List, I've prepared a paper to accompany a presentation at blackhat las vegas discussing Sophos Antivirus design. It might be of interest to those evaluating or deploying Sophos Antivirus. http://lock.cmpxchg8b.com/Sophail.pdf I've also created some tools to help understand and dump Sophos signature files, which I'll release soon. My impression of Sophos technology is not positive, however Sophos have informed me they're making some changes in response to my paper in the next major release, including a real authentication scheme, a new design for the BOPS subsystem, and to start phasing out their use of SPMAA. Feedback welcome, you can email me directly. Tavis. -- ------------------------------------- taviso@xxxxxxxxxxxxx | pgp encrypted mail preferred -------------------------------------------------------
