Hello, welcome to the Friday, April 7th, 2017 edition of the Santernet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Researchers at the Technical University of Brownschweig and the University of Guttig came up with an interesting trick to actually help antivirus in your attack.

Essentially, what they're after here is false positives.

Now, false positives we talked about often here on the podcast, but in this particular case,

it is sort of false positives that are specifically introduced by the attacker.

As a little example, if you are using, for example, an antivirus signature,

something that is detected as malicious as a password or a username when you're logging in to a site, that username will almost certainly end up

in a log file and Antimalver may now consider this log file malicious and depending on the

configuration of your antivirus may actually even delete it. Another scenario they're proposing is the use of the signatures

in cookies. So you are tricking a user to visit your malicious website. You are returning a cookie

that contains a string that, again, triggers antivirus signatures with that string.

You then essentially lock up the user's cookie database because it is now blocked by anti-malvary.

I'm not sure how practical all of these attacks are, but it's certainly an interesting attempt to show that signature-based

Malware detection certainly hits its limits.

There is of course the famous ACAR pattern, which is standard pattern that is usually used

for antivirus testing and could be used in this capacity here.

In this particular attack, what they actually did is that they sort of reversed some of the bite patterns

that antivirus looked for based on current samples they collected.

And while we are kind of used to this from consumer level device, it's sad to see that

Cisco had to patch yet another default credential vulnerability.

This time it affects the 1830 and 1850 series access points, particularly the Mobile Express software that ships with these

access points.

...