Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
RE: [Full-Disclosure] Multiple AV Vendors ignoring tar.gz archives
From: Barrie Dempster (barriereboot-robot.net)
Date: Tue Feb 08 2005 - 04:12:22 CST
On Tue, 2005-02-08 at 11:26 +1300, Nick FitzGerald wrote:
> Stuart Fox to me:
> > Isn't this similar to what MS do in Windows 2003/XP SP2 with Software
> > Restriction Policies? Executables are only allowed to run provided they
> > fit a prespecified pattern i.e. name (not very useful), signed or not,
> > hash of the executable.
> Yes, but it has to be much more thoroughly implemented.
Absolutely, There are a few minor implementations of this but it's
something that directory and management systems could incorporate. As
most OS's have an "executable permission", it would be an idea to have
software thats not in the white-list renderred incapable of having this
permission, combined with scan on execute to ensure that the any
software that previously has the permissions doesn't execute.
This isn't an entirely new idea, but it is one that isn't very well
implemented at this stage as noted. ( Gap in the market for any startups
reading the list :-P )
Barrie Dempster (zeedo) - Fortiter et Strenue
[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.