>- - Detection of known viruses variants using only signatures has its limits. >- - Obviously, there are as many algorithms as there are AVs. But no one >can claim the absolute truth. >- - Emulation isn't always used or inneficient. >- - Even with known viruses, AVs aren't absolutely reliable; just modify >a few bytes and they are blind. >- - In case of true harmful code, heuristics are aware. But there are some >breachs... >- - Signatures aren't always optimal. >- - AVs have weird behaviors: often it's all or nothing, a good identification >or... the void. Above all, why not a common naming for viruses? >- - Viruses research is a hard topic, whether it is for known or unknown >viruses. >- - Is RAV a good choice for Microsoft (don't kick my head!)? These reccomendations and the test are largely meaningless. For all we know some of the AV vendors look for that exact string, i.e. have a very simplistic detection method. Had these tests actually been done using a "real" virus (say one of the more recent mass mailers like klez or sobig) they might be meaningful. Now I'm not saying AV products are perfect, who knows maybe the NOP/JMP tricks will work with "real" viruses, but I wouldn't assume so until actually tested. In any event most AV is a reactive solution, bound to fail at some point because of the time delay between virus in the wild and installaiton of signature on user's platform. Kurt Seifried, kurtat_private A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/
This archive was generated by hypermail 2b30 : Fri Jun 27 2003 - 14:11:44 PDT