Forgot your password?
typodupeerror
Security IT

Google Security Engineer Issues Sophos Warning 89

Posted by Soulskill
from the you-have-been-called-out dept.
angry tapir writes "Google security engineer Tavis Ormandy discovered several flaws in Sophos antivirus and says the product should be kept away from high value information systems unless the company can avoid easy mistakes and issue patches faster. Ormandy has released a scathing 30-page analysis (PDF) 'Sophail: Applied attacks against Sophos Antivirus,' in which he details several flaws 'caused by poor development practices and coding standards,' topped off by the company's sluggishly response to the warning he had working exploits for those flaws. One of the exploits Ormandy details is for a flaw in Sophos' on-access scanner, which could be used to unleash a worm on a network simply by targeting a company receiving an attack email via Outlook. Although the example he provided was on a Mac, the 'wormable, pre-authentication, zero-interaction, remote root' affected all platforms running Sophos. (Ormandy released the paper as an independent researcher, not in his role as a Google employee.)"
This discussion has been archived. No new comments can be posted.

Google Security Engineer Issues Sophos Warning

Comments Filter:
  • by mrbluze (1034940) on Tuesday November 06, 2012 @11:10PM (#41902897) Journal
    Why a user would not simply install MS Security Essentials and be done with it?
    • Re: (Score:2, Informative)

      by Anonymous Coward

      Because large organisations don't have users installing unmanaged anti-virus software on company owned endpoints.

      Sophos (at least in my country) barely rates a mention in the consumer/home user anti-virus market, but they are massive in the enterprise market.

      • by LordLimecat (1103839) on Tuesday November 06, 2012 @11:50PM (#41903147)

        Security essentials is packaged for businesses as Forefront, and can be managed centrally.

        Being "massive in the enterprise market" doesnt mean youre good at it.

        • by clarkn0va (807617) <(moc.liamg) (ta) (teg.tpa)> on Wednesday November 07, 2012 @02:29AM (#41904269) Homepage

          Security essentials is packaged for businesses as Forefront

          You're so last month! We're calling it System Center Endpoint Protection [microsoft.com] now, because it rolls off the tongue more naturally.

          • by cbhacking (979169)

            LOL seriously? Microsoft branding idiots strike again, it seems...

            Next up:
            A) How many MS products called "Windows" aren't actually operating systems?
            B) How many MS products called "Windows" don't actually use a window-based UI?
            C) How many MS products called "Windows" can actually run Windows software?

            Lots of other brand names to pick on, but seriously, Windows makes it too damn easy. MS marketing needs to get over its love affair with that brand; the results are that the company confuses typical (uneducated

            • by jamesh (87723)

              While I agree with the thrust of your argument, the AV product is named System Center Endpoint Protection because System Center is the application used to centrally manage it (and the rest of your OS and application deployment needs) and Endpoint Protection is a well understood term, so in this case the name actually makes sense. I suspect they just got lucky.

      • Yep. I used to look after Sophos in what should have been a very secure network.

        Sophos set the virus signature updates out monthly on CD-ROM.

        We replaced it with McAfee. Not much better, but at lest the updates hit every days or two.

        • I've used Sophos in both the small business and enterprise incarnations, and both of them had a centrally managed way to download updates as frequently as you required. This wasn't even recently.

          • I don't remember when we switched. It was a few years back, but an update disc still finds its way to my desk every once in a while.
            • OK, I went back and checked date on the scripts I wrote to manage the changeover. It was Nov 2003. Jebus, where does the time go?
        • by MrIlios (2524820)
          I've used Sophos for around 7 years at different organisations and have always received updates automatically over the internet every few hours. Perhaps the installation on the 'very secure network' was set up a very long time ago and never reviewed - either that or the 'very secure network' was designed not to be internet connected and the update was specified to be delivered via physical media? I've had a few issues with the software in past, including recent wide-spread false-positive problem (http://w
    • by dclozier (1002772) on Tuesday November 06, 2012 @11:22PM (#41903005)
      I don't think there's an app for that. ;)
      • by cbhacking (979169)

        Or on Linux. Sophos is available for both.

        I feel terribly sorry for anybody who uses them, but hey, they *are* available!

    • by fuzzyfuzzyfungus (1223518) on Tuesday November 06, 2012 @11:26PM (#41903035) Journal

      Why a user would not simply install MS Security Essentials and be done with it?

      Among other considerations(like central management), I'm pretty sure that the MSSE license frowns on use in anything larger than a home/home office type environment.

