<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Fuzzy hashing helps researchers spot morphing malware ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-343262/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-18T15:12:07-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Friends don't let friends do McAfee...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453145]]></link>
        <description><![CDATA[for home computers. I reserve judgement on Enterprise. It is hard to get excited about it after so many disasters though!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453145]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sun, 22 May 2011 13:16:08 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Very true - and we are lucky to have him here on TR!(nt)]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453144]]></link>
        <description><![CDATA[]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453144]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sun, 22 May 2011 13:13:19 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Behavioural hueristics...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453154]]></link>
        <description><![CDATA[seem to be improving. I received a free license from CNET to a new Emisoft program called Namutu. This program only took SECONDS to find all the active DRM spies in my processes!!!I was simply amazed! As I consumed different types of protected content, a new spy activates, and Namutu nails it!! Of course these are false positives, but I am SO impressed with the rapid slap down they got, that I was extremely tickled! Of course I had to exclude these MPAA and IAA processes to get my blu-ray and HD cable working, but I'm still very happy about this new type of behavioral heuristics. From the makers of Online Armor, this utility needs little updating, but it does, anyway, at least once a day, probably for white-lists. Unfortunately the giveaway period has ended, and I will probably have to purchase it next year. I cannot use Online Armor on Vista x64, so I am very happy I have the next best thing!!! ]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453154]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sun, 22 May 2011 13:05:32 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I'm way late to the discussion but...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453153]]></link>
        <description><![CDATA[I do believe it was either MBAM or AdAware or both that claim one detection rule can cover some tens of malware &quot;families&quot;. If I remember the way I read it, the rules look for similar snippets of code common to each family of malware to build a definition. This sounds similar to your fuzzy hashing explanation; but maybe I'm off kilter. I notice both the Lavasoft product and MBAM have fast scanning capabilities, so maybe this helps in that area as well.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3453153]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sun, 22 May 2011 12:56:03 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Like Sinisterslay suggested over in the spamslicing thread at Water Cooler]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438103]]></link>
        <description><![CDATA[Fuzzy hashing could be a strong weapon against message board spammers too... they'd have to figure out new ways to generate their SEO garbage, if they'd be automatically blocked from posting too similar responses.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438103]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 13:01:49 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Been there, done that]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438066]]></link>
        <description><![CDATA[I was one of those affected by that.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438066]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 11:53:16 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Not quite, if I understand correctly]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438080]]></link>
        <description><![CDATA[Artemis does compare hashes, but my sources point to it as cryptographic hashing not fuzzy hashing. That still would work as you explained it. Fuzzy hashing is a step further requiring less human intervention. If you have different information, could you please supply the links.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438080]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 11:51:45 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[My humble thanks]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438064]]></link>
        <description><![CDATA[A lot of people worked hard to get me here. They deserve the credit. Hope my son doesn't see this, he'll want a larger raise.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438064]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 11:40:23 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I thought so, thank you for commenting]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438015]]></link>
        <description><![CDATA[Also, I would be interested in learning more for future articles. Could you please contact me using the link in my profile.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438015]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 10:40:43 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[This is kind of what I was thinking too]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438040]]></link>
        <description><![CDATA[After first reading the description of how this type of hashing works, I didn't think it had much promise.  After all, malware code is going to exist of some key function calls amongst a sea of logic to steer the course, and illogic thrown in just to obfuscate the purpose.  It seems to me that the instructions necessary to make our lives miserable could be small enough, and scattered liberally enough, to skirt detection quite easily.  It's why pattern-matching is still the only established defense.  Unfortunately, we're still the only computers capable of doing this with any degree of success.Ultimately, it doesn't seem like there's any silver bullet to malware detection.- Cryptographic hashes will establish a baseline of a system.  After inventory is done, then it becomes easy to tell when something has changed.  Changes should arouse suspicion (but not quite to the point of causing panic!) and then trigger further investigation.- Fuzzy hashes are useful here, if the transformation is simple enough to be caught be reordering instructions or breaking them into groups that may or may not be linear and consecutive anymore.- A lot can be gleaned from watching the system calls made by a program.  There are some calls that will raise flags just by their existence.  But again, this alone isn't a sign of malicious intent.  (Partitioning and BIOS update tools to name a few obvious examples.)  This is of course old technology used in AV utilities since the beginning of such a market.- Finally, a lot of good comes from group think.  There are several online databases where filenames and sizes are recorded to aid savvy users curious about the purpose or intent of some particular executable.  Adding hashes to this would be a small task.  Populating them (voluntarily) by clients would increase ease of automated detection.  In this way, I could see AV software go open source with much less development overhead as compared to commercial ventures relying on manual analysis.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438040]]></guid>
