Description
Norman SandBox Analyzer does not use the proper range for Interrupt Descriptor Table (IDT) entries, which allows local users to determine that the local machine is an emulator, or a similar environment not based on a physical Intel processor, which allows attackers to produce malware that is more difficult to analyze.
References
- 20070302 Re: Evading the Norman SandBox Analyzer mailing-list
- 20070228 Evading the Norman SandBox Analyzer mailing-list
- http://www.ntsecurity.nu/onmymind/2007/2007-02-27.html
- 20070303 Re: Evading the Norman SandBox Analyzer mailing-list
- 34955 vdb-entry