Timeline for Can a polymorphic/metamorphic worm use a mutex?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 31, 2012 at 7:29 | comment | added | Polynomial | Could the downvoter explain themselves? | |
| Jul 30, 2012 at 20:07 | vote | accept | Celeritas | ||
| Jul 30, 2012 at 20:07 | comment | added | Celeritas | I better explained myself why don't we continue this here: security.stackexchange.com/questions/17862/… | |
| Jul 30, 2012 at 19:49 | comment | added | Polynomial | But you still need a known token for both, which means that the AV only needs to identify the pattern of mutexes. Also, mutexes aren't filenames, they're named system objects. If you had completely random names, you'd still have generation code that contains a pattern. Or you'd end up with different "generations" infecting the same system. | |
| Jul 30, 2012 at 19:34 | comment | added | Polynomial | If it was hard coded, the AV engine could detect it. If it changes the name randomly as part of its polymorphism engine, how would a new infection know what the new name is? | |
| Jul 30, 2012 at 18:00 | comment | added | Celeritas | What if a virus has hard coded into it a name of a file it will use as a mutex and if that file doesn't exist it assumes it is infecting a new system and rewrites itself using the metamorphic engine and gives it self a new mutex (that it creates before running the new generation of itself)? Is there viruses like that? | |
| Jul 30, 2012 at 15:32 | history | answered | Polynomial | CC BY-SA 3.0 |