Re: eSafe: Could this be exploited?

[Nick FitzGerald <nick () virus-l demon co uk>]

Kev Ford wrote:

> Just an idle thought, but what about scripting? Would it be possible to 
> get some simple scripts through simply by making a large portion of the 
> end of the message useless comment fields? Maybe even a worm that 
> rewrites this 'noise' every time to make a moving target?

Yep, but it need not even be that deliberate.

Windows VBS with its ever so forgiving "resume next" "error handler", 
and some other "resilient" scripting languages (such as mIRC script), 
means that even some badly truncated malware can be executed 
"successfully", so long as the "important" part(s) of its functionality 
are nearer the beginning of the script code than the end.  Scripts in 
such languages that get rogered through partial transmission (this was 
very common with early mIRC script viruses) can keep on going in their 
new, truncated forms until they finally get chopped before the minimal 
code point that makes them replicative.

And yes, we have seen this happen in the wild many times already.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854