Google Security Engineer Issues Sophos Warning 89
angry tapir writes "Google security engineer Tavis Ormandy discovered several flaws in Sophos antivirus and says the product should be kept away from high value information systems unless the company can avoid easy mistakes and issue patches faster. Ormandy has released a scathing 30-page analysis (PDF) 'Sophail: Applied attacks against Sophos Antivirus,' in which he details several flaws 'caused by poor development practices and coding standards,' topped off by the company's sluggishly response to the warning he had working exploits for those flaws. One of the exploits Ormandy details is for a flaw in Sophos' on-access scanner, which could be used to unleash a worm on a network simply by targeting a company receiving an attack email via Outlook. Although the example he provided was on a Mac, the 'wormable, pre-authentication, zero-interaction, remote root' affected all platforms running Sophos. (Ormandy released the paper as an independent researcher, not in his role as a Google employee.)"
Can someone explain (Score:4, Insightful)
Re: (Score:2, Informative)
Because large organisations don't have users installing unmanaged anti-virus software on company owned endpoints.
Sophos (at least in my country) barely rates a mention in the consumer/home user anti-virus market, but they are massive in the enterprise market.
Re:Can someone explain (Score:5, Informative)
Security essentials is packaged for businesses as Forefront, and can be managed centrally.
Being "massive in the enterprise market" doesnt mean youre good at it.
Re:Can someone explain (Score:5, Informative)
Security essentials is packaged for businesses as Forefront
You're so last month! We're calling it System Center Endpoint Protection [microsoft.com] now, because it rolls off the tongue more naturally.
Re: (Score:2)
LOL seriously? Microsoft branding idiots strike again, it seems...
Next up:
A) How many MS products called "Windows" aren't actually operating systems?
B) How many MS products called "Windows" don't actually use a window-based UI?
C) How many MS products called "Windows" can actually run Windows software?
Lots of other brand names to pick on, but seriously, Windows makes it too damn easy. MS marketing needs to get over its love affair with that brand; the results are that the company confuses typical (uneducated
Re: (Score:2)
While I agree with the thrust of your argument, the AV product is named System Center Endpoint Protection because System Center is the application used to centrally manage it (and the rest of your OS and application deployment needs) and Endpoint Protection is a well understood term, so in this case the name actually makes sense. I suspect they just got lucky.
Re: (Score:1)
Ooh! How very *cloud* of it! Sign me up!
Re: (Score:3)
Yep. I used to look after Sophos in what should have been a very secure network.
Sophos set the virus signature updates out monthly on CD-ROM.
We replaced it with McAfee. Not much better, but at lest the updates hit every days or two.
Re: (Score:2)
I've used Sophos in both the small business and enterprise incarnations, and both of them had a centrally managed way to download updates as frequently as you required. This wasn't even recently.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Informative)
Then again, Dave Kennedy recently recommended MSE at a security conference I went to. Says it's much better than most of the other AVs he tested by far. It might be a desktop oriented product, but it does the job.
Re: (Score:2)
http://www.microsoft.com/en-us/server-cloud/system-center/endpoint-protection-2012.aspx [microsoft.com] - System Center Endpoint Protection
That's MSE with centrally managed enterprise control (formally known as ForeFront) and it's in use by a large number of organisations of substantial size (primarily because you "get it" along with other Microsoft products in your MS enterprise agreement).
MS Security Essentials on a Mac? (Score:5, Funny)
Re: (Score:2)
Or on Linux. Sophos is available for both.
I feel terribly sorry for anybody who uses them, but hey, they *are* available!
Re:Can someone explain (Score:4, Informative)
Why a user would not simply install MS Security Essentials and be done with it?
Among other considerations(like central management), I'm pretty sure that the MSSE license frowns on use in anything larger than a home/home office type environment.
MSE is for home or small business use. (Score:3)
Well for one thing, MSE only runs on Windows. Sophos runs on OS X and Linux as well. Remember, this is a business-oriented product.. In fact, one of the big concerns here is that there are so many bugs in the Sophos scanner that, if it's installed on a server (email, proxy/firewall, whatever), it's easy to compromise that server. This applies even if running Linux.
Re:Can someone explain (Score:5, Informative)
Re:Can someone explain (Score:5, Informative)
Bingo. I work at a large fortune 10 company with a few hundred thousand employees and it seems like a monthly occurrence where Sophos actively gets in the way. If it's not flagging benign content, it's causing resource problems on end-user systems. To call their support sluggish would be doing it a kindness. I believe we're actively looking for a replacement.
Re:Can someone explain (Score:5, Funny)
I could email you a PDF to install that replacement for you...
