> "DevilsPGD" <spam_narf_spam@crazyhat.net> wrote in message <span style="color:blue">
> news:96s7v3h0nbn9sn0per7k64c5uqkbs1r8jt@4ax.com...
> In message <#NQ9n$FlIHA.1164@TK2MSFTNGP02.phx.gbl> "FromTheRafters"
> <Erratic@ne.rr.com> wrote:
><span style="color:green">
>>Many blended threat worms of the recent past have used real virus
>>code. The point is that an infected file is likely to be executed by the
>>system or the user just as it would have had it not been infected.</span>
>
> They do?</span>
Yes, here's a recent example.
http://www.trendmicro.com/VINFO/virusencyc...AGIPEF%2ECE%2DO
<span style="color:blue">
> Virtually everything I've run into falls into the one of two categories:
>
> 1) Trojan, being a piece of software which appears to perform a certain
> action but in fact performs another.
>
> 2) Worms, being self-replicating computer programs spreading more or
> less without user intervention across a network.</span>
Too bad these things can't be so easily pigeonholed. This
is why "blended threat" is so often used to describe them.
<span style="color:blue">
> I haven't seen one in many years that played the original virus trick of
> actually modifying existing EXEs and waiting for the user to shuffle
> those EXEs off to another PC somehow.</span>
It is not required of viruses to seek out or inhabit new devices - that
is worm behavior, however you can see how backups may become
involved if infected files are backed up and then the computer is cleaned.
You may not back up worm files, but you might back up virally infected
files which also contain the worm code.
<span style="color:blue">
> With USB drives capacity
> increasing, and portable software becoming more popular, we may well see
> the return of real viruses in the near future, but I can't think of one
> that has had a major impact in many moons.</span>
Mostly because the viral impact is overshadowed by the worm
and other malicious code's impact. The infection of files may be
just in order to "rise from the dead" after one removes an active
worm from a system.
<span style="color:blue">
> Now, that being said, a fair amount of malware is polymorphic in one
> form or another.</span>
True, but irrelevent.
<span style="color:blue"><span style="color:green">
>>It is real easy to say "just don't do it" and believe it is that simple.
>>I just wanted to point out that that is a naive attitude.</span>
>
> Perhaps somewhat naive, but the reality of it is that if you practice
> minimal safe computing techniques, specifically, staying behind an
> inbound packet filtering (Windows Firewall or NAT tend to do the job)
> and don't install or run anything offered to you unsolicited, only
> install software either from reputable companies or that you have
> researched, plus stay up to date with Windows and application patches,
> you'll be safe.</span>
Fairly safe - yes.
Absolutely safe - no.
Reputable sources can still unknowingly offer "infected" programs.
You still will need AV to scan incoming programs before execution.
<span style="color:blue">
> AV software tends to be far too slow to keep up with threats -- I've
> been in the mail server business for many years now, my own server scans
> each and every inbound message with three different engines, and still
> we see malware sneaking through that, if rescanned 24 hours later, gets
> caught. I wouldn't suggest to users that they rely on AV software, it
> simply isn't up for the task.</span>
This lag time between the onset of a threat and the response by
way of detection definitions being implemented is the achilles
heel of the AV service. That is why the recent malware is mostly
aimed to exploit this instead of using the older viral techniques.
Without AV it would quickly become much worse.
<span style="color:blue">
> There is also a fairly new class of worm, specifically attacking
> vulnerabilities in AV software, often in the form of buffer overruns in
> parsers -- So in some cases you're actually more vulnerable with AV
> software installed then without.</span>
True, but these flaws in software are inevitable for all program
types. The key is that they are addressed quickly when discovered.
The reputable AV companies are really good about this.
<span style="color:blue">
> While this isn't a new concept as a
> whole, malware exploiting this type of vulnerability automatically is
> relatively new.</span>
IIRC most of these were related to the routines used by the AV to
unpack, unzip, melt, or otherwise translate data to code to scanning
purposes. I never thought that that was a good idea for AV to do.
The user should have some responsibility for his own protection.
Then it seems that the Java system translated zipped files into code
and executed it without the user in the loop - in my eyes this feature
necessitated the scanning within archives feature. So the scanner
program essentially became an internet facing receiver of foreign
code that even unzipped and executed the malware it was trying
to protect you from.
I actually laughed when I first heard about this - the irony of it all.
<span style="color:blue">
> I can tell you that when I was in school, I absolutely loved McAfee, all
> you had to do was get a file called "program.exe" into the search path
> of the client-side component, then launch an AV scan and it would launch
> said program.exe executable from the service-side scanning component
> which ran with administrative privileges. Quick and easy promotion to
> full administrative rights, what could be better?</span>
Spoken like a true hacker. style_emoticons/D
