Anti Virus Software

[Spivonious]

i'm not talking about heap allocations/heap overrun attacks.

maybe i'm missing something, but there is nothing sacred about the stack. if the attacker successfully overwrites the stack with his own arbitrary code and sets the return address correctly, the attacker has basically succeeded in getting the user (typically administrator) to run his arbitrary code.

perhaps ie7 protected mode mitigates against arbitrary code running as a privileged user, but certainly not all your applications that get input or process files from the internet do (iTunes, Windows Media, Outlook, Outlook Express, RealPlayer, Adobe Flash, Adobe Acrobat Reader, MP3 players, etc...).

However, on Vista all of these programs run as standard users, so unless you actively give them administrative privileges (or turn UAC off) the worst they can do is access your user files.

[Spivonious]

http://www.jcfonline.com/forums/show...00#post1111567

So how come everyone jumped on me but not you? Silly guitar forums!

[hippietim]

i'm not talking about heap allocations/heap overrun attacks.

Then you should have said so You said "A buffer overflow will NOT trigger a page fault/access violation." which is incorrect. They can.

maybe i'm missing something, but there is nothing sacred about the stack. if the attacker successfully overwrites the stack with his own arbitrary code and sets the return address correctly, the attacker has basically succeeded in getting the user (typically administrator) to run his arbitrary code.

This is correct. The stack is just read/write memory. Although most users on Vista are not running with administrator tokens so system-wide resources are secured.

perhaps ie7 protected mode mitigates against arbitrary code running as a privileged user, but certainly not all your applications that get input or process files from the internet do (iTunes, Windows Media, Outlook, Outlook Express, RealPlayer, Adobe Flash, Adobe Acrobat Reader, MP3 players, etc...).

This is true. But only if you are running with an administrator token. The default behavior in Vista is to run with normal user privilege (yes, even for administrator accounts). The system has a secure pathway to elevate - meaning the UX is launched from a secure desktop object (aka, isolated from other window so it can't be hooked) and that pathway is launched by a secured process (Winlogon IIRC).

[hippietim]

So how come everyone jumped on me but not you? Silly guitar forums!

Because I didn't go spreading misinformation

[Spivonious]

Because I didn't go spreading misinformation

Well, at the very least, we all know a bit more about viruses and other malware now.

[Spivonious]

Well I ran Avast. It found one trojan horse, but I'm 99.999% sure it's a false positive because it said it was in pagefile.sys, which as we all know is the page file for Windows and gets recreated every time the computer boots.

[guitarsjb]

I like Avast.

[Phantom Hawk]

Wouldn't it be easier to just kill a virus or spyware creator every evening in public squares all across the globe ? Thats an antivirus program I'd feel ok about paying for. Instead, all they get is a year in jail, some probation, and told not to use computers anymore. Big friggin' deal. Millions of dollars damage and Dorkus gets a slap on the wrist. I'd be surprised if some of these assholes didn't work for Norton and write these programs just to force the rest of us into paying them for protection. The whole situation just irritates the hell outta me.

Ok, sorry for the hijack. Please go on with your rational discussion........

[Spivonious]

There is a popular theory that employees of McAfee created the first viruses to show that it could be done.