Re: Possible Mail server compromise ?

[Peter Kosinar <goober () ksp sk>]

> Nope, you have to distinguish between a sandbox (code is run) to an AV 
> scanner scanning code in a VM, when the av scanner scans the code, the 
> code is not executed and cannot decide whether it is inside a VM =)

Wrong. This would be true only if the AV didn't have the parsing bug in 
the first place. If the AV is buggy and allows some form of arbitrary code 
execution, the attacker -does- have the code executed inside the VM; and 
nothing stands in his way of detecting whether it's a real machine or not. 
If, on the other hand, the AV was not vulnerable... then, what would be 
the gain of running it inside a VM? :-)

Peter

--
[Name] Peter Kosinar   [Quote] 2B | ~2B = exp(i*PI)   [ICQ] 134813278