KEYNOTE TALK AVerify: AN OPEN-SOURCE ANTI-VIRUS - Eicar

More documents

Recommendations

Info

“A A study of anti-virus’ response to unknown threats (EICAR, 2009)” � N. Richaud and myself � Twelve anti-virus products tested � 21 single tests, oriented towards “proactive” (HIPS-like) detection � Tests run by hand in Dec. 2008 – Some tests did require admin rights, but not all � Results published at EICAR 2009 2010-05-10 EICAR 2010
� Low-level access EICAR 2009 2008 versions MBR (modified bootroot) avast! AVG Avira Detected BitDefender ESET F-Secure Kaspersky Detected McAfee Norton Panda Sophos TrendMicro 2010-05-10 EICAR 2010 Device\PhysicalMemory
Page 1 and 2: AVerify Towards verifiable anti-vir
Page 3 and 4: A philosophical note � The bad gu
Page 5 and 6: (not my fault) 2010-05-10 EICAR 201
Page 7 and 8: Let’s search “antivirus reviews
Page 9 and 10: “Race Race To Zero” (2008) Chal
Page 11: The firewall “leak tests” � G
Page 15 and 16: � Code injection: 2008 versions C
Page 17 and 18: The iAWACS 2009 Challenge � Goal:
Page 19 and 20: The iAWACS 2010 Challenge � Diffe
Page 21 and 22: The Guillermito case � 2001, Tega
Page 23 and 24: More difficulties of testing � Ca
Page 25 and 26: Does CC Certification make sense?
Page 27 and 28: AVerify � Inspired by the EICAR a
Page 29 and 30: Planned tests #1: HIPS features �
Page 31 and 32: Planned tests #3: real-world � Th
Page 33 and 34: An interesting attack � “KHOBE
Page 35 and 36: Scripting a virtual machine � Che
Page 37 and 38: On providing samples � Distributi
Page 39 and 40: The future of AVerify? � Lots of
Page 41: Q&A Thank you for your attention! 2

KEYNOTE TALK AVerify: AN OPEN-SOURCE ANTI-VIRUS - Eicar

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?