2 ms·
>In one technique, Kaspersky's engineers would take an important piece of software commonly found in PCs and inject bad code into it so that the file looked lik
by r721 11y ago
>In one technique, Kaspersky's engineers would take an important piece of software commonly found in PCs and inject bad code into it so that the file looked like it was infected, the ex-employees said. They would send the doctored file anonymously to VirusTotal.
>Then, when competitors ran this doctored file through their virus detection engines, the file would be flagged as potentially malicious. If the doctored file looked close enough to the original, Kaspersky could fool rival companies into thinking the clean file was problematic as well.
I don't quite understand - what about hashes? VirusTotal doesn't work as they say it works.
- striking 11y agoHashes aren't the only thing that judge a file. Virus scanners today look for specific portions of files that look like malicious code, either by directly matching it or by tracing the code. Apparently some virus scanners traced too far into other parts of the executable's code, into the legitimate portions that are found as system components on computers today. It's a neat attack.
- _0ffh 11y ago> Virus scanners today look for specific portions of files that look like malicious code, either by directly matching it or by tracing the code. FYI virus scanners have been doing that for ~25 years.