Friday, November 4, 2005

Virus scanners made moot

Recently, researcher Andrey Bayora revealed that it is possible to <A HREF="http://www.security.ithub.com/article/Virus+Scanners+Made+Moot+by+New+Exploit/164278_1.aspx?kc=ewnws110305dtx1k0000599">fool antivirus scanners</A> into thinking that a file under scan is one kind, when it is in actuality something entirely different. The exploit prepends a header byte that convinces the scanner the file is not the type the suffix averred it was. Because routine prepended data can be of variable length it is extremely difficult (or impossible) to locate the original start offset of a file. It would seem the only way out of this is to scan the entire file for headers, which would greatly decrease the throughput of the virus scanner. There seems to be no workaround, save a total redesign of how scanning engines work.

News Timeline



From Our Sponsor