Antivirus Software Could Make Your Company More Vulnerable (csoonline.com) 74
itwbennett writes: Since June, researchers have found and reported several dozen serious flaws in antivirus products from vendors such as Kaspersky Lab, ESET, Avast, AVG Technologies, Intel Security (formerly McAfee) and Malwarebytes. Many of those vulnerabilities would have allowed attackers to remotely execute malicious code on computers, to abuse the functionality of the antivirus products themselves, to gain higher privileges on compromised systems and even to defeat the anti-exploitation defenses of third-party applications. And evidence suggests that attacks against antivirus products are both possible and likely. Some researchers believe that such attacks have already occurred, even though antivirus vendors might not be aware of them because of the very small number of victims. Among the emails leaked last year from Italian surveillance firm Hacking Team there is a document with exploits offered for sale by an outfit called Vulnerabilities Brokerage International. The document lists various privilege escalation, information disclosure and detection bypassing exploits for multiple antivirus products, and also a remote code execution exploit for ESET NOD32 Antivirus with the status 'sold.'
Re:Not quite AV, but close (Score:5, Insightful)
Every piece of software is a potential security hole. AVs, firewalls, encryption layers like SSL or what not constitute no exceptions.
Re:Not quite AV, but close (Score:4, Insightful)
Exactly, which is why things should be kept simple - the less code you have running the less you have to keep track of.
Re:Not quite AV, but close (Score:4, Informative)
I'll half agree with you... I think I know what you're getting at, but I think it's worth clarifying a bit. After all, it's not like any arbitrary code on a machine is vulnerable to random attacks from the internet.
Rather than talking about simplicity - because let's face it, that will never happen - we need to focus on minimizing and hardening the attack surface. For instance, if my personal machine sits behind a router, arbitrary incoming traffic from the internet is blocked. Anything that isn't blocked then has to make it past my personal machine's built-in firewall, which would tend to reject most anything else. Thus, it's likely that 99.999 percent of the code on my machine (any modern OS is *horribly* complex by nature) is completely immune to random internet-based attacks, at least ignoring user actions like launching an infected program or script.
A good example of minimizing attack surface is Amazon's recent release of a very tiny TLS library called s2n. With only 6000 lines of code, it's *much* easier to vet and declare secure than the feature rich but dangerously bloated OpenSSL library, which may put servers at risk with features they never used. Even the name (signal to noise) indicates the intent, which is to keep the library tiny and focused. We're discovering that there's a danger to letting code grow infinitely large and complex, and not depreciating it, because even if those old features work, they still may contain security issues. I'd be extremely surprised if s2n had any serious security flaws in its implementation simply due to its small size - there's just not as much that can go wrong there.
Re: (Score:1)
completely immune to random internet-based attacks, at least ignoring user actions like launching an infected program or script
Or using a web browser to view a news article on Forbes triggering popunders with malware exploits, or looking at a page which happens to contain a PNG file designed to exploit a buffer overflow in the PNG parsing library, or running AV software which scans a ZIP file that happens to be crafted to exploit a vulnerability in the archive extraction library. Or really installing any software, ever.
If there's two things we could do to mitigate the damage caused by these exploits, it's:
1: Stop using C and C
Re: (Score:2)
Go ahead and use Modern C++. Properly used (and by that I mean doing things that can be easily checked by a code reviewer), it's a lot safer than C or older C++.
Re: (Score:2)
While your desktop is likely pretty well protected against worms by default (ignoring the fact it's probably punching holes in the firewall with UPnP) it's /entirely/ irrelevant to the attack under discussion.
This is a privilege escalation attack on people who are doing the 'right thing' and not running all their web browsers as admin. i.e. corporate/government networks that tend to enforce AV and have moved on from the Windows 98 model. Access from the internet side is not required.
It's like you're saying
Re: (Score:2)
Yep, I didn't mean to imply otherwise. I was specifically responding to the parent's notion that "simplicity" is what's needed, but my argument is that's somewhat impractical given the size of modern software, so you need to focus more on the software that's exposed to potential attacks. And obviously, as this article points out, that includes our AV software.
