blobrana wrote:
Hum,
yeah i am wary of any binary,
But this one was virus scanned and internet traffic watched.
Virus scanners mean nothing, as they usually only flag things on definition. Change around the code on a trojan a little, and they miss it. Most checks are based on checksums or md5.
If one wanted to transmit some data to another host on the net, you would think the virus suite you are running would check this? Sure, if it opens it own socket for the io. But what if it used the html rendering library via com to send the data? Trick a trusted process to send your data, and you slip by the av software.
So you are watching the traffic, and with what? Ethereal, tcpdump? So what, if i were to write something malicious, i would make it communicate very rarely, maybe only onece a week, maybe more, maybe less. Did you check to see which registry keys it was accessing? Did you check to see what files it was playing with? Are you anal enough about what processes are running to notice? Do you know what all of the running processes you have are?
You cant watch your system 100% of the time with 100% detial. 80% of security problems could be solved with just an ounce of education.
