Can PAN detect this kind of malware?

emr_1 — Wed, 17 Jul 2013 15:17:27 GMT

I found following article.

This is pretty interesting technique, though if people hits this kind of malware, is Threat Prevention (or might be wildfire?) able to detect this malware?

Regards,

Re: Can PAN detect this kind of malware?

mikand — Wed, 17 Jul 2013 21:25:30 GMT

Hopefully PA will add this as a general threat that a jpeg contains a malformed exif-header (or rather the exif-header contains data which shouldnt exist there in normal situations).

Such as the /.*/e^ or for that matter eval, base64_decode and the other stuff.

This would also be interresting to exploit regarding as a tunneling technique.

That is similar to how What2Code – IT Security Blog used ssh within web-browsing session (and later ssh within dns session) now you can take it a step further and use proper http etc but tunnel through jpegs which is being sent back and forth 🙂 (and this way you would be screwed as soon as you let the client use web-browsing as appid)

topic Re: Can PAN detect this kind of malware? in General Topics

Can PAN detect this kind of malware?

Re: Can PAN detect this kind of malware?