Pinboard (guardiantech)

Android virus scanners are easily fooled >> The H Security

guardiantech — 2013-05-06T19:30:48+00:00

Researchers at Northwestern University and North Carolina State University have discovered that anti-virus programs for Android can usually be bypassed using trivial means. The researchers developed DroidChameleon, a tool that can modify known malware apps in numerous ways to prevent them from being detected.
Most of the ten scanners they tested mainly performed signature-based analyses. In some cases, simply changing the package name in the metadata was enough for virus scanners to consider the malware harmless. Several scanners could be fooled by unpacking the malware and then creating new installation packages. In other cases, the researchers were successful after encrypting parts of the app or redirecting function calls.
Their conclusion is unambiguous: all ten anti-virus programs could be fooled in one way or another…
The researchers' findings are a further reason for users to not allow the installation of apps from untrusted sources, also called sideloading, in the first place.

(Thanks @rquick for the link.)

Privacy-violating, useless AVG antivirus app pulled from Windows Phone Marketplace

guardiantech — 2011-09-14T05:20:16+00:00

"To the surprise of many, an antivirus application was published on the Windows Phone Marketplace earlier in the week. The publication of AVG Mobilation for Windows Phone was peculiar for two main reasons. The first is that Windows Phone simply doesn't have any viruses to scan for. Second, Windows Phone applications are sandboxed; they have no access to the system files or other applications. Even if a virus were to be developed for the platform, the virus scanner would not be able to detect or remove it.
"AVG was apparently undaunted by these obstacles, and developed the free, but ad-supported, Mobilation regardless."

AVG didn't really cover itself in glory here.

Massive profits fuelling rogue antivirus market >> Brian Krebs's Security Fix

guardiantech — 2011-06-23T20:09:21+00:00

"TrafficConverter.biz was dismantled on Nov. 29, 2008, most likely because the same domain was referenced deep inside the guts of the Conficker worm, a family of malware that is estimated to have infected at least 10 million Microsoft Windows systems.
"Prior to site's demise, security researchers managed to snag a copy of the database for the TrafficConverter affiliate program. While that data set is incomplete, the information available on the top-earning affiliates helps explain why so many consumers are reporting infections from rogue anti-virus products: Successful affiliates are making money hand over fist with these programs."

Apple to malware authors: Tag, you’re It! >> Naked Security

guardiantech — 2011-06-02T08:24:53+00:00

About eight hours after the bad guys altered their product, Apple came back with an update. "As the cat-and-mouse game continues it will be interesting to see how the attackers proceed. The major change to bypass detection yesterday was to use a small downloader program to do the initial infection, then have that program retrieve the actual malware payload.
"This approach may be successful as it will be easier for them to continually make small changes to the downloader program to evade detection while leaving the fake anti-virus program largely unchanged.
"Why is this important? Apple's XProtect is not a full anti-virus product with on-access scanning. XProtect only scans files that are marked by browsers and other tools as having been downloaded from the internet.
"If the bad guys can continually mutate the download, XProtect will not detect it and will not scan the files downloaded by this retrieval program."

And they can mutate it, for sure.