Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, indicating the real-time virus scan was working. However, this got me thinking... since this is a relatively short string of ASCII printable characters, this could be easily inserted into many forms of user-input. So depending on how the Anti-Virus software handles this, you may be able to use this to force a deletion of a file if you are able to append this to it. For example, let's say a Web server logs all the requests you send it, and you insert this EICAR virus signature into a request and it gets logged into a file, and the file then gets deleted. I tried searching google for malicious use of the EICAR virus test but wasn't able to find any examples of misuse of this in the wild. Anyone know if this has been done before? It's an interesting idea that an Anti-Virus software ironically could be a threat to what would otherwise be non-threatining. Thoughts?
In conclusion, if implemented correctly in the AV software, the EICAR Test appended to a log file would not be detected (which is good). However, I found out that this is not always implemented correctly. Therefore, some anti-virus software may wrongfully take action if this were to be appended to a log file. See my analysis done below:
Anti-Virus software that accurately detects the EICAR Test signature by itself in a file: https://www.virustotal.com/en/file/56606ad869484ccbb4d012f46c9c73ea9b20f9863351741aab96763345209564/analysis/1409779284/
Anti-Virus software that detects the EICAR test signature even if it's been appended to a file (this violates the EICAR Test rule, and thus was not implemented in the AV software according to Protocol): https://www.virustotal.com/en/file/f5b88459f4b2c6425bdfc5c8f4f17027e0bfcc65a4c39dbb48f96c81ce17369c/analysis/1409779665/