

At approximately 'Thu, Jun 26, 2003 at 07:37:12PM -0500' 'M. Osten' warbled:
> On Thu, 2003-06-26 at 10:14, ATD wrote:
> > Yes, 
> >     And this was my point. Are the crafty "worm gods" creating worms that
> > evade detection by using compression and other methods?  If they are
> > doing this, and if they are creating the "stealth worms" whats next. Zip
> > files would be just one of hundreds of ways to hide worms. Maybe the
> > virus scanning technology needs to be kicked up a notch or two.
>
> Do most virus scanners *not* scan compressed files?  We scan all
> incoming mail using Amavis (on linux) with the NAI engine which does
> scanning of all the common compression schemes.

Most virus scanners I believe DO scan compressed files. 
Worm gods use techniques like code morphing to make it harder to detect
the worm rather than compression. Note that true worms propogate WITHOUT
user intervention, so I think you are talking more about email viruses
here. Worms that propogate without user intervention normally have 
defined attack vectors/exploits, and can be detected/screened by
IDS/Firewall.

-- 
Brett Hutley [M.App.Fin., CISSP, SANS GCIH]
mailto:brett () hutley net | "My other computer is ALSO a *nux box"
http://hutley.net/brett | PGPkey:http://hutley.net/brett/pupkey.txt
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html