Full Disclosure mailing list archives
Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV]
From: bipin gautam <visitbipin () yahoo com>
Date: Sat, 2 Oct 2004 06:02:24 -0700 (PDT)
--- 3APA3A <3APA3A () SECURITY NNOV RU> wrote:
Dear bipin gautam, Your statements about "all antivirus" and "design fault" are wrong, it's strongly depend on the way manual scanning is implemented in specific product. 1. many antiviral products implement their own kernel driver to access scanned file. For this case permissions have no impact for scanning.
hello 3APA3A, Ok ya... i already mentioned the fact, If the scanner is unable to drop the privilege and run under the security content of "dumb_user" the malicious code goes undetected. Correct me if i am wrong, but.... mostly (full-)system "manual scan" is executed as a administrative job......... and i've already mentioned the fact, its MORE* a NTFS file permission problem. http://www.geocities.com/visitbipin/all.html IF A FILE PERMISSION IS SET IN A WAY... only THE OWNER OF THE FILE HAS ACCESS TO THAT FILE, Even softwares running with ADMINISTRATIVE or SYSTEM privilage don't have access to the file, normally!!!!!!!!! Really strange, cauz root should have atlest read access to any file in the system regardless of the permission. Atlest, most trojan, spyware scanner gets executed as a admin. or system process. Regarding your statement,
antiviral products implement their own kernel driver to access scanned file.
I tested on norton av 2003 and few spyware product "the cleaner" "Ad-aware" and by this way....... a trojan bypassed the protection. Guys, please confirm this issue then.... i ain't in a research lab, just using my home PC. i'll test the issue with mcafee and be back with the results
You still can bypass antiviral protection for manual scans with file encryption (on-access scanners may impersonate accessing user). This time file can only be scanned by administrator if administrator is recovery agent.
wow, i didn't thought of this..... bipin _______________________________ Do you Yahoo!? Declare Yourself - Register online to vote today! http://vote.yahoo.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 01)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] GuidoZ (Oct 01)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] GuidoZ (Oct 01)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 01)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 01)
- <Possible follow-ups>
- All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 01)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] 3APA3A (Oct 02)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 02)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 02)
- Re: (confirm) Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 02)
- Re: (confirm) Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 02)
- Re[2]: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] 3APA3A (Oct 02)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] bipin gautam (Oct 02)
- Re[2]: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] 3APA3A (Oct 03)
- Re[2]: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] Kolja Powischer (Oct 04)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] 3APA3A (Oct 02)
- Re: All Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bugs. [Part IV] GuidoZ (Oct 01)