Dan Guido

@dakami @thegrugq @dguido Actually, for my Aurora exploit, DEP took one weekend (IE8/XP), DEP+ASLR (IE8/Win7) took a second weekend.

@dinodaizovi @thegrugq @dguido my mistake :) *two* weekends, one hacker, minimal motivation != "extremely high"

@dakami @dinodaizovi Also what @thegrugq is true: ASLR/DEP impose continuing cost. ExploitShield is “bypassed” once and done.

@dguido @dinodaizovi @thegrugq These are all very compelling theories. What does the empirical data say though?

@dakami @dguido @dinodaizovi what are you measuring?

@thegrugq @dguido @dinodaizovi An apparent 100% success rate stopping unsignatured malware feels like it deserves some respect

@dakami @thegrugq @dinodaizovi Rather, AV has a 100% success rate detecting malware that hasn’t tried to bypass it.

@dguido @thegrugq @dinodaizovi AV is signature based and has an enormous false positive rate if they try anything funny