Re: Re: Question about Viruses

[Drsolly <drsollyp () drsolly com>]

> > What's an "EPO"?
>
> EPO - Entry Point Obfuscator -- is a virus which doesn't directly modify 
> the entrypoint or code at the entrypoint, but rather performs some 
> modification elsewhere in the code (like, repacing random "call" 
> instruction in the code section by a call to itself). While this decreases 
> its chances of being executed (it might insert itself into rarely or never 
> used execution path), it's also pretty efficient as an anti-AV measure.

Oh, those. Yes, detection is trickier. I took the view (true at the time) 
that these were sufficiently rare (and not in-the-wild) that I needn't do 
the work needed to do a clean, I'd only offer the delete option.
 
> Thus, the infections by two different EPO's can actually commute (in the 
> sense of the file being infected by Vir1 and Vir2 can result in exactly 
> the same file as if the file was infected by Vir2 and Vir1 in that order). 
> In fact, the "infection-graph" of a program can no longer be assumed to be 
> linear (as it used to be in the good old times with just simple infectors 
> around) and it can (theoretically, practical samples of this kind have not 
> been observed) be arbitrarily complex DAG (directed acyclic graph).

There's a danger in devising an arbitrarily complex situation, and trying 
to do something about it - you can wind up with a product that's too 
complex, without any benefit to the users because the complex situation 
hasn't actually happened.
 
> Yes, exactly. That's one of the reasons why the number of "detected 
> viruses" (= the number of different virus names that an AV can report) or 
> number of used signatures cannot be used as any kind of metric of quality 
> of the AV.
 
Good grief. You mean, there's people think it can? I know that when I was 
active in this area, most AV's couldn't actually tell the difference 
between the variants of a virus, because they weren't doing exact 
identification. So they actually had no way of knowing how many they 
detected.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.