    • Well for one thing, MSE only runs on Windows. Sophos runs on OS X and Linux as well. Remember, this is a business-oriented product.. In fact, one of the big concerns here is that there are so many bugs in the Sophos scanner that, if it's installed on a server (email, proxy/firewall, whatever), it's easy to compromise that server. This applies even if running Linux.

    • by Rennt (582550) on Tuesday November 06, 2012 @11:27PM (#41903043)
      Users don't install Sophos. It's the kind of product that is marketed to the CEO level (thus forced on enterprise IT departments).
      • by Ritz_Just_Ritz (883997) on Wednesday November 07, 2012 @12:00AM (#41903215)

        Bingo. I work at a large fortune 10 company with a few hundred thousand employees and it seems like a monthly occurrence where Sophos actively gets in the way. If it's not flagging benign content, it's causing resource problems on end-user systems. To call their support sluggish would be doing it a kindness. I believe we're actively looking for a replacement.

        • by cbhacking (979169) <been_out_cruising-slashdot&yahoo,com> on Wednesday November 07, 2012 @02:03AM (#41904095) Homepage Journal

          I could email you a PDF to install that replacement for you...

          No, not a PDF on *how* to install it, one that *would* do so (or rather, cause Sophos to do so) as soon as it entered your email server! :-)

        • by TheLink (130905) on Wednesday November 07, 2012 @03:22AM (#41904641) Journal
          And many here said I was stupid not to run antivirus software on my personal system. Fact is, Sophos and the rest of the AV idiots prove that the cure can be worse than the disease especially if you know how to avoid the disease.

          I generally still believe that most normal Windows users are better off with some AV software, but nowadays when they still get infected and I still have to fix their frigging machines for them, it starts making me wonder whether they really are better off - the malware people do have access to the AV software so they can tweak their malware till it passes all of them.

          Even though I don't use AV software, I won't get badly affected by most drive-bys since my browser does not run as the same user account as the account I use to log in to windows. The drive-by might set up the autorun and start up hooks, but they only apply to the browser account, which I don't use to log in. That browser has noscript and adblock too. I also use different browsers for banking (so pwning my Slashdot browser won't get you my bank stuff).

          And I know how to upload stuff to virustotal to check before running it. So if the 30+ different AV software can't spot the virus, the virus would not be detected either if I installed AV software on my computer. The difference is the installed AV software would be using up my system resources every day, whereas I only need to do that check once in a long while. And the AV stuff is often exploitable[1] and they also have a habit of marking important stuff (or almost everything) as malware every few years.

          If you pwn my video driver or do other stuff (zero day OS privilege escalation) then sure you can pwn me, but I bet the AV crap won't stop you either.

          [1] Sophos, Symantec, McAfee, etc if you can crash them, they are likely to be exploitable, and their crappy software runs with higher privileges than my browsers.
          • by Xest (935314)

            I don't know why the viewpoint your put forward is so unpopular on Slashdot, I've said the same sorts of things before and been modded into oblivion for it over the years.

            It's a shame because it's true. If you're sensible in what you execute and don't visit untrusted websites with the likes of Javascript turned on in a browser running as administrator, and don't open fishy e-mail attachments etc. then there's really not much that can go wrong. You're not invulnerable by any measure, but the amount of times

            • by tibit (1762298)

              I don't even think that having Javascript turned on is a problem. Not having it turned on pretty much makes the most of the web nonfuctional. Javascript isn't a vastly larger exploitation target than the html parser and DOM engine. Sure turning off parts of the browser makes you a lesser target, but it's not like, say, Java that has comparably a ton of holes.

              • by Xest (935314)

                Yes, I meant to say for untrusted sites. For most sites I visit I do have Javascript enabled, but if I was going somewhere untrusted then that wouldn't be the case.

                • by tibit (1762298)

                  So you're essentially betting that the untrusted site will exploit your javascript vm, versus, say, the good old image parsers, html parser, etc. :)

            • by TheLink (130905)

              As I mentioned, if you run the browser as a different (even more restricted) user, the damage is usually limited, unless the malware uses a privilege escalation exploit. So even if you have javascript enabled, you could still be OK.

              From a Computer Science perspective the AV vendors are attempting something "harder" than solving the Halting Problem. They are not always able to have the full inputs or the full description of the program, and "harm"/"evilness" sometimes is harder to define.
              Halting Problem: giv

        • by Idaho (12907)

          Heh. I'm sure this recent incident [sans.edu] didn't help either.

