[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Re: Let's have fun with EICAR test file
From:       "Kurt Seifried" <bt () seifried ! org>
Date:       2003-06-27 21:01:14
[Download RAW message or body]

>- - Detection of known viruses variants using only signatures has its
limits.
>- - Obviously, there are as many algorithms as there are AVs. But no one
>can claim the absolute truth.
>- - Emulation isn't always used or inneficient.
>- - Even with known viruses, AVs aren't absolutely reliable; just modify
>a few bytes and they are blind.
>- - In case of true harmful code, heuristics are aware. But there are some
>breachs...
>- - Signatures aren't always optimal.
>- - AVs have weird behaviors: often it's all or nothing, a good
identification
>or... the void. Above all, why not a common naming for viruses?
>- - Viruses research is a hard topic, whether it is for known or unknown
>viruses.
>- - Is RAV a good choice for Microsoft (don't kick my head!)?

These reccomendations and the test are largely meaningless. For all we know
some of the AV vendors look for that exact string, i.e. have a very
simplistic detection method. Had these tests actually been done using a
"real" virus (say one of the more recent mass mailers like klez or sobig)
they might be meaningful. Now I'm not saying AV products are perfect, who
knows maybe the NOP/JMP tricks will work with "real" viruses, but I wouldn't
assume so until actually tested.

In any event most AV is a reactive solution, bound to fail at some point
because of the time delay between virus in the wild and installaiton of
signature on user's platform.

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/


[prev in list] [next in list] [prev in thread] [next in thread]