Re: [Full-Disclosure] AV Naming Convention

nobody_at_localhost
Date: 08/10/04

  • Next message: Frank Knobbe: "Re: [Full-Disclosure] (no subject)" 
    To: full-disclosure@netsys.com
Date: Tue, 10 Aug 2004 09:52:08 -0700

    Randal, Phil wrote:
    >>I have to agree with Todd, the naming convention is now right
    >>useless for the normal population and make keeping up with
    >>viruses on a corporate level that much harder. AV companies
    >>are always trying to beat the other company and this leads to
    >>very little information sharing between the companies on new
    >>viruses, etc.
    >>
    >>Maybe a foundation should be created. This foundation could
    >>give a seal of approval to all AV corporations that join in.
    >>We are starting to make rules for patch management over at
    >>patchmanagment.org. Why couldn't a group work with AV names
    >>and the first company that finds and IDs it correctly gets to
    >>name it in the foundation. Just a dream, I would guess.
    >
    >
    > This completely misses the point. When a new virus is discovered, it is
    > essential that there is a RAPID response to the threat. The idead of
    > handing the critter over to a committee to decide it's name is, quite
    > frankly, plain bonkers.

    I think you missed some of his point, his is not saying a committee
    should name it, he is saying whoever gets there first gets to name it.

    > I for one would rather all the antivirus
    > vendors came up with their own names if it meant that
    > detection/disinfection patterns came out hour earlier.
    >
    > Cheers,
    >
    > Phil
    >
    > ----
    > Phil Randal
    > Network Engineer
    > Herefordshire Council
    > Hereford, UK

    Actually, I was thinking the exact same thing, I'd like to set up a AV
    vendor neutral, FD style virus repository. I'd require a user cert for
    anyone who wants to "deposit" a new virus and the first to deposit the
    new virus would get to name it. It would be assigned a GUID, so that a
    computer friendly identifier was available.
    There would be an RSS feed as well as various push feeds.
    Lineage could be discussed and mapped.
    Other vendors could add their names to that record with information
    about what virus def file name the virus first appears in.

    If it turns out that more than one group submits the same virus, then
    those "dups" would be discarded from the db, thus encouraging AV vendors
    and other groups to post new viruses asap so that everyone has a chance
    to download them and start researching them.

    Fear of the government labeling me a terrorist gives me pause though...

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Frank Knobbe: "Re: [Full-Disclosure] (no subject)"

    Relevant Pages

    • Re: worm SCO.A removal of from windows98
      ... Liveupdate doesn't scan your machine for viruses. ... Different vendors choose different names for viruses, ... field to attempt to spread the virus further. ... SCO.A, MyDoom, and Novarg are all names for the same worm. ...
      (microsoft.public.scripting.virus.discussion)
    • The Truth About AIDS. Biological Warfare at is finest
      ... AIDS was created in a test tube and released into the population. ... Contrary to widespread speculations that human AIDS viruses arose from ... National Cancer Institute researchers noted that "only one virus ... virus RNA, associated with leukemia and sarcoma development, and ...
      (rec.org.mensa)
    • Re: WHO: Swine Flu Could Trigger Global Pandemic
      ... all worked up over the right of humans to temporarily camp in The ... Its a natural process, viruses are able ... sense of what a virus is and how it works. ... host as it is replicating, and transfer this genetic information to a ...
      (alt.gathering.rainbow)
    • Re: I switched to Firefox because--Solved
      ... Mac OS 9 and earlier had some virus problem, but none so far for Mac OS ... Earlier Mac viruses do not impact Mac OS X. ... > was AutoStart 9805, the first known Macintosh worm, which originated in Asia ...
      (microsoft.public.windowsxp.general)
    • Re: GAH! Pandemic fears excuse for power grab!
      ... INFLUENZA PANDEMICS AND OUTBREAK OF H5N1 VIRUS IN HONG KONG IN 1997 ... Origin of Pandemic Viruses That Emerged in the 20th Century ... Four human influenza pandemics have occurred in this century. ... involve genes encoding HA (high cleavability due to multiple basic amino ...
      (rec.martial-arts)
    • Quantcast