Re: Extracting signature snippets from AV databases

On Monday 08 May 2006 05:56 pm, Bill Stout wrote:
> Hi Jose,
>
> I'm familiar with EICAR.  However I'd like to trigger signatures across
> the board.
>
> Ultimately I'd like to run a real malware test, but that can only be
> done in an isolated lab, and that requires a continuous investment of
> time and money to insure the collection is up to date.
>
> http://www.av-test.org/ is another possibility, but I have no contacts
> there, and it's somewhat isolated proof (can't touch the environment,
> and it's a run-once deal).

That's been tried before, (R. Utilities, his name shall remain unmentioned).  
As was pointed out at the time, since these are not viruses (or Malware), 
they should not be detected as such.  Any detection of 'strings' would be a 
false positive.  Additionally, most current products do not rely on strings, 
rather incorporate heuristics and strings for better Positive identification 
and detection of minor variants.  This is why it's important to rely on 
testing orgs like V-Tests, Virus Bulletin, ICSALabs, and West Coast Labs.  
They all publish free public results, and will do private testing for a fee.  
The EICAR and SpyCAR files should be used to validate the product is 
installed and properly functioning, independent peer reviewed scientific 
tests should be relied upon to verify product efficiency.  This is a debate 
that goes back to the early to mid 90's, and the arguments have not changed.  
The only thing that has changed is the availability of "Virus Collections" on 
the web, but like then, what is the quality of those collections, are they 
really viruses, are they really the virus name the collector has promised 
them to be? Again a bad idea, as you have no control of quality of the zoo, 
nor positive identification of the samples or intendeds.  Once again we come 
full circle to let the professional test orgs/ individuals do what they do 
best, and cross reference their tests, to help you be able to say with 
authority, that the tests are as unbiased as possible, and not influenced by 
vendors.


-- 
Kenneth L. Bechtel, II
Team Anti-Virus
Phone - 717-579-9083                      | WildList Reporter
P.O. Box 635, Palmyra, PA 17078           | Founding member AVIEN
E-mail - [email protected]      | Member AVAR
I can't be an impostor - I don't know what I'm doing!
PGP Footprint: 969E 2A27 3042 EE52 AEFB  6FF0 2711 9467 D38C 5C0F