[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Antivirus detection after malware execution
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Antivirus detection after malware execution
- From: jason@xxxxxxxxx
- Date: Mon, 18 Oct 2010 14:27:46 -0600
The purpose of this writeup is to detail the execution of malicious code via a
protocol handler (hcp) prior to being detected by Anti-Virus Technology. It
should be noted that detection does occur by AV however only after the code is
executed and placed into memory.
Using this technique, an attacker can effectively bypass the protections of
AntiVirus technology. Being able to bypass AntiVirus technology allows an
attacker to drop and execute known malicious files (Zeus for example).
The exploit used to trigger this behavior is CVE-2010-1885 (HelpCenter)
released by Tavis Ormandy. While this exploit is used, this is NOT a rehash of
the Microsoft Helpcenter Exploit. The purpose of this write up is to walk
though the discovery and document the method used to effectively bypass
AntiVirus and execute a malicious payload on a victims machine.
http://www.n00bz.net/antivirus-cve
CVE-2010-3496- McAfee
CVE-2010-3497- Symantec/Norton
CVE-2010-3498- AVG
CVE-2010-3499- F-Secure