On this wonderful morning what do my eyes see? A dialog box saying the following to me: Scan type: Realtime Protection Scan Event: Virus Found! Virus name: Hacktool File: C:\Documents and Settings\kaka\Local Settings\Temporary Internet Files\Content.IE5\AVININWN\DSR-youbin[1].pl Location: Quarantine Computer: KAKA User: kaka Action taken: Clean failed : Quarantine succeeded : Access denied Date found: Thu Jul 10 08:55:43 2003 The file in question is http://kokanins.homepage.dk/DSR-youbin.pl The obvious retardedness of labelling my damn generic exploit as being a virus aside, it strikes me as 'funny' that I am still available to: Select the text in my browser, create a "new text document", paste the contents and save it to disk, and without any nagging from the puny AV-software: access the file, rename it (the "new text document") to the original filename, still access it via an editor, and even execute it via my cygwin environment. Let's turn our attention to http://kokanins.homepage.dk/rs_iis_xpl.pl The same sort of bullshit as above except "Virus name: FreeBSD.Rootkit". Uh, that's incorrect to say the least - this is no rootkit. This time the antivirus software succeeds in its mission - it quarantines the file. However, changing "$freebsd_string" to "$freelsd_string" is enough to fool the software, allowing execution of the file etc. as in the previous example. Antivirus-software is protection for people against yesterdays threats. Antivirus-software is protection for moronic users against themselves. Antivirus-software is crap. I say we kill the users and be done with it. Datfile ver. 50709f // updated today NAV ver. 7.51.847 // oh no, I am exposing Scan engine ver. 4.1.0.6 // dangerous info here -- kokaninATdtors.net _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Thu Jul 10 2003 - 02:13:23 PDT