RE: Vulnerability-based IPS Patent

[Nick FitzGerald <nick () virus-l demon co uk>]

Richard M. Smith to me:

> So did these TSR scanners look at files after they were stored on disk or
> while the files were coming through DOS before being stored on disk?  The
> latter approach is required to be prior art for the patent.

I think "after being stored on disk BUT before the file was finally 
closed" would also count as prior art, as at that point you can prevent 
the file ever being properly utilized by deleting it or otherwise 
preventing further access to it.

Precisely how Alan's, Roger's, or others' TSR scanners worked in these 
regards will have to be answered by them...

But you raise an interesting issue -- would an Email virus scanner 
(say) necessarily be in breach of the Hilgraeve patent?

Most seem to have assumed that the answer is "yes".

If the AV worked by employing an initial receipt queue, processing 
message streams that had been entirely written to file in that queue, 
then deciding whether to continue processing them through the next 
delivery queue or not, based on their virality, they might be able to 
be written in such a way that the AV is not "automatically inhibiting 
the screened digital data from being stored on said destination storage 
medium if at least one predefined sequence is present" (depending on 
your definition (missing in the Hilgraeve patent?) of "destination 
storage medium").


Regards,

Nick FitzGerald

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.