Endpoint Protection

 View Only

  • 1.  Symantec please fix this: Easily Bypassing Antivirus Detection

    Posted Jun 03, 2010 01:58 PM
    This might be of interest.

    http://www.room362.com/blog/2010/6/2/av-bypass-made-stupid.html


  • 2.  RE: Symantec please fix this: Easily Bypassing Antivirus Detection

    Posted Jun 03, 2010 02:05 PM

    Have you tested this against SEP 11? I have forwarded this on to Security Response.

    Thomas


  • 3.  RE: Symantec please fix this: Easily Bypassing Antivirus Detection

    Posted Jun 03, 2010 04:19 PM

    I have not, but the author is reachable via the provided link.


  • 4.  RE: Symantec please fix this: Easily Bypassing Antivirus Detection

    Posted Jun 04, 2010 12:20 AM
    The new exe has a different fingerprint and this can be accomplished lots of different ways.

    Thats why you have Truscan, PTP, IPS etc.
    If the new exe is distributed widely enough it will end up in the normal signatures and be detected.

    Z




  • 5.  RE: Symantec please fix this: Easily Bypassing Antivirus Detection

    Posted Jun 05, 2010 09:43 PM
    What zero said is right, you can even test by checking the MD5's yourself. This is part of the reason why all the AV's have trouble with zero day threats. However any good AV will catch it through heuristic detection. Yet another reason why old AV's are not capable of protection against current threats.

    Grant-