Paul's Security Weekly (Audio) No CVE and No Accountability - Ed Skoudis - PSW #851
5 snips
Nov 14, 2024 Ed Skoudis, a renowned cybersecurity expert and SANS instructor, joins the discussion, diving into fascinating topics like zip files within zip files that perplex antivirus software. He emphasizes the huge accountability gaps in CVE management, sparked by vendors ignoring vulnerabilities in end-of-life software. The conversation also highlights this year’s Holiday Hack Challenge, focusing on its engaging structure and innovative designs. Additionally, they discuss the evolution of cybersecurity, from legacy system challenges to the importance of proactive vulnerability research.
AI Snips
Chapters
Transcript
Episode notes
Zip File Concatenation
- Concatenating zip files evades some antivirus software, as demonstrated with 7-Zip.
- 7-Zip developers acknowledge this is not a bug but won't change the behavior.
Evading Antivirus with Zip Files
- Hide malware within concatenated zip files to confuse antivirus software.
- The antivirus may only see the outer zip file, missing the malicious content inside.
CVE Accountability for EOL Software
- End-of-life software poses a security risk because vendors often refuse to issue CVEs.
- This lack of CVE hinders vulnerability scanning and patching, leaving systems vulnerable.