0nekoneko7@lemmy.world to Linux@lemmy.mlEnglish · 28 days agoKaspersky releases free tool that scans Linux for known threatswww.bleepingcomputer.comexternal-linkmessage-square74fedilinkarrow-up1110cross-posted to: news@lemmy.linuxuserspace.show
arrow-up1110external-linkKaspersky releases free tool that scans Linux for known threatswww.bleepingcomputer.com0nekoneko7@lemmy.world to Linux@lemmy.mlEnglish · 28 days agomessage-square74fedilinkcross-posted to: news@lemmy.linuxuserspace.show
minus-squareatzanteol@sh.itjust.workslinkfedilinkEnglisharrow-up4·28 days agoWhy? It’s not hard. They typically hash files and look for hits against a database of known vulnerabilities.
minus-squareboredsquirrel@slrpnk.netlinkfedilinkarrow-up7·28 days agoYes and if viruses use something like base64 encoding or other methods, the hashes dont match anymore. As far as I understood it, it is pretty easy to make your virus permanently un-hashable by just always changing some bits
minus-squareatzanteol@sh.itjust.workslinkfedilinkEnglisharrow-up2·28 days agoThe xz backdoor was a packaged file distributed with the standard packages though. It would be trivial to find.
minus-squareboredsquirrel@slrpnk.netlinkfedilinkarrow-up1·28 days agoThis is obviously not about this known file. It is about “would this scanner detect a system package from the official repos opening an ssh connection”
minus-squareatzanteol@sh.itjust.workslinkfedilinkEnglisharrow-up1·28 days agoSorry, I was responding to: I HIGHLY doubt that they would detect the XZ backdoor
minus-squarePossibly linux@lemmy.ziplinkfedilinkEnglisharrow-up2·edit-228 days agoThat doesn’t work against polymorphic malware I think the best way is to monitor calls and behavior. Doing that is a privacy nightmare
minus-squareatzanteol@sh.itjust.workslinkfedilinkEnglisharrow-up1·28 days agoWho’s talking about polymorphic malware? We were talking about the xz backdoor.
minus-squarePossibly linux@lemmy.ziplinkfedilinkEnglisharrow-up1·28 days agoOh well in that case there is no chance
Why? It’s not hard. They typically hash files and look for hits against a database of known vulnerabilities.
Yes and if viruses use something like base64 encoding or other methods, the hashes dont match anymore.
As far as I understood it, it is pretty easy to make your virus permanently un-hashable by just always changing some bits
The xz backdoor was a packaged file distributed with the standard packages though. It would be trivial to find.
This is obviously not about this known file.
It is about “would this scanner detect a system package from the official repos opening an ssh connection”
Sorry, I was responding to:
That doesn’t work against polymorphic malware
I think the best way is to monitor calls and behavior. Doing that is a privacy nightmare
Who’s talking about polymorphic malware? We were talking about the xz backdoor.
Oh well in that case there is no chance