McAfee VirusScan Enterprise 8.0.0 Misidentifies EICAR Test File

[TheGesus]

REVISION 1.1
===========
Without "offensive" language.


PROBLEM
========

McAfee VirusScan Enterprise 8.0.0 (tested unpatched and with Patch 11)
using the 4781 DAT file (dated 06/09/2006, perhaps also previous) and
engine 4400 incorrectly identifies the "industry standard" EICAR test
file as Elspy.worm .


PROOF OF CONCEPT
=================
@echo off
:looper
REM Make file >128 bytes #################
REM ######################################
REM ######################################
REM ######################################
echo X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*>testfile
goto looper

Cut & paste the above into Notepad (lines may wrap), save as a Windows
CMD file & run it.

VirusScan will report an instance of Elspy.worm once every three seconds (YMMV).


RISK FACTOR
===========
I dunno... you could probably make your "Enterprise AntiVirus
Administrator" look like a clueless idiot. That's always fun!


ADMISSION OF LAMENESS
=====================
Yes, this is lame. It is also stupid that an "Enterprise" antivirus
package cannot identify an EICAR test file properly. That's not MY
problem. Also, I did ZERO research on this so if someone else has
already published, mea culpa.


VENDOR NOTIFICATION
==================
None.


HOLLA
=====
Greetz to Dad & the Woolly Spook!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Nick FitzGerald]

Post by TheGesus
REVISION 1.1
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Without "offensive" language.

Where's the fun in that?? 8-)

Post by TheGesus
PROBLEM
=3D=3D=3D=3D=3D=3D=3D=3D
McAfee VirusScan Enterprise 8.0.0 (tested unpatched and with Patch 11)
using the 4781 DAT file (dated 06/09/2006, perhaps also previous) and
engine 4400 incorrectly identifies the "industry standard" EICAR test
file as Elspy.worm .

Actually, it doesn't.

I mean, I take your word for it that, in your testing, VirusScan
detected "Elspy.worm" as a result of running that .CMD file (my own
tests with a console version of VirusScan against the "testfile"
resulting from the following reported "Found the Elspy.worm virus !!!",
so I'm happy to accept the on-access scanner will do something
similar), but VirusScan is NOT detecting this in 'the "industry
standard" EICAR test file'.

Post by TheGesus
PROOF OF CONCEPT
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
@echo off
:looper
REM Make file >128 bytes #################
REM ######################################
REM ######################################
REM ######################################

*>testfile

Post by TheGesus
goto looper
Cut & paste the above into Notepad (lines may wrap), save as a Windows
CMD file & run it.

You mention "CMD" so I'm assuming the versions(s) of Windows you tested
this on were NT-based rather than Win16 or Win9x.

Post by TheGesus
VirusScan will report an instance of Elspy.worm once every three seconds=

(YMMV).

As I already said, I'll take your word for this detection, BUT your
claim is outright wrong.

Did you actually look at the "testfile" created by your na=EFve .CMD
file?

The first thing I noticed was that it was the wrong size. I expected
it would be 69 bytes (more on why in a moment), but in fact it was even
shorter at 68 bytes.

68 bytes is the length of the bare test string. The official EICAR
specification for the test file:

http://www.eicar.org/anti_virus_test_file.htm

says that the file MUST start with the 68-byte string we see in your
.CMD file and that it "may be optionally appended by any combination of
whitespace characters with the total file length not exceeding 128
characters. The only whitespace characters allowed are the space
character, tab, LF, CR, CTRL-Z."

As the ECHO command necessarily emits a CRLF line-break, had your .CMD
file worked as expected, one would have seen "testfile" at 70 bytes
(the 68 of the EICAR test string, plus the two from ECHO's CRLF).

I said I was, however, expecting it to be 69 bytes. Why?

Well, you did not escape the "%" character (the sixth in the EICAR test
string), and _within .BAT and .CMD file_ these have special meaning,
such that they are stripped unless protected by escaping ("%%"), and
possibly in some instances with quoting.

In actuality though, "testfile" ends up being 68 bytes. A quick look
at "testfile" shows that the caret ("^"; the 20th character in the
EICAR test string) has also been dropped, reminding me that it is also
a special character (even at the bare commandline this time) and must
also be escaped/quoted if intended to be treated as a literal.

Post by TheGesus
RISK FACTOR
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
I dunno... you could probably make your "Enterprise AntiVirus
Administrator" look like a clueless idiot. That's always fun!

If this makes him/her look any more of a clueless idiot than it makes
you look, then I guess, as they say, your organization has bigger
problems...

Post by TheGesus
ADMISSION OF LAMENESS
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Yes, this is lame. It is also stupid that an "Enterprise" antivirus
package cannot identify an EICAR test file properly. That's not MY
problem. Also, I did ZERO research on this so if someone else has
already published, mea culpa.

Now, I'm not entirely disagreeing that it is strange that VirusScan
detects this weirdly mutant, "non-EICAR test file", but it certainly is
NOT mis-identifying 'the "industry standard" EICAR test file'.

As for your lameness in missing that the file you were generating was
NOT the file you were trying to generate -- I'll leave that up to
others to decide...

Post by TheGesus
VENDOR NOTIFICATION
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
None.

Pity -- you might have saved yourself the embarrassment of this public
disclosure of your lameness.

Post by TheGesus
HOLLA
=3D=3D=3D=3D=3D
Greetz to Dad & the Woolly Spook!

They must be sooooo proud of you...


Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[TheGesus]

Post by Nick FitzGerald

Post by TheGesus
VENDOR NOTIFICATION
==================
None.

Pity -- you might have saved yourself the embarrassment of this public
disclosure of your lameness.

OK, so I am pwned. I am surprised you even bothered with me, Nickie.
You are such a bitch I know you can't help yourself. But do you have
to be so WORDY?

Anyway, this is lots of fun.

So... cut & paste this new improved POC into a Windows CMD file and run...

FOR /L %%i in ( 1 1 100000 ) DO ECHO X5O!***@AP[4\ >virus%%i.exe
%0

And you have an instant Elspy.worm flood and your Enterprise AntiVirus
Administrator is shitting his pance. Run in circles, scream and shout
and all THAT.

Be sure to do it before McAfee updates the DAT file on Monday!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Cardoso]

Looks like a nice prank, I used to send NET SEND "virus warnings" to
nearby people. The rally clueless jumped when receiving "network
monitoring warning: you're not allowed to watch naked pictures, please
close your Web Browser"

Other than that, network-wide messages are not really usefull. NO ONE
believes in "network shutdown in 5 minutes, please save your files and
logout of the system"





On Sat, 10 Jun 2006 23:40:53 -0400
TheGesus <***@gmail.com> wrote:

T> On 6/10/06, Nick FitzGerald <***@virus-l.demon.co.uk> wrote:
T> >
T> > > VENDOR NOTIFICATION
T> > > ==================
T> > > None.
T> >
T> > Pity -- you might have saved yourself the embarrassment of this public
T> > disclosure of your lameness.
T> >
T>
T> OK, so I am pwned. I am surprised you even bothered with me, Nickie.
T> You are such a bitch I know you can't help yourself. But do you have
T> to be so WORDY?
T>
T> Anyway, this is lots of fun.
T>
T> So... cut & paste this new improved POC into a Windows CMD file and run...
T>
T> FOR /L %%i in ( 1 1 100000 ) DO ECHO X5O!***@AP[4\ >virus%%i.exe
T> %0
T>
T> And you have an instant Elspy.worm flood and your Enterprise AntiVirus
T> Administrator is shitting his pance. Run in circles, scream and shout
T> and all THAT.
T>
T> Be sure to do it before McAfee updates the DAT file on Monday!
T>
T> _______________________________________________
T> Full-Disclosure - We believe in it.
T> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
T> Hosted and sponsored by Secunia - http://secunia.com/
T>

Allgemeinen Anschulterlaubnis
Cardoso <***@pobox.com> - SkypeIn: (11) 3711-2466 / (41) 3941-5299
vida digital: http://www.contraditorium.com site pessoal e blog: http://www.carloscardoso.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[TheGesus]

It can be even more fun in an ePolicy Orchestrator (ePO) environment!
Use it during the last week of the quarter and screw up the quarterly
AV reports! Someone is guaranteed to shit their pance, although you
may not be around to appreciate the ensuing hilarity.

And the improved version (see my response to Nickie FucksGerald's
pwnage) is memorizable! Keep it in your head, bang it out on a
keyboard of an unattended PC (you know, the one in Shipping &
Receiving), minimize the DOS box, walk away, and BAM! Instant
Elspy.worm "infection".

Pity it doesn't really have anything to do with EICAR, though. Mea culpa.

Post by Cardoso
Looks like a nice prank, I used to send NET SEND "virus warnings" to
nearby people. The rally clueless jumped when receiving "network
monitoring warning: you're not allowed to watch naked pictures, please
close your Web Browser"
Other than that, network-wide messages are not really usefull. NO ONE
believes in "network shutdown in 5 minutes, please save your files and
logout of the system"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Marcos Agüero]

Post by TheGesus
And you have an instant Elspy.worm flood and your Enterprise AntiVirus
Administrator is shitting his pance. Run in circles, scream and shout
and all THAT.

Oh! That's really stupid! The logs will show 10000 infection on the same
PC within a few seconds. Easy to spot as a false positive and remove
from the report. And such things happens in real world without the help
of lame people like you. Can't see where is the fun on this, except your
stupidity-disclousure.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/