Incidents
Possible Mail server compromise ? Feb 04 2008 06:28PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 12 2008 11:41PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 18 2008 07:19PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:43AM
Eduardo Tongson (propolice gmail com) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 07:33PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 02:38AM
Eduardo Tongson (propolice gmail com)
Re: Possible Mail server compromise ? Feb 19 2008 05:35PM
Bob Toxen (vger verysecurelinux com) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:14AM
Jon Oberheide (jon oberheide org) (1 replies)
Bob,

On Tue, 2008-02-19 at 12:35 -0500, Bob Toxen wrote:
> On Mon, Feb 18, 2008 at 08:19:41PM +0100, Faas M. Mathiasen wrote:
> > Dear All,
> > Since I got a storm of e-mail to my last post, I'd like to summarise
> > some of them
> > and have something more structured:
>
> > Jon Oberheide send me some impressive statistics with regards of
> > vulnerabilities within AV Software, interesting enough most of them
> > are remotely exploitable :O
> Most? I would expect most to offer patches quickly.

In the context of Faas' mail server, most are remotely exploitable as
they can be triggered by the attachments of remote unsolicited emails.

> > "Protects your company from malware threats (Worms, Virus, Trojans..),
> > aps-AV reuses your existing Anti-Virus software and supports multiple
> > Anti-Virus engines. aps-AV increases the malware detection rate
> > through the diversity and heuristics of these multiple engines.
> > However unlike the competition, aps-AV does not increase the remotely
> > exploitable attack surface."
> That sounds like "snake oil". The more code (i.e., adding their
> product) the greater the "remotely exploitable attack surface".

False, it's simple privilege separation. By separating the acquisition
of candidate files from the actual analysis of them, you significantly
reduce the attack surface as you've introduced an isolation barrier
between the host requesting analysis of a file and the host that is
actually performing the analysis.

I'm not sure how n.runs implements their system, but our system uses Xen
VMs for the detection engines. When it is determined that a piece of
malware has exploited the AV software (through non-whitelisted process
spawning, any network activity, or other unexpected system behavior),
the VM is simply trashed and restored from a clean snapshot. This
isolation and disposal mechanism effectively eliminates the risk of
using vulnerability-ridden antivirus engines.

> > Is anybody using that system ?
> I hope not.

Hmm?

Regards,
Jon Oberheide

--
Jon Oberheide <jon (at) oberheide (dot) org [email concealed]>
GnuPG Key: 1024D/F47C17FE
Fingerprint: B716 DA66 8173 6EDD 28F6 F184 5842 1C89 F47C 17FE
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBHu40WWEIcifR8F/4RAmjEAKDjBYUF7Eve4atbRlMOzvonBkTfBgCeMCB/
v7ztO7lrZhcOjl9AyR7Lrp0=
=UVFB
-----END PGP SIGNATURE-----

[ reply ]
Re: Possible Mail server compromise ? Feb 20 2008 05:11PM
Valdis Kletnieks vt edu (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 07:25PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 11:07PM
Peter Kosinar (goober ksp sk) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 10:49AM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
RE: Possible Mail server compromise ? Feb 22 2008 12:38AM
Richard C Lewis (chad mr-lew com) (1 replies)
Re: Possible Mail server compromise ? Feb 26 2008 04:19PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 19 2008 06:46PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (3 replies)
Re: Possible Mail server compromise ? Feb 20 2008 02:48PM
Eygene Ryabinkin (rea-sec codelabs ru) (2 replies)
Re: Possible Mail server compromise ? Feb 20 2008 10:59PM
Valdis Kletnieks vt edu (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 10:31AM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 21 2008 05:13PM
Paul Schmehl (pauls utdallas edu)
Re: Possible Mail server compromise ? Feb 20 2008 07:10PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 20 2008 07:05AM
Bob Toxen (vger VerySecureLinux com) (1 replies)
Re: Possible Mail server compromise ? Feb 20 2008 07:25PM
Faas M. Mathiasen (faas m mathiasen googlemail com)
Re: Possible Mail server compromise ? Feb 20 2008 01:51AM
Valdis Kletnieks vt edu
Re: Possible Mail server compromise ? Feb 13 2008 09:55AM
Michael Loftis (mloftis wgops com)
Re: Possible Mail server compromise ? Feb 13 2008 05:09AM
Jon Oberheide (jon oberheide org)
Re: Possible Mail server compromise ? Feb 04 2008 07:05PM
Jon R. Kibler (Jon Kibler aset com) (1 replies)
Re: Possible Mail server compromise ? Feb 04 2008 09:39PM
Tony Maupin (tony themaupins com) (1 replies)
Re: Possible Mail server compromise ? Feb 04 2008 09:57PM
Faas M. Mathiasen (faas m mathiasen googlemail com) (1 replies)
Re: Possible Mail server compromise ? Feb 05 2008 05:49PM
Valdis Kletnieks vt edu
RE: Possible Mail server compromise ? Feb 04 2008 06:58PM
Worrell, Brian (BWorrell isdh IN gov)


 

Privacy Statement
Copyright 2010, SecurityFocus