AntiVirus Products Fail to Find Simple IE Malware 190
SkiifGeek writes "Didier Stevens recently took a closer look at some Internet Explorer malware that he had uncovered and found that most antivirus products that it was tested against failed to identify the malware through one of the most basic and straight forward obfuscation techniques — the null-byte. With enough null-bytes between each character of code, it is possible to fool all antivirus products (though additional software will trap it), yet Internet Explorer was quite happy to render the code. Whose responsibility is it to fix this behavior? Both the antivirus / anti-malware companies and Microsoft's IE team have something to answer for."
It's 2005 again! (Score:3, Informative)
Duh. (Score:5, Informative)
Java is a good example of this. Java doesn't interpret crap. It is what it is, and it doesn't give a crap if it works or not. It's strongly typed, it's picky as hell about variable initialization...It's a bitchy language for newbies, because it's unforgiving of the most meek typos.
I don't think java is the end all be all...It's certainly not friendly to develop in, and that's given scripting languages (hello php) a huge advantage in the marketplace...Much the same as with unix and microsoft, so it's not surprising to see them continuing down their path.
But in the end, you've got to embrace some maturity and stop bottlefeeding your developers and make them fix their damn code when it doesn't conform to a normal standard.
Re:Best AntiVirus Product out there (Score:2, Informative)
Browsers are far too forgiving (Score:5, Informative)
Browsers are incredibly forgiving of bad HTML. Worse, the definition of "acceptable HTML" is undocumented, both for IE and Firefox. We discovered this writing Sitetruth [sitetruth.com]'s parser. We started out with BeautifulSoup [crummy.com], which is supposed to be a "forgiving" HTML parser. By browser standards, it's not; we had to make some improvements. Here are some things that show up in real-world HTML:
Part of the reason for the growth in bad HTML is that Adobe seems incapable of making a version of Dreamweaver that consistently generates correct HTML for anything later than HTML 3.2. (Create a moderately complex page in Dreamweaver 8 in HTML 4.x or XHTML mode, and run it through a validator. It will fail.) If the best tools can't get it right, why should anybody else?
Since real world HTML parsing is ambiguous, and bad HTML is widespread, differences between browser parsers and other tools can be exploited as security holes.
Re:As much as I hate Microsoft... (Score:3, Informative)
Seeing a well designed ActiveX application does two things: One, it makes you say, "Wow, that's kinda cool..." and then it makes you say, "Jesus, I've got to turn this off!" It really does connect your browser to your OS...Use the new OWA [wikipedia.org] app with IE with ActiveX allowed, and it'll hook right into your desktop and give you little popups whenever you get new mail.
That kind of access to the system allows you to do some cool stuff, but it's not well secured, and it makes it possible for a click to a webpage to completely compromise your system.
Re:Disabling Script? (Score:3, Informative)