    • A consumer can and definitely should if they're using free antivirus. A business with more than 10 PCs cannot. It's against the EULA. They're supposed to get Forefront.
    • by Harassed (166366)

      I've been recommending MSE for ages now as it seems to work fine for me. In a corporate environment, I have also long recommended the equivalent System Center Endpoint Protection (SCEP formerly Forefront Endpoint Protection). However, recent AV tests show that SCEP/FEP (and MSE which uses the same AV engine) are significantly worse than any of the competition.

      Take a look at http://dennistechnologylabs.com/reports/s/a-m/2012/ [dennistechnologylabs.com] which puts SCEP at the bottom of the heap (although Trend doesn't fare much bette

    • by p.rican (643452)
      Easy.

      I have a MAC.

      I needed a decent freely available anti-virus scanner and Sophos came highly recommended. On a side note, On my Win7 machine at home I do use MSE and recommend to to anyone using Windows. I'm kinda paranoid so I also keep MalwareBytes and CCCleaner on my machines.

      • by tibit (1762298)

        CCleaner isn't for the paranoid, it's simply a tool every administrator needs. Its functionality has nary nothing to do with viruses or malware. If you value your time, you won't be waiting for the microsoft-written add/remove software box to come up. It takes 15 fucking seconds to come up on a clean, less than a year old i7 system running Windows 7. Ccleaner's remove software pane comes up instantly.

    • by acoustix (123925)

      Why a user would not simply install MS Security Essentials and be done with it?

      Because if I can't trust Microsoft to make a relatively secure OS then there's no way in hell I'm trusting the same company/developers to make a properly working security software to run on top of the OS.

      Third party security software makes sense.

  • Let the lawsuits begin!!!

    Any wagers on whether they sue Google, based on some strained argument that they are responsible for his views, even when acting independently?

  • by BLKMGK (34057) <.morejunk4me. .at. .hotmail.com.> on Tuesday November 06, 2012 @11:24PM (#41903015) Homepage Journal

    This was the subject of a talk given at Black Hat (or was it DEFCON?) in August out in 'Vegas. Why it's news now suddenly is a mystery to me. The guy did thoroughly hack the product to include reversing it's signature encryption (homebrew crypto?!) and figuring out that some features simply didn't work. However at the time of the talk he also told the audience that he had been working with the company and that they had changed some things and would be switching to standard crypto. I'd still agree the company comes across as slimy since some of their claims were pure crap (some signatures apparently obviously machine generated despite claims they didn't do that etc.) but now months later to post this like it's news? Really? Maybe he should have had this paper ready to roll right after the talk?

    http://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html#Ormandy [blackhat.com]

    • by BLKMGK (34057) <.morejunk4me. .at. .hotmail.com.> on Tuesday November 06, 2012 @11:26PM (#41903039) Homepage Journal

      Oh yeah, I asked the guy after his talk if he was going to research any other AV products - his response was that no he wasn't. I wish he would or that perhaps someone else would. I'm pretty sure Sophos isn't the high bar in AV but I'm betting that there may be some others with some pretty crappy behavior out there that haven't been highlighted. Why not give them a shot too? Wasn't clear why these guys were such a target although he did mention their being used in various hardware products as an AV engine as part of the reason .

      • by WD (96061)

        One has to wonder if the Sophos targeting was spite-driven in any way. Back in 2010, Sophos kind of trashed Tavis for disclosing a vul in Windows: http://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pleased-website-exploits-microsoft-zeroday/ [sophos.com]

        • by fatphil (181876)
          But on the flipside, more people have trashed Graham Clueless than have ever complained about Tavis.

          For example, I like the way that Clueless calls something which was made public 5 days after MS was notified of it a "zeroday". Those with enough brains to count up to five would be more inclined to call that a "fiveday" exploit, assuming they like the "N-day" moniker at all, which not all do.
  • by Deathlizard (115856) on Tuesday November 06, 2012 @11:32PM (#41903063) Homepage Journal

    From http://nakedsecurity.sophos.com/2012/11/05/tavis-ormandy-sophos/ [sophos.com] and reprinted here in case of slashdotting...

    As a security company, keeping customers safe is Sophos's primary responsibility. As a result, Sophos experts investigate all vulnerability reports and implement the best course of action in the tightest time period possible.

