Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security Microsoft

Anti-Virus Vendors Scramble To Patch Hijacking Exploit Involving Microsoft Tool (securityweek.com) 48

"A zero-day attack called Double Agent can take over antivirus software on Windows machines," Network World reported Wednesday. wiredmikey writes: The attack involves the Microsoft Application Verifier, a runtime verification tool for unmanaged code that helps developers find subtle programming errors in their applications... [The exploit] allows a piece of malware executed by a privileged user to register a malicious DLL for a process associated with an antivirus or other endpoint security product, and hijack its agent.
Patches were released by Malwarebytes, AVG, and Trend Micro, the security researchers told BleepingComputer earlier this week. Kaspersky Lab told ZDNet "that measures to detect and block the malicious scenario have now been added to all its products," while Norton downplayed the exploit, saying the attack "would require physical access to the machine and admin privileges to be successful," with their spokesperson "adding that it has deployed additional detection and blocking protections in the unlikely event users are targeted."

BetaNews reports that the researchers "say that it is very easy for antivirus producers to implement a method of protection against this zero-day, but it is simply not being done. 'Microsoft has provided a new design concept for antivirus vendors called Protected Processes...specially designed for antivirus services...the protected process infrastructure only allows trusted, signed code to load and has built-in defense against code injection attacks.'"
This discussion has been archived. No new comments can be posted.

Anti-Virus Vendors Scramble To Patch Hijacking Exploit Involving Microsoft Tool

Comments Filter:
  • I bought a HP Pavilion 500-165 off of someone for $100 who said it ran slow and I uninstalled Norton and the problem went away. So Norton is the greatest program ever invented for acquiring computers cheaper from people.
  • Privileged User (Score:2, Insightful)

    by Anonymous Coward

    Something executed by a "privileged user" can and should be able to remove anti-virus by design, how else could AV get installed and uninstalled if not by a privileged user?

    This is why you protect your admin/root accounts.

  • by shellster_dude ( 1261444 ) on Saturday March 25, 2017 @04:29PM (#54109435)
    Dear god, will this bullshit end? It's like no one has ever heard of AppInit_Dlls (https://support.microsoft.com/en-us/help/197571/working-with-the-appinit-dlls-registry-value) or Binary Patching the MS way (https://msdn.microsoft.com/en-us/library/windows/desktop/aa370592(v=vs.85).aspx). This is not a new fucking 0-day or even a vulnerability. It is another, legitimate hooking technique that Microsoft invented. You have to have Local Admin credentials. If I have local Admin credentials, I can already kernel hook, install firmware or do any other privileged thing on the box. It doesn't surprise me that some no-name "security" company is peddle over-hyped shit. What does surprise me, is that some many supposedly intelligent "technical" people are swallowing it.
    • This is not a new fucking 0-day or even a vulnerability.

      Maybe it's not a 0-day, but how is this not another vulnerability? Maybe it's not a vulnerability in Windows, but it appears to be a legitimate vulnerability in several AV tools.

    • It is a story not so much because this can be done, but because there is a solution to it and has been for 3 years, AV vendors just aren't implementing it. There's additional hardening they could take to mitigate this, they just aren't.

      • @Sycraft-fu [slashdot.org]: "It is a story not so much because this can be done, but because there is a solution to it and has been for 3 years, AV vendors just aren't implementing it. There's additional hardening they could take to mitigate this, they just aren't."

        Do you have a link to this three year old solution for the Double Agent zero-day attack, that the vendors aren't implementing, that the vendors are still working on a solution [networkworld.com] to?
  • Windows lets unprivilegied user inject a DLL in trusted code. That looks like a backdoor.

    I wonder if it has been intentionally added lie Juniper's unauthorized VPN backdoor [slashdot.org].

  • The attack involves the Microsoft Application Verifier, a runtime verification tool for unmanaged code that helps developers quickly find subtle programming errors in their applications. The tool, introduced with Windows XP, is installed by default and enabled on all versions of the operating system.

    Since when was Application Verifier installed by default? It was apparently included on Windows XP's CD in /Support/Tools, but wasn't part of the standard installation. I don't recall it being installed on any

Real Programmers don't write in PL/I. PL/I is for programmers who can't decide whether to write in COBOL or FORTRAN.

Working...