Re: sebek as a patch?

>Possible, but not very practical.
I thought there might be some problems with that approach :)

Another approach I thought of was to hide the module the same way the
adore worm is hidden - but this would still be vulnerable to pattern
matching. Perhaps encryption is the way to go - the only problem then
is that you need a decryptor, which is then *itself* vulnerable to
pattern matching.

Maybe we should look to the enemy for solutions: could polymorphic
virus techniques help here?

Another random (and probably useless :) idea,
Daniel Axtens
Received on Oct 07 2005