Tuesday, February 08, 2005

On Marcos Velasco

Mr. Velasco mentions on his security site that he has not gotten as much attention in the past two years for all of his security tools and research than he has received for writing a Cabir clone and SIS file infector. I agree that it is not very heartening to see your good works ill received.

AntiSpy clears out a number of interesting tracking keys in the Windows registry. The readme file included in the install package covers most of what you would need to know about these keys. The key being that they're recreated on reboot, necessitating a tool like antispy to remove them. For that purpose it beats a general purpose spyware scanner like Spybot.

MV RegClean identifies invalid registry entries like other registry cleaning tools on the market. Its interface is clean with straightforward options for scanning the registry as well as performing backups.

Regarding Cabir (H & I) , according to Mr. Velasco these are clones of Cabir developed by reverse engineering the original Cabir worm. For someone involved in the computer security industry writing viruses is a no-no.

Regarding innovation, Mr . Velasco's creation of a SIS file infector/dropper while not a completely new technique it is the first implementation of an archive infector on the Symbian OS. For this he certainly deserves credit.

All the same he has stepped over the line, if you are in the business of securing computers do not endanger them at the same time.

No comments:

Protecting the ‘Metaverse ecosystem’…: Openness is healthy

Meta’s Reality Labs has an opening for “Malware Reverse Engineer” . Not an uncommon role, but this particular one is a bit more specific whe...