Full Disclosure mailing list archives
Re: Show me the Virrii!
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Thu, 08 Jan 2004 16:06:29 +1300
"fastfood () optusnet com au" <fastfood () optusnet com au> wrote:
Antivirus Software Turned Upside Down by Jason Coombs (jasonc () science org)[...]Restricting the execution of code by a CPU to a small list of known good programs that the owner of the computer chooses to trust would basically kill the antivirus industry.[...] Cisco have a new product that does just this - Cisco Security Agent. http://www.cisco.com/en/US/products/sw/secursw/ps5057/ Thoughts, comments?
I have no direct experience with using the product, but from the various descriptions in the Cisco white-papers covering these product families it seems they use _only_ traditional system hardening and behaviour detection, analysis and blocking (or reversing) technologies. In fact, in places these papers specifically states things such as: Cisco Security Agent does not rely on, or even contain, signatures. If we accept that Cisco knows how its products work then the Security Agent products cannot include whitelisting such as Jason's code, as this is still fundamentally signature based. -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Show me the Virrii!, (continued)
- Re: Show me the Virrii! Exibar (Jan 07)
- RE: [inbox] Re: Show me the Virrii! Curt Purdy (Jan 07)
- Re: [inbox] Re: Show me the Virrii! Exibar (Jan 07)
- RE: Show me the Virrii! John . Airey (Jan 07)
- Re: Show me the Virrii! Exibar (Jan 07)
- RE: Show me the Virrii! Schmehl, Paul L (Jan 07)
- Re: Show me the Virrii! Exibar (Jan 07)
- RE: Show me the Virrii! doyle043 (Jan 07)
- RE: Show me the Virrii! Nick FitzGerald (Jan 07)
- Re: Show me the Virrii! fastfood () optusnet com au (Jan 07)
- Re: Show me the Virrii! Nick FitzGerald (Jan 07)
- Re: Show me the Virrii! Jeremiah Cornelius (Jan 07)
- RE: Show me the Virrii! VBuster (Jan 08)