landave

9 ms·

31.
by landave 9y ago
Bitdefender's core has dynamically loaded modules that are distributed with the regular definition update, which runs fully automatically. So there is nothing to do.
32.
by landave 9y ago
That's interesting. Unfortunately, AVG has been acquired by Avast last year [1]. I already looked into the new version of AVG a few months ago, and found that they have replaced AVG's engine with Avast's engine. Since the sca
33.
by landave 9y ago
The definitions are licensed with the engine and can usually not be modified. In a nutshell, most anti-virus vendors that are licensing the Bitdefender engine extend it with their own engine to improve their detection rate. For example, the
34.
by landave 9y ago
That's right. The list of anti-virus products that license the Bitdefender engine is extremely long. Actually, I wanted to include the most prominent Bitdefender customers in the article to give an impression. I ended up not doing so,
35.
Bitdefender Anti-Virus: Heap Buffer Overflow via 7z LZMA(landave.io)
83 points by landave 9y ago|58 comments
36.
by landave 9y ago
I don't know. If you are not already familiar with the inner workings of bitcoin, it seems to me that a simple computation power secures the transactions is not really helpful. What does that even mean, to secure the transactions? Es
37.
Bitdefender Remote Stack Buffer Overflow via 7z PPMD(landave.io)
1 points by landave 9y ago|0 comments
38.
by landave 9y ago
I agree with the pdf spec allowing some insane stuff. However, I think it's quite a stretch to put any blame on Adobe for this one. In essence, Avast has implemented their own std::vec in C for the management of the magic numbers, and
39.
by landave 9y ago
The graph is generated by binary ninja [1] fully automatically, and this is just a screenshot of the tool. Any alternative reversing platform or disassembly tool like IDA Pro can generate you something very similar. [1] https://b
40.
by landave 9y ago
Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works. So to be very clear: I reversed the functions and
41.
by landave 9y ago
The engine is not sandboxed. I will speak only for the Windows product though, because this is the only one I looked at in detail. (But the Linux engine is not sandboxed either). This is X86 code [1] running as NT AUTHORITY\SYSTEM. Hence, s
42.
by landave 9y ago
I am very surprised by the strong interest in this kind of work, and I appreciate it a lot! I would love to hear some feedback, in the hope that the following posts will be more enjoyable than this first one.
43.
by landave 9y ago
Honestly, I'm quite surprised about the strong reaction. I thought it was common knowledge that this kind of software is full of bugs. During the last year, I discovered dozens of bugs in different widespread anti-virus products. Not a
44.
by landave 9y ago
Wow, thanks! That means a lot to me. Honestly, I didn't expect this to interest anyone.
45.
by landave 9y ago
I'm sorry to disappoint you :) I discovered this via a coverage based fuzzing engine with a dictionary (containing those magic numbers). Said fuzzing engine is similar to libFuzzer, but I have designed it with a focus on fuzzing closed
46.
Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers(landave.io)
245 points by landave 9y ago|54 comments
47.
by landave 9y ago
I've read quite a lot about AMP, but I still don't really understand for what technical reason a new markup language (AMP HTML) and an additional javascript library is required to achieve the (claimed) effect. More specifically: I
48.
Announcing a new blog series on anti-virus software(landave.io)
1 points by landave 9y ago|0 comments
49.
Ask HN: Legal situation of disclosing anti-virus bugs
2 points by landave 9y ago|0 comments
50.
by landave 9y ago
I am pretty sure that you need a Board Serial Number (SN) from a real Mac. At least about a year ago this was the case. Did you use a SN from a real Mac? If not, then you probably got lucky. I think there is also the possibility of calling