Home page logo

bugtraq logo Bugtraq mailing list archives

Re[2]: Aladdin response regarding eSafe
Date: Mon, 2 Aug 2004 02:17:56 +0400

Dear Aleksandar Milivojevic,

--Friday, July 30, 2004, 6:06:57 PM, you wrote to bugtraq () securityfocus com:

engines I tested (KAV, ClamAV and others) are file-oriented. It makes
it impossible to code good antiviral protection for proxy server with
this engines.

AM> Hm.  What about option of sending one byte of data to the client every
AM> minute (with configurable limit that not more than xx% of file can be
AM> transffered before scanning, just in case you stummble accross site that
AM> is actually that slow ;-) ), instead of just feeding him up to 80% of
AM> the file in advance of file being scanned?  For those that prefer a bit
AM> more security over interactivity.  This would prevent client from timing
AM> out, 99.99% (number from the back of my head) of files would take less

There  is a difference between inability to create good protection (both
strong  and  convenient)  and  inability to protect. Of cause, there are
ways  to  implement  protection:  you can check file after each 100KB of
data  (anyway  only first X KB of files are usually checked by antiviral
software)  you  can  send  one  byte  per minute, you can send fake HTML
headers  one  in a minute (they will be ignored), or you can simply show
HTML  page with your own progress bar for large files, you can recognize
file  type and act depending on it. Any of this is "hack", because there
is no standardised way.

You know my name - look up my number (Beatles)

  By Date           By Thread  

Current thread:
  • Re[2]: Aladdin response regarding eSafe 3APA3A (Aug 02)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]