Timeline for Can a polymorphic/metamorphic worm use a mutex?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2012 at 7:18 | answer | added | D.W. | timeline score: 2 | |
| Jul 30, 2012 at 20:07 | vote | accept | Celeritas | ||
| Jul 30, 2012 at 15:32 | answer | added | Polynomial | timeline score: 2 | |
| Jul 4, 2012 at 15:56 | comment | added | Polynomial | The point of polymorphic malware is to have no identifiable pattern. If you use a mutex, you need to know the name of the mutex. To know the name of the mutex, there must be a pattern to it. If there's a pattern to it, the AV can use that pattern to detect the malware. | |
| Jul 3, 2012 at 22:35 | history | tweeted | twitter.com/#!/StackSecurity/status/220284629314310146 | ||
| Jul 3, 2012 at 21:50 | comment | added | Bruce Ediger | In general, interacting processes (OS processes or threads, worms, servers/clients) have to have some independent entity to use as a mutex. Threads in a Linux process use memory bytes manipulated by special instructions. Processes use directories, whose creation and deletion is guaranteed atomic by the OS. Java threads synchronize on an object known to all threads. What will your worms use as a mutex? | |
| Jul 3, 2012 at 21:32 | comment | added | Celeritas | @BruceEdiger what I'm saying is at there would be 1 copy of the worm on each machine (on the network) instead of 100. The 1 worm propigating itself (e.g. mass mailer) would be a lot less resource intense than 100 worms mass mailing (per machine). Did I understand what your saying? | |
| Jul 3, 2012 at 21:16 | comment | added | Bruce Ediger | What kind of entity would a worm (polymorphic or not) use as a mutex over whatever network it infects machines on? Sometimes, multiple processes use directories in a filesystem as a mutex, but that's local to one machine. | |
| Jul 3, 2012 at 19:22 | history | asked | Celeritas | CC BY-SA 3.0 |