Full Disclosure mailing list archives
RE: RE: when will AV vendors fix this???
From: "Thomas D." <whistl0r () googlemail com>
Date: Mon, 7 Aug 2006 22:45:10 +0200
-----Original Message----- From: Dude VanWinkle Sent: Monday, August 07, 2006 8:49 PMSo I might be able hide something, but I can't do anything.Well, there would be an access denied message for most AV scanners when it hit the file in question and couldnt even get a read.
As I said before: 1.) An attacker has to transfer a bad file. Every One-Access Scanner should detected the threat, if it is known (if it is unknown, it is a zero-day attack...) 2.) If you have transfered the file (as I said before: This isn't easy...), you can only hide the file, because, If you run it, it will be detected. If it won't be detected, it is an unknown file, so it is a zero-day attack... And even if you hide the file, if it hide the way you describe, you aren't able to execute the file, until you give access to yourself. If you do this, the anti-virus program will also have access.... Keep in mind: If it is an unknown file (zero-day), you don't even think about hiding, because it isn't necessary. You have other problems... => I don't think it is a security related problem nor a problem itself. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- when will AV vendors fix this??? Bipin Gautam (Aug 05)
- Re: when will AV vendors fix this??? Denis Jedig (Aug 05)
- Re: Re: when will AV vendors fix this??? <...> (Aug 06)
- Re: when will AV vendors fix this??? Marius Huse Jacobsen (Aug 07)
- Re: when will AV vendors fix this??? Bryan (Aug 07)
- RE: when will AV vendors fix this??? Thomas D. (Aug 07)
- Re: RE: when will AV vendors fix this??? Dude VanWinkle (Aug 07)
- RE: RE: when will AV vendors fix this??? Thomas D. (Aug 07)
- RE: RE: when will AV vendors fix this??? Dmitry Yu. Bolkhovityanov (Aug 11)
- Re: RE: when will AV vendors fix this??? Paul Schmehl (Aug 14)
- Re: RE: when will AV vendors fix this??? Bipin Gautam (Aug 15)
- Re: RE: when will AV vendors fix this??? Dude VanWinkle (Aug 07)
- Re: when will AV vendors fix this??? Denis Jedig (Aug 05)
- Re: when will AV vendors fix this??? Bipin Gautam (Aug 07)
- <Possible follow-ups>
- Re: Re: when will AV vendors fix this??? hatless (Aug 06)
- Re: when will AV vendors fix this??? Andreas Marx (Aug 14)