It's the reason many of us were upset with Mozilla for adding that stupid "Pocket" feature - that product is likely to have security holes, and the
Re: (Score:2)
Seen it often (Score:2)
on domestic computers. AVG in particular just seems to let malware through - advertising scams, mostly, although once it was ransomware.
It's particularly annoying that I can't deactivate them to run other scanners to remove the crap they've allowed in. Anti-malware should NOT install and run under the SYSTEM account.
I Don't Think You Understand (Score:1)
I don;t think you understand. What you've seen is a failure to detect a particular virus. But, the story is talking about vulnerabilities in the antivirus software itself. So, AVG gets exploited and is then used to grant administrative access to a Windows system, something that would not have been possible if it wasn't for the weakness in the AVG agent and the fact that it runs with system level privileges.
My suspicion is that, if you were affect by such a virus, you would never know it.
Many of these are ASLR related FAILURES of devs (Score:1)
If I've read correctly (and tell me if I'm wrong, no doubt) but most of these latest vulns in the AV apps themselves were related to faulty or no-implementation of ASLR memory randomization and as such allow overflow and direct injection attacks into memory. All the major companies report it as a closed bug.
Is there some other APT type attack going on that isn't mentioned in the original disclosures?
cost and benifit (Score:5, Insightful)
Re:cost and benifit (Score:4, Insightful)
If it's any help (and if you're referring to desktop Windows computers behind standard domestic NAT-ed router/firewalls), then with the exception of WSE since it came out (WinVista?), I've *never* run anti-virus on any Windows installation in our 4-person home in over 20 years.
About once a year I boot each machine from something like Trinity Rescue Disk and run a sweep using two or three different anti-virus packages. This might come up with perhaps one or two low-risk infections (usually Java), but that's it.
I assume therefore that if the people using the machines are not in the habit of visiting certain types of website, and aren't inclines to open attachments they're not expecting, then all will be well.
Re: (Score:2)
Absolutely. I too have never ran any virus package on any of my machines starting from the days of Win 3 and winsock. I have never had an infected machine. I scan every six months and receive the same results.
For button pushing users I support, the only packages I would trust were the packages distributed by Kaspersky or Panda. Everything else I've ever seen is excellent in the over use of your funds and resources.
Re: (Score:2)
Re: cost and benifit (Score:2)
As someone who used to support these users with infections I can tell you almost everyone of them had Norton, an expired av package, or no AV at all whatsoever.
So I highly disagree. Though most had XP and 7 is much more secure by default. av software and adbkocking make a HUGE difference.
Though today I now think ad blocking add ons are the best security on the planet! Ads are how malware gets on and being a sophisticated Slashdot user you do what most don't.
FYI nod32 found a Trojan on Slashdot a few years a
Re: (Score:2)
I assume therefore that if the people using the machines are not in the habit of visiting certain types of website,
Which type of website would that be?
Years ago, when Investor Village was still young, they had a problem with an advertiser serving up malware.
Just the other day, Forbes was caught serving up malware in their ads after telling people to whitelist them.
Various other web pages not affiliated with what you might call the "seedy underbelly" of the Internet have been caught serving up malware in the
Re:cost and benifit (Score:5, Interesting)
I ran XP and later Win7 with nothing more than Microsoft Security Essentials, and never had an infection. Ran CCleaner and Malwarebytes regularly and never found a thing.
Re: (Score:3, Funny)
"and never had an infection"
That you know of.
Re: (Score:2)
Have a nice day, but please don't come again. Idiot.
Re: (Score:3)
I was, at one time, tasked to incorporate CCleaner as a 'plugin' to an app I was working on.
AFAIK, CCleaner does absolutely no virus checking. The version I was working on would 'clean up' your registry, temp directory, and a couple other spots, but not check for viruses per se.
And having looked through what it purports to do in the way of registry element deletion, I would be exceptionally cautious about letting it run free. Some of the bits it wanted to clean up as unused were not unused/useless on the
Re: (Score:2, Interesting)
Think about it: if you were writing malware, wouldn't you test to make sure it could get past the major antivirus packages? That's just due diligence. If your QA didn't do that, you would fire them.
And if that weren't bad enough, some of the Antiviruses are worse user experience than actually getting a virus......
Re: (Score:2)
Not so true, in fact some generate false positives because of various techniques used to infer a risky file.
