Pat, I learnt long ago that when I don't know something definitively, post something wrong and wait for a supposedly correct answer. The following is not even the least recent I could find. The earliest I personally had a finger in was a PT I did in 2001 https://ww.blackhat.com/presentations/bh-europe-08/Feng-Xue/Whitepaper/bh-eu-08-xue-WP.pdf …
I think this is pretty significant. Think of AV attack surface as a rich vein of gold nobody has bothered to mine yet. A zillion highly privileged parsers. I know some red teamers who’ve used bugs like these but you don’t hear of them being used ITW much.https://www.zdnet.com/article/trend-micro-antivirus-zero-day-used-in-mitsubishi-electric-hack/ …
-
-
-
I find it amazing that people think I’m unaware of the zillion research papers on AV bugs. I’m not. I’ve spent years reporting on it. What’s different here is an APT crew moving to gain entry with an AV 0day and that being reported publicly.
- Još 6 drugih odgovora
Novi razgovor -
-
-
Getting “well actually’d” on this tweet, just as
@Metlstorm predicted. Will be a fun conversation to have on the show.@taviso has pointed out these bugs are being sold already so likely in use ITW. I still think a big pivot towards AV exploitation will be bad for many reasons.Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
This is why you run two antivirus
-
To double your attack surface? Or to increase the probability of an undetected flaw in the AV?
- Još 1 odgovor
Novi razgovor -
-
-
Excited to hear about this on the show! Sounds like the AV attack surface has been utilized, but maybe not to the extent the public knows. Or the public isn't aware as to how often AV is abused. AV's assumed in standards to be safe - this could change the game in a lot of ways.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
dude
@matalaz has been doing this for like 8 yearsHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
There's a (opensource) antivirus project that wraps clamav in nsjail. I mean: there is ONE. In total.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.