Re: Texas Bank Dumps Antivirus for Whitelisting

["Richard M. Smith" <rms () computerbytesman com>]

Digitally signed malware is easy to spot of course. ;-)  However a whitelist
should only contain trusted vendors.  Accepting any digital signed piece of
software isn't a good idea.

Richard

-----Original Message-----
From: Alex Eckelberry [mailto:AlexE () sunbelt-software com] 
Sent: Tuesday, July 22, 2008 10:10 AM
To: Florian Weimer
Cc: Richard M. Smith; funsec
Subject: RE: [funsec] Texas Bank Dumps Antivirus for Whitelisting

* Florian Weimer: 

> You should insist on AuthentiCode signatures from your vendors.  
> After that, you only need to maintain a list of vendors.

I've seen a fair amount of malware that is digitally signed.  I just
don't buy the AuthentiCode argument. 

Alex

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.