Which part of what I said do you consider not true? That Antivirus fails a lot of times? Here's a citation for you [forbes.com], with a quote:
no single AV vendor can detect most malware most of the time.
some detect novel malware, in two ways (Score:2)
I'm not GP, but you asked what part of your post is not true. This part:
> The problem with AV software is, it will only catch threats that are already known
That's true of SOME AV software. Other types use heuristics similar to spam filters to detect LIKELY threats (code that has been obfuscated in ways bad guys use, executables with names like *.com or *.jpg.exe, etc). Another type sometimes actually runs the code in a vm and looks for any changes to registry entries or files outside of the designat
Re: (Score:2)
That IS a problem for type A, partially for B, not (Score:2)
> Those things are all easily overcome by malware writers by testing against existing antivirus. If the Antivirus detects it, then keep changing the malware until the Antivirus doesn't detect it.
Those are called crypters and you're right, those are currently a significant problem for type-A, signature based AV. However, signature based is still useful. Consider all the Nigerian Prince scams and similar that you see. Most is immediately recognizable due to the grammar, etc. I would be absolutely trivial
Re: (Score:2)
Further development in this area is worthwhile.
Indeed.
Re: (Score:1)
Re:cost and benifit (Score:4, Insightful)
Yes its possible if you don't do stupid things and don't foul up Windows security. the vast majority of liabilities/vulnerabilities on modern Windows desktops arise directly from PBCAK (Person between chair and keyboard). I personally use a mixture of Slackware and OSX at home but I do security work and I can tell you if you are following the rules below on Windows 8 and later its very unlikely anyone is going to pop your box.
[Stuff that comes out of box if you don't f**k it up]
0) Have a strong password.
1)Leave UAC enabled.
2)Leave the windows firewall on and with recommended settings, even if you are behind NAT and or some other hardware firewall.
3)Install updates promptly.
4)Don't run things from sources you don't trust.
4a) If you really must run stuff from untrusted sources have a separate user account to download and execute that stuff with that you do not use to handle any information you don't want public, and for goodness sake don't let it elevate.
5) Do not install Flash
6) Do not install the Java browser plugins.
[Mostly painless things you can do to really harden windows boxen]
7) Install EMET
8) Install KB2871997 and disable wdigest
[annoying but still a good practice]
9) logoff (not just lock) your desktop when not in use. Optionally suspend or hibernate the system, instead.
Re: (Score:3, Informative)
Seriously, if windows needs a 'security' kludge like UAC to stay secure, then it's not really secure at all.
That is seriously ignorant. What UAC is really under the hood is very similar to having two accounts. One privileged and one less so. The shell has some smarts in it to spot when things that are likely to need escalation such as programs named setup.exe are called and asks, when the user is privileged. Its also a little more convient for the user because the environment etc is shared, and depending on the registry settings they maybe don't need to type their password, and because the OS takes special st
Re: (Score:2)
Seriously, if windows needs a 'security' kludge like UAC to stay secure, then it's not really secure at all. The whole point of OS security is to be able to run stuff that is 'untrusted' with a reasonable expectation that it won't totally compromise the system.
You are completely and utterly ignorant. UAC is just process elevation or a separate account and is pretty much how all OS's handle this. The simple rule on security is if you allow someone elses code to run on your machine then it is no longer your machine. remote vulnerabilities are reasonably common, but there is ALWAYS a little shit ton of local escalation vulnerabilities available to just about every OS and system level apps, If you can't find one for your chosen OS then chances are you aren't looking
Re: (Score:3)
FTFY.
Re: cost and benifit (Score:1)
Re: (Score:1)
3)Install updates promptly.
4)Don't run things from sources you don't trust.
Those two are mutually exclusive for Windows 7 users. I no longer trust Microsoft updates, thanks to the spyware that is Windows 10.
Re: cost and benifit (Score:2)
False.
Most Trojans get on by ads from 3rd party networks visiting a website.
Re: (Score:1)
Re: (Score:3)
I'll also echo what many have said - WSE and SPI Firewalls (
Re: (Score:1)
I did so, for quite some time actually, just to prove that it could be done. I still functioned - pretty much like normal, and had no known malware compromises. I had no resident AV but would scan once in while (with multiple non-resident apps like AVG and MBAM) and was fine. Don't download things from bad places, use a firewall, get thee behind a NAT, do not allow scripting to run as a general rule, and use least privilege practices.
This is possible to do with Windows, albeit a bit tedious to set up and pr
Re: (Score:2)
Symantec is not on the list. Lucky surprised me.
Must have been filtered by their antivirus...
Learned helplessness (Score:4, Interesting)
The main vector for malware is people doing what computers tell them to do. Users have become so accustomed to oversight and "someone else" taking care of their computers that they feel they do need to "update their media player program", "install a codec" and "download this antivirus to remove the trojan horse" when their computer tells them to. That's what the pros do, right? Update and install something and then everything works. And Windows has a "security center" which lambasts the users with red exclamation marks until they download an antivirus, and now that website has found something and offers a free antivirus software. Phew, close one.
Microsoft, Google, Apple, etc. need to stop their programs from telling people how to keep their computers safe. If you know how, then just do it. If you don't know, then what's the point in warning the users: They certainly won't know what to do. Either way, shut up about it. When the computer tells them it has a virus, then users must know that the message is not from someone who looks over them, but probably from someone who wants them to do something that they shouldn't do. "Install this" should instinctively sound exactly as dangerous as installing software off the internet is.
Re: (Score:2)
The problem here is that traditional desktop systems are designed for people who understand what they're doing...
Someone with no experience cannot be trusted to download software from the web and install it, if you search for any piece of software on virtually any search engine you will see many many sources to get the software from, many of which will be unofficial if not downright malicious.
The same problem does not happen to typical users of ios, android or chromeos because these systems don't expect use
And Performance (Score:1)
Not to mention the CPU and memory performance hit you take. Every antivirus tool probably has a missive database of every known virus, even from 20 years ago it's checking every file against (with any hope a file hash binary search). Norton's virus definition grew from like 25MB in 2008 to 220MB in 2013.
I routinely pause my antivirus when copying tons of files around or when installing known to be good stuff. As soon as I pause the scanner everything speeds up. even if you have a quad core, every file has t
Re: (Score:2)
Every antivirus tool probably has a missive database of every known virus, even from 20 years ago it's checking every file against (with any hope a file hash binary search).
Could you please replete that?
Re: (Score:2)
Every antivirus tool probably has a missive database of every known virus, even from 20 years ago it's checking every file against (with any hope a file hash binary search). Norton's virus definition grew from like 25MB in 2008 to 220MB in 2013
Don't count on that. I have personally seen some very old EOL systems NT4 and W2K boxes get infected with very old malicious software.
People keep some of these system in service, the AV packages often still support them but... here the rub to keep those definition files reasonably sized Symantec and friends actually drop old definitions for things that depend on vulns not present in more recent platforms. So if don't count on your old Win2K box not suddenly getting CodeRed all over again, even with NAV ru
Bad title. (Score:3)
At least with antivirus they're likely already getting updates regularly; the same can't be said for hardware drivers on a huge percentage of systems.
Re: (Score:2)
At least with antivirus they're likely already getting updates regularly
Why do you think that? Won't most people try to run with their original, old version of the antivirus and hope that the package definitions keep getting updated?
Re: (Score:2)
And as far as going without antivirus, it's a question of which is more of a concern - the things that may target the antivirus, or the things that may target the other parts of the system (browsers, maybe Flash still
Re: ESET broken is huge! (Score:2)
I left eset for Kaspersky. Reason is I thought I had a bad ass, motherboard, and sata cables. Constant disk corruption occurred.
When doing a SFC caused a bsod at the NTFS driver I figured it was the av software. I was right
Not Really (Score:2)
It's quite certain that AV software flaws have been attacked by bad guys, but that hardly means that your company is *more* vulnerable with the software than without it. Any sufficiently complex software has vulnerabilities.
Layers of options (Score:2)
Learn about good quality encryption so that years of plain text data are not just sitting on fast internet facing servers.
As for AV brands: The global reach and trust means they are getting reports back of bespoke 5 e
unfortunately... (Score:2)
Is AntiVirus dead? (Score:1)