        <dc:creator><![CDATA[nwallette]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 10:26:03 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[The article]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438012]]></link>
        <description><![CDATA[I really, really enjoy MK's writing.  The tone of the articles is that of a wise old grandfather telling stories.  The content is like listening in on a pub discussion amongst philosophers, programmers, engineers, and professors.How he manages to weld the two contrasting styles together into a successful dissertation, I'll never completely understand.    But I come away from it all feeling puzzled and enlightened all at once.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3438012]]></guid>
        <dc:creator><![CDATA[nwallette]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 10:14:56 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I suppose it's &amp;quot;cloud,&amp;quot; too?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437968]]></link>
        <description><![CDATA[Every silver lining has a cloud. This one (link) rained particularly hard on my users. =)http://www.infosecurity-us.com/view/8952/mcafee-security-software-flags-windows-kernel-code-as-malware/]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437968]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 08:44:17 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[McAfee's Artemis = fuzzy hashing]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437782]]></link>
        <description><![CDATA[This article was written as if this is some future technology. McAfee's enterprise VirusScan, versions 8.7 and newer, can already do this. Code named Artemis, the technology takes a hash of a suspicious file. Suspicious files are ones whose hash closely, but not exactly, match a known malware pattern. This hash is sent to McAfee's cloud-based Global Threat Intelligence, and a good/bad determination is made in milliseconds. The local host then treats the file the hash was made from as either good or bad based on that determination.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437782]]></guid>
        <dc:creator><![CDATA[mattyhiway@...]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 05:35:32 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[No]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437769]]></link>
        <description><![CDATA[I am more on the side of content protection.  But I will investigate ssdeep.  New ideas are always welcome and can bring to ways of protection.I'm glad that this paper initiate your exploration in your own field.  It highlights one of my belief in security:  cross fertilization is key.  BTW, I'm one of the authors.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437769]]></guid>
        <dc:creator><![CDATA[Wunderbarb]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 05:01:22 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Thank you, Steve]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437750]]></link>
        <description><![CDATA[You are correct about minimizing vulnerabilities. The image of the &quot;Dutch boy and his plugging the hole in the dike.&quot; come into mind.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437750]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 03:55:37 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I just took notes]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437738]]></link>
        <description><![CDATA[I capture all sorts of enthusiasm working with members of academia.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437738]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Wed, 06 Apr 2011 03:48:59 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[It shows.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437637]]></link>
        <description><![CDATA[It's probably one reason why you can make cryptographic hashing interesting even without calling on its mathematical sex-appeal No mean feat, that.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437637]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Tue, 05 Apr 2011 19:13:29 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Excellent Article!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437579]]></link>
        <description><![CDATA[Obviously, the best method to defeat malware is to always optimize code. Unfortunately, the method you described here, is probably the closest we will come until some genius thinks up another way. At least it keeps security wonks in the green!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437579]]></guid>
        <dc:creator><![CDATA[stevew@...]]></dc:creator>
        <pubDate>Tue, 05 Apr 2011 16:11:51 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Which one?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437593]]></link>
        <description><![CDATA[Everyone I talk to, I consider a mentor.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437593]]></guid>
        <dc:creator><![CDATA[Michael Kassner]]></dc:creator>
        <pubDate>Tue, 05 Apr 2011 15:24:15 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Luckily, I can imagine.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437541]]></link>
        <description><![CDATA[See this gray here? I am imagining it to be black.Now I am imagining it to be white.You've been talking to your mentor a lot, have you not? That there was ...cryptic.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-343262-3437541]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Tue, 05 Apr 2011 12:52:36 -0700</pubDate>
    </item>
    </channel>
</rss>

