Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
BLACK FRIDAY DEAL: Trust the World's Fastest VPN with Your Internet Security & Freedom--A Lifetime Subscription of PureVPN at $48 with coupon code "BFRIDAY20" ×
Security Technology

How AV Can Open You To Attacks That Otherwise Wouldn't Be Possible (arstechnica.com) 34

Antivirus suites expose a user's system to attacks that otherwise wouldn't be possible, a security researcher reported on Friday. From a report: On Friday, a researcher documented a vulnerability he had found in about a dozen name-brand AV programs that allows attackers who already have a toehold on a targeted computer to gain complete system control. AVGater, as the researcher is calling the vulnerability, works by relocating malware already put into an AV quarantine folder to a location of the attacker's choosing. Attackers can exploit it by first getting a vulnerable AV program to quarantine a piece of malicious code and then moving it into a sensitive directory such as C:\Windows or C:\Program Files, which normally would be off limits to the attacker. Six of the affected AV programs have patched the vulnerablity after it was privately reported. The remaining brands have yet to fix it, said Florian Bogner, a Vienna, Austria-based security researcher who gets paid to hack businesses so he can help them identify weaknesses in their networks. Bogner said he developed a series of AVGater exploits during several assignments that called for him to penetrate deep inside customer networks. Using malicious phishing e-mails, he was able to infect employee PCs, but he still faced a significant challenge. Because company administrators set up the PCs to run with limited system privileges, Bogner's malware was unable to access the password database -- known as the Security Account Manager -- that stored credentials he needed to pivot onto the corporate network.

How AV Can Open You To Attacks That Otherwise Wouldn't Be Possible

Comments Filter:
  • They what? (Score:2, Funny)

    by Anonymous Coward

    Six of the affected AV programs have patched the vulnerable.

    They "patched the vulnerable"? Really?

    At this rate english will be a dead language within three or four generations.

    • Six of the affected AV programs have patched the vulnerable.

      They "patched the vulnerable"? Really?

      At this rate english will be a dead language within three or four generations.

      I blame the the Coriolis Affect

    • They "patched the vulnerable"? Really?

      It's a close relative of Do the needful [grammarly.com].

    • Maybe they're going above and beyond and spreading a patch to all the other computers that are still affected.
  • I wonder if this is being exploited in the wild
  • by Opportunist ( 166417 ) on Friday November 10, 2017 @09:25AM (#55525491)

    I know it's quite common to bash Antivirus, from "they create the viruses themselves to create a market" to "they are snakeoil anyway", so the headline is very Slashdot-y, but please realize that this is exploitable because three things come together:

    1. The way Windows symlinks is FUBAR.
    2. There are STILL programs that simply go by the logic of "let's just load every DLL in this directory".
    3. A program (in this case an AV tool) allows to "restore" files into a directory, does not double check where that ends up and has admin privileges.

    You can probably get the same effect with backup programs.

    • by Baron_Yam ( 643147 ) on Friday November 10, 2017 @09:35AM (#55525543)

      The way Windows handles installing and removing programs is insane. The way programs handle what security Windows offers is insane. But as a platform, Windows was originally designed for 'easy' not 'good', and it did an adequate job of standardizing program UIs, and then providing a standard interface to devices.

      After that, of course, Microsoft (and everyone else) discovered that you could force users onto the upgrade treadmill by changing the standards over time and killing backwards compatibility. And now they have enough of the business desktop market not to care.

      Whee!

      • After that, of course, Microsoft (and everyone else) discovered that you could force users onto the upgrade treadmill by changing the standards over time and killing backwards compatibility.

        What on earth are you talking about? If there's one thing that Microsoft is insanely good at, it's preserving backwards compatibility at the OS level, even allowing much older 32-bit applications (some even vintage Windows 95 era software) to run on 64-bit machines via a built-in emulation layer. Most issues of breaking compatibility had to do more with software explicitly breaking earlier rules which weren't strictly enforced in older versions of Windows (like Windows XP), such as writing data to the pro

    • by ctilsie242 ( 4841247 ) on Friday November 10, 2017 @10:15AM (#55525737)

      Because of Windows's historically crappy programming, this is why AV was created. This isn't just MS's fault. Other operating systems of that time with cooperative multitasking had issues as well, so things like Disinfectant for the Mac that had a program load and run were critical.

      However, time has passed. Macs run a pre-emptive OS with MAC and DAC controls. Linux has SELinux and AppArmor. Even Windows, especially with tools to limit what applications can write to what files, is getting there.

      There is no real need for AV anymore. In the past, AV's liability of CPU slowness was worth it, as it would catch things. Now, AV is all but worthless because the two primary infection vectors are malvertising (which needs to be handled by the web browser and the sandbox/VM it sits in) and Trojans. AV rarely protects against malicious PDFs or Word documents.

      It is worse now, because with the fact that AV autoupdates both signatures and code, as well as sends what the hell it feels like to the mother-ship, AV can easily become malware in itself in a way that is undetectable.

      What needs to be done is to dump AV completely and have the OS handle security. The Qubes OS model is a good example of this done right. Alternatively, one can do this manually via Sandboxie or VMs on the desktop.

      The fewer moving parts, the better.

      • Because of Windows's historically crappy programming, this is why AV was created. This isn't just MS's fault. Other operating systems of that time with cooperative multitasking had issues as well, so things like Disinfectant for the Mac that had a program load and run were critical.

        You're right that this isn't just MS's fault. The 68x000 series of MacOS (capital M) did all sorts of things to encourage viruses, e.g.:

        1. Hard disk volumes had their own driver code in the first couple of blocks which was dutifull
    • 2. There are STILL programs that simply go by the logic of "let's just load every DLL in this directory".

      This is not unusual because this is how programs handle extended functionality via plugins. For instance, every digital audio workstation (DAW) in the world works by scanning key folders for dlls with well-defined interfaces, known as VSTs. These VSTs contain virtual instruments or effects that can be accessed by the host DAW. Photoshop plugins? Same concept. And there are probably thousands more examples.

      This is what people mean when they talk about the conflicting interests of security and functional

      • It is really asking too much of a program to store a list of the plugins it uses and load those and only those plugins?

  • by evolutionary ( 933064 ) on Friday November 10, 2017 @09:30AM (#55525507)
    Linux is better at resisting these things than MS windows. one can argue that Linux is less targeted, but whatever the reason, Linux (there is Apple based on BSD, but Apple has hooks in their products that are not open source). No system is foolproof. and some of these attacks used phishing techniques which someone who is watching can probably spot. But hopefully the AV companies will get better staying ahead of the curve.
  • News at 1942!

    Seriously though.. antivirus software is software, and many of them are very complex pieces of software given that they all seem to incorporate some combination of the primary AV, a firewall, malware scanners, webpage scanners, filesystem monitors, kitchen sinks, etc.

    Its kind of like expecting that your doctor can't get sick just because she's a doctor.

  • Most anti-malware programs are nonfree (user-subjugating, proprietary) software. So it stands to reason that since people make mistakes and sometimes purposefully either don't fix exploitable bugs or put them there intentionally, nonfree anti-malware programs should be treated no differently from other non-free software—don't run nonfree software. The solution becomes obvious: run free software anti-malware programs instead. Apparently privatization got us to where we are: a series of untrustable nonf

The computer is to the information industry roughly what the central power station is to the electrical industry. -- Peter Drucker

Working...