All your anti-virus are belong to us

Dear all,

Sorry for the slightly strange title, I’m sure some of you get it. If not, click here. Today is the last day of TechEd and I am happy to say that it has been brilliant. An absolutely fantastic session by Laura Chappell this morning on network forensics and then a follow up security panel discussion with Laura and more top MS and non-MS security professionals. This was my biggest shock of the day:

During a routine threat analysis of anti-virus programs, some open source Trojan source code was downloaded from the web. It was then compiled and several scan engines were used on the binary. None of the engines picked up the Trojan, even though it was a well known threat.

The reason?

This binary had been compiled with Delphi 2005 and the original virus writer had used a previous version. Therefore the signature didn’t match.

I’ll leave you with that, and finish by saying goodbye for now and I hope to see a bit of Barcelona tonight as we finish early at 4:30pm and it will still be light.