No, not a PDF on *how* to install it, one that *would* do so (or rather, cause Sophos to do so) as soon as it entered your email server! :-)
Re:Can someone explain (Score:4, Informative)
I generally still believe that most normal Windows users are better off with some AV software, but nowadays when they still get infected and I still have to fix their frigging machines for them, it starts making me wonder whether they really are better off - the malware people do have access to the AV software so they can tweak their malware till it passes all of them.
Even though I don't use AV software, I won't get badly affected by most drive-bys since my browser does not run as the same user account as the account I use to log in to windows. The drive-by might set up the autorun and start up hooks, but they only apply to the browser account, which I don't use to log in. That browser has noscript and adblock too. I also use different browsers for banking (so pwning my Slashdot browser won't get you my bank stuff).
And I know how to upload stuff to virustotal to check before running it. So if the 30+ different AV software can't spot the virus, the virus would not be detected either if I installed AV software on my computer. The difference is the installed AV software would be using up my system resources every day, whereas I only need to do that check once in a long while. And the AV stuff is often exploitable[1] and they also have a habit of marking important stuff (or almost everything) as malware every few years.
If you pwn my video driver or do other stuff (zero day OS privilege escalation) then sure you can pwn me, but I bet the AV crap won't stop you either.
[1] Sophos, Symantec, McAfee, etc if you can crash them, they are likely to be exploitable, and their crappy software runs with higher privileges than my browsers.
Re: (Score:3)
I don't know why the viewpoint your put forward is so unpopular on Slashdot, I've said the same sorts of things before and been modded into oblivion for it over the years.
It's a shame because it's true. If you're sensible in what you execute and don't visit untrusted websites with the likes of Javascript turned on in a browser running as administrator, and don't open fishy e-mail attachments etc. then there's really not much that can go wrong. You're not invulnerable by any measure, but the amount of times
Re: (Score:2)
I don't even think that having Javascript turned on is a problem. Not having it turned on pretty much makes the most of the web nonfuctional. Javascript isn't a vastly larger exploitation target than the html parser and DOM engine. Sure turning off parts of the browser makes you a lesser target, but it's not like, say, Java that has comparably a ton of holes.
Re: (Score:2)
Yes, I meant to say for untrusted sites. For most sites I visit I do have Javascript enabled, but if I was going somewhere untrusted then that wouldn't be the case.
Re: (Score:2)
So you're essentially betting that the untrusted site will exploit your javascript vm, versus, say, the good old image parsers, html parser, etc. :)
Re: (Score:3)
As I mentioned, if you run the browser as a different (even more restricted) user, the damage is usually limited, unless the malware uses a privilege escalation exploit. So even if you have javascript enabled, you could still be OK.
From a Computer Science perspective the AV vendors are attempting something "harder" than solving the Halting Problem. They are not always able to have the full inputs or the full description of the program, and "harm"/"evilness" sometimes is harder to define.
Halting Problem: giv
Re: (Score:2)
Heh. I'm sure this recent incident [sans.edu] didn't help either.
Re: (Score:1)
Re: (Score:1)
I've been recommending MSE for ages now as it seems to work fine for me. In a corporate environment, I have also long recommended the equivalent System Center Endpoint Protection (SCEP formerly Forefront Endpoint Protection). However, recent AV tests show that SCEP/FEP (and MSE which uses the same AV engine) are significantly worse than any of the competition.
Take a look at http://dennistechnologylabs.com/reports/s/a-m/2012/ [dennistechnologylabs.com] which puts SCEP at the bottom of the heap (although Trend doesn't fare much bette
Re: (Score:2)
I have a MAC.
I needed a decent freely available anti-virus scanner and Sophos came highly recommended. On a side note, On my Win7 machine at home I do use MSE and recommend to to anyone using Windows. I'm kinda paranoid so I also keep MalwareBytes and CCCleaner on my machines.
Re: (Score:3)
CCleaner isn't for the paranoid, it's simply a tool every administrator needs. Its functionality has nary nothing to do with viruses or malware. If you value your time, you won't be waiting for the microsoft-written add/remove software box to come up. It takes 15 fucking seconds to come up on a clean, less than a year old i7 system running Windows 7. Ccleaner's remove software pane comes up instantly.
Re: (Score:2)
Why a user would not simply install MS Security Essentials and be done with it?
Because if I can't trust Microsoft to make a relatively secure OS then there's no way in hell I'm trusting the same company/developers to make a properly working security software to run on top of the OS.
Third party security software makes sense.
release the lawyers! (Score:2)
Let the lawsuits begin!!!
Any wagers on whether they sue Google, based on some strained argument that they are responsible for his views, even when acting independently?
Re:release the lawyers! (Score:4, Interesting)
Sue for what? This was responsibly disclosed, and the facts are straightforward so it's not like they can sue for libel. In fact, Sophos requested and was granted a number of redactions and different phrasings throughout the paper. You can read about it in the document history section, near the bottom.
Yes, I read the whole paper... some 8 hours ago. Slashdot is slow.
Re: (Score:1)
Yeah I'll bet $10000 they don't sue.
Re: (Score:2, Funny)
Again with the $10,000 bets! Mitt, shouldn't you be focused on the election right now?
Re: (Score:2)
Yeah I'll bet $10000 they don't sue.
Get the model release,
'Cause Sasquatch took a picture of you.
Released.... in August! (Score:5, Informative)
This was the subject of a talk given at Black Hat (or was it DEFCON?) in August out in 'Vegas. Why it's news now suddenly is a mystery to me. The guy did thoroughly hack the product to include reversing it's signature encryption (homebrew crypto?!) and figuring out that some features simply didn't work. However at the time of the talk he also told the audience that he had been working with the company and that they had changed some things and would be switching to standard crypto. I'd still agree the company comes across as slimy since some of their claims were pure crap (some signatures apparently obviously machine generated despite claims they didn't do that etc.) but now months later to post this like it's news? Really? Maybe he should have had this paper ready to roll right after the talk?
http://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html#Ormandy [blackhat.com]
Re:Released.... in August! (Score:5, Insightful)
Oh yeah, I asked the guy after his talk if he was going to research any other AV products - his response was that no he wasn't. I wish he would or that perhaps someone else would. I'm pretty sure Sophos isn't the high bar in AV but I'm betting that there may be some others with some pretty crappy behavior out there that haven't been highlighted. Why not give them a shot too? Wasn't clear why these guys were such a target although he did mention their being used in various hardware products as an AV engine as part of the reason .
Re: (Score:2)
One has to wonder if the Sophos targeting was spite-driven in any way. Back in 2010, Sophos kind of trashed Tavis for disclosing a vul in Windows: http://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pleased-website-exploits-microsoft-zeroday/ [sophos.com]
Re: (Score:2)
For example, I like the way that Clueless calls something which was made public 5 days after MS was notified of it a "zeroday". Those with enough brains to count up to five would be more inclined to call that a "fiveday" exploit, assuming they like the "N-day" moniker at all, which not all do.
Re: (Score:2)
Actually, it's not even 100% out. There's a ton of stuff in there that he's vague about, like not mentioning a single specific area where his fuzzer found something, plus at least one area where Sophos specifically requested that a vuln be concealed, and he agreed.
I'm not going to call him a sell-out for doing so - responsible disclosure is a tricky business, and it looks like Sophos is (somewhat slowly, but apparently in good faith) fixing some of the more egregious issues, so there's no huge push to discl
Re: (Score:3)
Meh, he gave enogh detail on how their sandbox couldn't handle specific processor instructions and would bypass files that had them to be pretty effective against the AV I'd say. I think there was also a specific number of instructions the sandbox would run before passing the file too but I might be thinking of another AV.
I'll grant that he didn't give a script that one could just copy and paste but I think he gave plenty of information to a pretty interested audience that could act on it back in August! I
Official Sophos Response. (Score:5, Informative)
From http://nakedsecurity.sophos.com/2012/11/05/tavis-ormandy-sophos/ [sophos.com] and reprinted here in case of slashdotting...
As a security company, keeping customers safe is Sophos's primary responsibility. As a result, Sophos experts investigate all vulnerability reports and implement the best course of action in the tightest time period possible.
Recently, researcher Tavis Ormandy contacted Sophos about an examination he had done of Sophos's anti-virus product, identifying a number of issues:
A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed Visual Basic 6 compiled files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
The Sophos web protection and web control Layered Service Provider (LSP) block page was found to include a XSS flaw. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
An issue was identified with the BOPS technology in Sophos Anti-Virus for Windows and how it interacted with ASLR on Windows Vista and later. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
An issue was identified in how Sophos protection interacts with Internet Explorer's Protected Mode. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers cbegan: 5 November 2012 (56 days later)
Vulnerabilities were found in how Sophos's anti-virus engine handles malformed CAB files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
Vulnerabilities were found in how Sophos's anti-virus engine handles malformed RAR files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers began: 5 November 2012 (56 days later)
A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed PDF files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 5 October 2012
Roll-out of a fix for Sophos customers began: 5 November 2012 (31 days later)
Tavis Ormandy has provided examples of other malformed files which can cause the Sophos anti-virus engine to halt - these are being examined by Sophos experts. Sophos has seen no evidence of this occurring in the wild.
First reported to Sophos: 4 October 2012
Roll-out of a fix for Sophos customers will begin: 28 November 2012 (55 days later)
Best practice
Sophos customers are reminded of the following best practices:
1. Keep systems patched and up to date
2. Upgrade to the latest version of Sophos software to get the best protection
Responsible disclosure
Sophos believes in responsible disclosure.
The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products. On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach.
Re: (Score:2, Funny)
Best practice
Sophos customers are reminded of the following best practice:
0. Uninstall Sophos
Re:Official Sophos Response. (Score:5, Insightful)
What's worse?
1. That a security company had so many serious flaws in a flagship product
2. That the same security company considers it OK to take (on average) over 40 days to fix the issues. Remember that this is an Anti-virus product. One of the main use cases is to respond quickly to flaws in other software, to cover the period between the flaw becoming known, and the vendor releasing a fix.
3. That most clients won't see a problem with 2.
Re: (Score:1)
What's worse is Symantec or McAfee would throw lawyers at the problem and otherwise ignore it while counting their piles of money.
Re: (Score:2, Insightful)
1. Well now it has that many fewer flaws. Yeah, it seems like a lot, but I'm not convinced Sophos has significantly more flaws than any other software. The previous AV product we used (McAfee) was buggy as hell, all the time. How many patches has Windows or Linux, or any other AV product or frankly any other significant piece of non-trivial software product on the market received? I'm confident the answer is 'more than 8' in all cases.
2. 40 days for a vulnerability which has not been disclosed publicly and
Re: (Score:1, Troll)
4. That the OS in question is of such low quality that it requires third party band-aids to provide some level of protection against known exploits that remain unfixed for several years?
5. That nobody sees a problem with 4.
42 days later... (Score:2)
This fall, never before seen in cinema, a new type of hero, the geeky Sophos Patcher, finds himself fighting a virus in corporate HQ: The question of the universe and everything and zombies... Get ready to be patched...
Re: (Score:3)
Frankly, a bit of arrogance is pretty normal here. I mean, this guy does what most people not only can't do, but treat as a kind of black magic... and he does it well. Lots of vulnerabilities are found each year. Some of them are known to be serious enough to be a major threat (i.e. all layers of defense can be cut through to produce a working exploit). A handful of them have exploits actually written, though usually with benign payloads (popping up Calculator is a popular choice in the community). Tavis no
Re: (Score:2)
He's toned things down in the last year - have you read the original sophail from spring last year? He rips sophos' head off and pisses down their gullet. It's arrogant showboating, but absolutely perfect given the shambles he's covering. There's nothing wrong in making stupid companies which pretend that they are not stupid appear stupid.
Re: (Score:2)
http://nakedsecurity.sophos.com/2010/06/11/google-engineer-act-irresponsibly-microsoft-zeroday-disclosure/ [sophos.com]
Looks like Tavis did not too took it too well and has been since going after Sophos products.His tone in the latest paper is simply a reflection of the feud between the two.
Re: (Score:2)
Hospital (Score:2)
A hospital I worked at had a horrible USB stick virus (which I ended up getting). Sophos didn't work, and the IT guy I reported it to just updated the definition file, and tried to scan again (and it obviously didn't work).
The thing that annoyed me the most was there was no way I could easily forward the virus files to Sophos. No way of communicating with them. I guess they just don't care. Making software work costs money. That money is best spend on marketing.
Fortunately there was nothing important on my
Re:Hospital (Score:5, Interesting)
No way to easily report the files? You just email them in, a 30 second phone call to Sophos will get you the details.
In a previous role we would help clean users home computers from time to time, and we discovered a good number of new viruses. I submitted half a dozen viruses to Sophos that weren't being picked up by any virus scanners. They confirmed them all within a few days, and signatures were added within weeks. The whole process is incredibly easy.
Re: (Score:2)
I can't believe people pay for Sophos when they can't even add keep their virus definitions current. As much as I dislike Microsoft software, MSE is a much better bet.
Sophos tried to fix itself, already (Score:1)
Remember 2 months ago? http://tech.slashdot.org/story/12/09/20/1645202/sophos-anti-virus-update-identifies-sophos-code-as-malware [slashdot.org]
They are shipping totally untested code.
Official Official Sophos Response (Score:1)
Includes eight points of document, attack points, response and versions of product in which they were fixed and dates the fixed versions released.
Sophos KB Article 118424 [sophos.com]
Where this all started back in July 2012:
Small children shouldn't cast stones [sophos.com]
Ongoing "drama"
A dish best served with Ketchup [sophos.com]
The "sequel"
Never let a good Rant get the best of you [blogspot.com]
And today "When last we Left Lost.."