SecurityTube

Description: AV Bypass, if you want to see it

Tags: aking1012 , Andrew King , AV bybass ,

Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.

Comments:

• Disturbed on Thu 30 Jun 2011
  
  Of course interested to continue this series, waiting for more, and with an example it would be great. Thanks for this.
• typeon3 on Thu 30 Jun 2011
  
  more !
• Andrew on Thu 30 Jun 2011
  
  Okay so there's interest. I have more...much more. Just wanted to make sure I wasn't wasting time.
• Da_Blubb on Thu 30 Jun 2011
  
  Would be nice if you could post more of this stuff :)
• Andrew on Thu 30 Jun 2011
  
  @Da_Blubb - I don't have the video made yet...I do have about a 25 page paper that proposes the thesis if you prefer reading. I'll put together more videos soon. Getting ready to do my weekend with my possible future wife(if she doesn't refuse). Anyway, I do plan to post more, but it will be at least Monday before I do. If you want HD keep an eye out here and download it as soon as it comes out. I don't have the money to pay for a vimeo premium account so I only get 1 HD per week.
• Da_Blubb on Thu 30 Jun 2011
  
  Well, HD is nothing for me... Im living in a village without DSL, so theres no need :P
  But i got one wish, could you upload those videos on a filehoster or somewhere else? Vimeo need a specific port wich i cant offer. So i cant even download those videos direct from vimeo :'(
  Im from Germany, so excuse me for my english.
• 3ntropy on Thu 30 Jun 2011
  
  Hello, Andrew ! First of all thanks for the video. Another thing i wanted to ask you as I heard you are working on your thesis, is it acceptable to write a thesis on computer memory exploitation or smartphone spawning? Thanks, I am not a black hat or smth like that. Thanks in advance.
• NeOwA on Thu 30 Jun 2011
  
  Very intresting ! Thank you for the video and the knowledge sharing ! I hope we will have soon some next parts :)
• m0ei on Fri 01 Jul 2011
  
  Interesting, Thx for the video Andrew.
• Acebond on Fri 01 Jul 2011
  
  Hi, looks very interesting and I would love to watch although probably a bit advanced for me. I do hope you continue the series I reckon I’ll learn quite a few things about AVs and how viruses/trojans bypass them.
  Thanks, Ace
• RFinfotrader on Fri 01 Jul 2011
  
  Bring out the meat and potatoes Andrew. Slide show seemend a little dark. Anticipate next video man
• Ignatius on Fri 01 Jul 2011
  
  Hi Andrew. I think you're on to a winner with this proposal! I know you said that you were just testing the water to see how such a series would be received and I'd be surprised if anyone said something like "go away and don't waste your or my time". I'm looking forward to the series, not only to learn more about the topic but also about how to use the various tools that you listed in this intro properly. Whilst I have played around with some of them, I've been self-taught so it's been rather like the "blind leading the unsighted" (no offense intended to anyone).
  
  The speed of production of your videos isn't an issue for me. I'm perfectly happy to have one each week so I have chance to digest the material, test it out and post questions/comments. I'm grateful for the time and effort that you plan putting into this series.
• Andrew on Fri 01 Jul 2011
  
  @3ntropy - I can't say for some universities. For WGU.edu(which I am attending), as long as you can make a case for a problem/PoC/solution scenario(like a business case) it is acceptable.
• Andrew on Fri 01 Jul 2011
  
  @3ntropy - I can't say for some universities. For WGU.edu(which I am attending), as long as you can make a case for a problem/PoC/solution scenario(like a business case) it is acceptable.
• FR4NCIXC0 on Fri 01 Jul 2011
  
  @Andrew: My Friend, how is that that you throw a flare and you expect for us no to see it.
  Of course with all want to see all you got, specially the encoder stuffs I have been wandering what kind of weed do I have to buy to make an encoder... and now you are going to point me in the right direction. If you have any book that can be consulted about any topic, just mention it on the video.
  
  Keep going my friend!!
  Anything posted here is not a waste of time.
• RonS on Fri 01 Jul 2011
  
  Definitely interested. I'd like to share with my AV team and my ISSA group. I think any speed you can manage for production is okay. Thanks.
• Andrew on Fri 01 Jul 2011
  
  @all - Thx for the comments. I'm working on the next two.
• Andrew on Sat 02 Jul 2011
  
  here's the plan for videos in this series:
  pt1 intro
  pt2 scaffold
  pt3 RWX
  pt4 intel to att
  pt5 inline asm test
  pt6 general design
  pt7 step1 save registers
  pt8 step2 clear registers
  pt9 step3 set registers
  pt10 step4 synchronize chains
  pt11 step5 use registers
  pt12 step6 nop insertion
  pt13 step7 jmp mixing
  pt14 step8 register restoration
  pt15 step9 re-encode on completion requisites
  pt16 step10 re-encode on completion
  pt17 testing with a real detected payload
  pt18 go pwn some stuff - or get paid depending...
  pt19 huge pitfalls of this approach
  pt20 fixing those pitfalls
  pt21 a FUD dll based penetration testing tool/endpoint
• in0cula on Sat 02 Jul 2011
  
  great, hope you'll continue to share with us your knowledge.
  Thank you
• LHYX on Sat 02 Jul 2011
  
  I like to see more XD
• Vivek-Ramachandran on Sat 02 Jul 2011
  
  Andrew, I am eagerly awaiting to see all these vids :) and also to finally meet you in person this year at Defcon!
  
  Great stuff buddy! keep rocking!
• m0x on Sun 03 Jul 2011
  
  I'd like to see more, definitely.
• dragonflare921 on Sun 03 Jul 2011
  
  would love to see more of this. ive been itching to get back into some programming.
• xseni32 on Mon 04 Jul 2011
  
  It would be one of the more interesting video series in securitytube ! why do you think you'll waste your time ^___^ ?
  We're all waiting for you and support you .
  I'll watch this until the end of the series , don't worry :)))
• rico.trs on Mon 04 Jul 2011
  
  Some interesting stuff,I think this tutorial series will be very usefull.
• tictactom on Tue 05 Jul 2011
  
  I would agree this would not be a waste of time at all. This may be some what advanced so breaking it down may be a pain, but I think this will be worth while information here. Cant wait to see the rest of the series.
• Andrew on Tue 05 Jul 2011
  
  @all - video 2 is re-encoding. I'm working on doing a 1 video a week or so release cycle for the series. there's going to be a lot of dry stuff in this though. if i just said "so insert an inline asm nop in your scaffold dll" i would get a lot of "?? huh, me no understand ??" type of responses, so baby steps. It should get there.
• tictactom on Tue 05 Jul 2011
  
  Sounds good.
• Ignatius on Tue 05 Jul 2011
  
  @Andrew - I think that many of us are inexperienced with this sort of material so we'll welcome the baby steps. In addition, we've all become familar with the format of Vivek's videos that frequently take complex topics and present them in a way that's easy to understand and entertaining. This approach certainly makes me want to research more.
  
  I hope that the threads associated with your videos generate discussion to explore other aspects of what you've presented, just as the discussions related to the various WLAN Security Challenges that Vivek posted have done.
• Sandstone on Wed 06 Jul 2011
  
  Sounds really interesting, please continue work on this! it's really great someone is sharing this info :D

Login to post a comment