This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0]
Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with certificate revocation for anything bad that managed to be signed by a trusted certificate. That means you have both a whitelist (that is append only) and a blacklist (to fix mistakes in the append only whitelist).
A whitelist might not even work. In practice whitelists end up with everything in the world on them. It might not be that hard to find a whitelisted program that would let you do the thing in the article just by passing it the right arguments. Certainly anything with a buffer overflow in it would work and there are probably a hundred other ways to do it too.
Yep, one place where I used to work, the owning company's policy had "Linux" on its whitelist, but not "Wireshark". Even though the company was developing software which communicated over the network in various protocols.
0: http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf