Tuesday, May 11, 2010

“New malware attack laughs at your antivirus software” plus 3 more

“New malware attack laughs at your antivirus software” plus 3 more

New malware attack laughs at your antivirus software

Posted: 10 May 2010 05:40 PM PDT

Rogue antivirus "biggest threat" facing Canadian PCs

Posted: 11 May 2010 03:04 AM PDT

All your Windows antivirus are belong to us

Posted: 10 May 2010 02:46 PM PDT

A group of computer-security researchers may have just made all of your Windows antivirus software obsolete.

Matousec.com issued an advisory last week that chronicles a process by which malware could circumvent just about every security product out there. We're talking McAfee, Norton, BitDefender ... the works.

The researchers devised a mock-up piece of malicious software that morphs itself at exactly the right time. Just after an antivirus program scans an excerpt of code, the malware can swap that benign code for malicious code before it's executed.

It's being called an "argument-switch attack." From a good description by The Register:

The exploit has to be timed just right so the benign code isn't switched too soon or too late. But for systems running on multicore processors, matousec's "argument-switch" attack is fairly reliable because one thread is often unable to keep track of other simultaneously running threads. As a result, the vast majority of malware protection offered for Windows PCs can be tricked into allowing malicious code that under normal conditions would be blocked. ...

Still, the exploit has its limitations. It requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC.

The argument-switch attack exploits the System Service Descriptor Table (SSDT) used by antivirus software – well, any software – which provides a "hook" to the Windows kernel. If you're technical enough for know what that means, there's plenty of more in-depth information in a report by Matousec.

"The research was done on Windows XP Service Pack 3 and Windows Vista Service Pack 1 on 32-bit hardware," the report states. "However, it is valid for all Windows versions including Windows 7. Even the 64-bit platform is not a limitation for the attack."

Lucian Constantin, of Softpedia, notes on a company blog that the underlying vulnerability has been known for years. And there have been no widespread exploits using the tactic.

"On the other hand, it is also true that multi-core processors, which drastically increase the success rate of this attack, have since become widespread in desktop computers," Constantin wrote. "Nevertheless, from information we received in confidence, some antivirus vendors were already planning to stop using SSDT hooks in the next version of their products, since before this research came out."

So, maybe we'll all be safe. I guess we'll see how the security companies play this one.

Via The Houston Chronicle

Five Filters featured article: The Art of Looking Prime Ministerial - The 2010 UK General Election. Available tools: PDF Newspaper, Full Text RSS, Term Extraction.

McAfee Antivirus Free Download

Posted: 10 May 2010 07:00 AM PDT

The latest version of eth McAfee antivirus has been released and people are going crazy on the internet trying to find a free copy to download. The evidence is the McAfee Antivirus Free Download search word that's topping the list.

Well it is fairly easy to actually find a free copy to download, because there are dozens of working and active torrents out there that could help achieve the task. Although it's going to be absolutely illegal and a complete act of software piracy, torrents are not deemed illegal, so why not use them.

Downloading the McAfee VirusScan® 2010 is easy, but I wouldn't recommend it. The reason is that McAfee's latest version doesn't contain improvements that eradicate the very factors that made McAfee a crappy antivirus for desktop PCs. I'm not saying that the antivirus is overall crappy; it's just not suitable for desktops. Maybe on servers or high end mainframes it could prove to be an exceptionally smart choice, but on desktop PCs it slows the computer down to such an extent that's just not worth downloading the antivirus. On top of that it still comes with the same flaws that made it the most dangerous antivirus for the OS; the sudden urge to delete an important system file every now and then, on suspicion of a virus threat.

My advice to average desktop or laptop users is to get a light antivirus like Nod or AVG or Avast. And if you have a huge security problem and need a big antivirus then get Norton, because the latest release of Norton is ten times faster than McAfee.

McAfee

McAfee

Five Filters featured article: The Art of Looking Prime Ministerial - The 2010 UK General Election. Available tools: PDF Newspaper, Full Text RSS, Term Extraction.
Posted by at

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)