4 ms·

I think I read about this a long time ago where it was thought that this could be used to potentially bypass anti-virus checks

kuroguro 6y ago
To be fair something as simple as adding a self-signed cert bypasses more AVs than it should. It would work as long as it doesn't become popular. Very few people would put in as much effort as long as there are easier ways around.
gus_massa 6y ago
I think antivirus would be fine. There is a test file by EICAR https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file . It's also 100% text, but it's and ".com" instead of a ".exe" so the internal structure is easier. And more importantly, it use self-modifying code to modify an instruction and run a non printable instruction, that is somewhat cheating.
- dale_glass 6y ago
  Why cheating? I don't think complying with any kind of "fairness" was ever the point. EICAR was created to fulfill a need to test antiviruses with some additional requirements, and how exactly it achieved it wasn't really important. I'm not sure if anybody ever described the official design goals for it, but based on some previous reading it seems that being able to type it on a keyboard was a requirement. I'm guessing this is because the kind of environment in which one experiments with viruses and their detection, it's desirable to maintain physical separation, and so using any kind of media or requiring a network connection would create danger. Or perhaps they also wanted it to be suitable for testing locked down environments where a more convenient way of introducing the test would have already been removed.
  - gus_massa 6y ago
    The part about cheating was tongue in check, self modifying code makes writing printable executables easier. An excuse to avoid it is that some operative system are trying to enforce W^X, so executable code can't be modified. (But I think the real reason is that he wanted the harder challenge.)

kuroguro 6y ago

To be fair something as simple as adding a self-signed cert bypasses more AVs than it should. It would work as long as it doesn't become popular. Very few people would put in as much effort as long as there are easier ways around.

gus_massa 6y ago

I think antivirus would be fine. There is a test file by EICAR https://en.wikipedia.org/wiki/EICAR_test_file https://en.wikipedia.org/wiki/EICAR_test_file . It's also 100% text, but it's and ".com" instead of a ".exe" so the internal structure is easier. And more importantly, it use self-modifying code to modify an instruction and run a non printable instruction, that is somewhat cheating.

dale_glass 6y ago
Why cheating? I don't think complying with any kind of "fairness" was ever the point. EICAR was created to fulfill a need to test antiviruses with some additional requirements, and how exactly it achieved it wasn't really important. I'm not sure if anybody ever described the official design goals for it, but based on some previous reading it seems that being able to type it on a keyboard was a requirement. I'm guessing this is because the kind of environment in which one experiments with viruses and their detection, it's desirable to maintain physical separation, and so using any kind of media or requiring a network connection would create danger. Or perhaps they also wanted it to be suitable for testing locked down environments where a more convenient way of introducing the test would have already been removed.
- gus_massa 6y ago
  The part about cheating was tongue in check, self modifying code makes writing printable executables easier. An excuse to avoid it is that some operative system are trying to enforce W^X, so executable code can't be modified. (But I think the real reason is that he wanted the harder challenge.)