TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

105 pointsby landavealmost 7 years ago

6 comments

fulafelalmost 7 years ago
Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc.<p>Though probably their customers are mainly corporate &quot;intranet&quot; environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware infections - which are not av focused yet.<p>(1) or whatever the average AV detection rate is these days.
评论 #17253905 未加载
评论 #17253709 未加载
评论 #17259954 未加载
nneonneoalmost 7 years ago
Wow, this is a neat exploit. It breaks ASLR with a static payload, only employing some decompression tricks to combine randomized addresses with fixed ROP targets. I like the technique and I think it could be more generally applied to file exploits.
brokenmachinealmost 7 years ago
I&#x27;ve been using computers my entire life but this read like it was in Greek to me. Very impressive that people out there actually understand all that stuff. I&#x27;m not sure where to begin learning about that.
评论 #17253870 未加载
cafalmost 7 years ago
The way the author uses the RAR decoder engine itself to mutate parts of an existing (randomized) function pointer, defeating ASLR, is pretty damn neat.
youseecomradealmost 7 years ago
And MalwareBytes is still using 7zip 18.01
评论 #17254083 未加载
评论 #17253299 未加载
graycatalmost 7 years ago
What are each of<p>F-Secure<p>RAR<p>ASLR<p>massage the heap (what heap, where)<p>ROP chain<p>RarVM<p>etc.
评论 #17252446 未加载