Andreas Marx
18/08/06, 19:20
At 22:35 07.08.2006, Paul Schmehl wrote:
[...]
> This is similar to the problem of alternative data streams. Essentially,=
the work needed to solve this problem isn't worth the expenditure of time=
and effort, because the file, in order to infect the system, has to be ex=
ecuted. Once the file is executed "normal" on-access scanning will catch =
the exploit *if* it is known. (If it's unknown, it doesn't matter anyway.=
) Yes, on-demand scanning won't "see" the file, but even malicious files =
are benign until they are run.
[...]
No, that's not the case. On-Access scanner *might* be able to catch the ma=
lware (if it's a known variant), but it could be that the scanner is missi=
ng the file, depending on it's implementation. The same applies to the On-=
Demand scanner: it might or might not detect it, even if the *known* malwa=
re can still run on a system, as many tricks exists to get the file execut=
ed. Here are two articles showing this with ADS, including some test resul=
ts:
Dangers from the Twilight Zone | Alternate Data Streams can still be hidin=
g places for malware
Microsoft's NTFS file system supports Alternate Data Streams to store addi=
tional information about a file. Malware can lurk in such streams. Nonethe=
less, a year and a half after the first ADS test of 18 virus scanners stil=
l not all of them reliably detect malware in ADS. [...]
<http://www.heise-security.co.uk/articles/74892>
Gefahr aus der Schattenwelt, Teil 2 | Alternate Data Streams als Versteck =
f=FCr Sch=E4dlinge
Microsofts NTFS-Dateisystem unterst=FCtzt Alternate Data Streams, um zus=E4tzl=
iche Informationen zu einer Datei zu speichern. Auch Sch=E4dlinge k=F6nnen sic=
h in solchen Streams verstecken. Anderthalb Jahre nach dem ersten ADS-Test=
von 18 Virenscannern erkennen aber immer noch nicht alle Produkte Malware=
in ADS zuverl=E4ssig.
<http://www.heise.de/security/artikel/74641>
cheers,
Andreas Marx
CEO, AV-Test.org
<http://www.av-test.org>
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5 F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= 5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5 F=5F=5F=5F
XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club! =09
Jetzt gratis testen! http://freemail.web.de/home/landingpad/=3Fmc=3D021130
[...]
> This is similar to the problem of alternative data streams. Essentially,=
the work needed to solve this problem isn't worth the expenditure of time=
and effort, because the file, in order to infect the system, has to be ex=
ecuted. Once the file is executed "normal" on-access scanning will catch =
the exploit *if* it is known. (If it's unknown, it doesn't matter anyway.=
) Yes, on-demand scanning won't "see" the file, but even malicious files =
are benign until they are run.
[...]
No, that's not the case. On-Access scanner *might* be able to catch the ma=
lware (if it's a known variant), but it could be that the scanner is missi=
ng the file, depending on it's implementation. The same applies to the On-=
Demand scanner: it might or might not detect it, even if the *known* malwa=
re can still run on a system, as many tricks exists to get the file execut=
ed. Here are two articles showing this with ADS, including some test resul=
ts:
Dangers from the Twilight Zone | Alternate Data Streams can still be hidin=
g places for malware
Microsoft's NTFS file system supports Alternate Data Streams to store addi=
tional information about a file. Malware can lurk in such streams. Nonethe=
less, a year and a half after the first ADS test of 18 virus scanners stil=
l not all of them reliably detect malware in ADS. [...]
<http://www.heise-security.co.uk/articles/74892>
Gefahr aus der Schattenwelt, Teil 2 | Alternate Data Streams als Versteck =
f=FCr Sch=E4dlinge
Microsofts NTFS-Dateisystem unterst=FCtzt Alternate Data Streams, um zus=E4tzl=
iche Informationen zu einer Datei zu speichern. Auch Sch=E4dlinge k=F6nnen sic=
h in solchen Streams verstecken. Anderthalb Jahre nach dem ersten ADS-Test=
von 18 Virenscannern erkennen aber immer noch nicht alle Produkte Malware=
in ADS zuverl=E4ssig.
<http://www.heise.de/security/artikel/74641>
cheers,
Andreas Marx
CEO, AV-Test.org
<http://www.av-test.org>
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5 F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= 5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5 F=5F=5F=5F
XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club! =09
Jetzt gratis testen! http://freemail.web.de/home/landingpad/=3Fmc=3D021130