    Recently, researcher Tavis Ormandy contacted Sophos about an examination he had done of Sophos's anti-virus product, identifying a number of issues:

    A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed Visual Basic 6 compiled files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    The Sophos web protection and web control Layered Service Provider (LSP) block page was found to include a XSS flaw. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    An issue was identified with the BOPS technology in Sophos Anti-Virus for Windows and how it interacted with ASLR on Windows Vista and later. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    An issue was identified in how Sophos protection interacts with Internet Explorer's Protected Mode. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers cbegan: 5 November 2012 (56 days later)

    Vulnerabilities were found in how Sophos's anti-virus engine handles malformed CAB files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    Vulnerabilities were found in how Sophos's anti-virus engine handles malformed RAR files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers began: 5 November 2012 (56 days later)

    A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed PDF files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 5 October 2012
    Roll-out of a fix for Sophos customers began: 5 November 2012 (31 days later)

    Tavis Ormandy has provided examples of other malformed files which can cause the Sophos anti-virus engine to halt - these are being examined by Sophos experts. Sophos has seen no evidence of this occurring in the wild.
    First reported to Sophos: 4 October 2012
    Roll-out of a fix for Sophos customers will begin: 28 November 2012 (55 days later)

    Best practice
    Sophos customers are reminded of the following best practices:

    1. Keep systems patched and up to date

    2. Upgrade to the latest version of Sophos software to get the best protection

    Responsible disclosure
    Sophos believes in responsible disclosure.

    The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products. On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach.

    • Re: (Score:2, Funny)

      by Anonymous Coward

      Best practice
      Sophos customers are reminded of the following best practice:

      0. Uninstall Sophos

    • by Anonymous Coward on Wednesday November 07, 2012 @12:23AM (#41903299)

      What's worse?
      1. That a security company had so many serious flaws in a flagship product
      2. That the same security company considers it OK to take (on average) over 40 days to fix the issues. Remember that this is an Anti-virus product. One of the main use cases is to respond quickly to flaws in other software, to cover the period between the flaw becoming known, and the vendor releasing a fix.
      3. That most clients won't see a problem with 2.

      • What's worse is Symantec or McAfee would throw lawyers at the problem and otherwise ignore it while counting their piles of money.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        1. Well now it has that many fewer flaws. Yeah, it seems like a lot, but I'm not convinced Sophos has significantly more flaws than any other software. The previous AV product we used (McAfee) was buggy as hell, all the time. How many patches has Windows or Linux, or any other AV product or frankly any other significant piece of non-trivial software product on the market received? I'm confident the answer is 'more than 8' in all cases.

        2. 40 days for a vulnerability which has not been disclosed publicly and

      • Re: (Score:1, Troll)

        by flyingfsck (986395)
        or
        4. That the OS in question is of such low quality that it requires third party band-aids to provide some level of protection against known exploits that remain unfixed for several years?
        5. That nobody sees a problem with 4.
    • This fall, never before seen in cinema, a new type of hero, the geeky Sophos Patcher, finds himself fighting a virus in corporate HQ: The question of the universe and everything and zombies... Get ready to be patched...

  • A hospital I worked at had a horrible USB stick virus (which I ended up getting). Sophos didn't work, and the IT guy I reported it to just updated the definition file, and tried to scan again (and it obviously didn't work).

    The thing that annoyed me the most was there was no way I could easily forward the virus files to Sophos. No way of communicating with them. I guess they just don't care. Making software work costs money. That money is best spend on marketing.

    Fortunately there was nothing important on my

    • Re:Hospital (Score:5, Interesting)

      by myxiplx (906307) on Wednesday November 07, 2012 @02:27AM (#41904257)

      No way to easily report the files? You just email them in, a 30 second phone call to Sophos will get you the details.

      In a previous role we would help clean users home computers from time to time, and we discovered a good number of new viruses. I submitted half a dozen viruses to Sophos that weren't being picked up by any virus scanners. They confirmed them all within a few days, and signatures were added within weeks. The whole process is incredibly easy.

      • Signatures were added within weeks?!

        I can't believe people pay for Sophos when they can't even add keep their virus definitions current. As much as I dislike Microsoft software, MSE is a much better bet.
  • by Anonymous Coward

    Remember 2 months ago? http://tech.slashdot.org/story/12/09/20/1645202/sophos-anti-virus-update-identifies-sophos-code-as-malware [slashdot.org]

    They are shipping totally untested code.

  • Just in case someone wants the numbers.

    Includes eight points of document, attack points, response and versions of product in which they were fixed and dates the fixed versions released.

    Sophos KB Article 118424 [sophos.com]

    Where this all started back in July 2012:
    Small children shouldn't cast stones [sophos.com]


    Ongoing "drama"
    A dish best served with Ketchup [sophos.com]

    The "sequel"
    Never let a good Rant get the best of you [blogspot.com]

    And today "When last we Left Lost.."

1: No code table for op: ++post

Working...