05.08.10
Crackers Evolve to Dodge Anti-Virus Software in Windows
Summary: A fully ‘protected’ and patched Windows installation cannot be secured due to new tricks and hidden vulnerabilities that Microsoft conceals from the public
A FEW days ago we wrote about Joanna Rutkowska's observations and mentioned her firm’s use of GNU/Linux. Yesterday we found this article from The Register, which speaks about anti-virus software being ineffective in the face of a new pattern of attacks.
Researchers say they’ve devised a way to bypass protections built in to dozens of the most popular desktop anti-virus products, including those offered by McAfee, Trend Micro, AVG, and BitDefender.
Ghabuntu recommends Ubuntu GNU/Linux as a preventive measure and also argues that:
It is a very serious issue which can have a devastating consequence in the lives of a lot of people. However, there is still hope. The research did not make any mention of this anti-virus as being such an easy to evade guard.
Anti-virus software has been useless for quite some time. Authoritative figures spoke about these issues for years and McAfee went as far as doing more harm than good last month.
According to several independent sources, about one in two Windows PCs is a zombie PC and Microsoft carries on lying about the number of vulnerabilities/patches in order to give the illusion that things are improving when it fact they never did. Microsoft is just lying about its patches, as before. Anti-virus software can’t do anything about it and here in Techrights we opine that the public has the right to know the truth. █
Yuhong Bao said,
May 12, 2010 at 8:50 pm
The attack is on SSDT hooking, which MS and others has been warning against for years and even tried to prevent via PatchGuard in x64 versions of Windows. The Nynaeve blog by Ken Johnson, a Windows kernel-mode expert who joined MS after this was written, has an example of a buggy SSDT hook that has security problems:
http://www.nynaeve.net/?p=210