Re: malicious code

From: "Jeff Williams" <jsquared@erols.com>

> I'm not looking for technology. It is going to be a very long time before

ISTR one malicious logic of recent years (TCP wrapper trojan, 1999 ?) had different behaviour according to the source port of the connection.

Calling crypt(3) and comparing the result to a stored string might be another indicator.

Features such as starting a shell (or anything else) in a program you know shouldn't do that would be another. That's one of the things you can prevent with technology (such as SubDomain).

I agree that anything approaching comprehensive detection is hopeless. Received on Tue Jan 28 02:42:59 2003