Yes, this shows that antivirus is trivial to bypass. However, antivirus is not the last word in endpoint protection. While this method can be used to get otherwise ordinary payloads past antivirus, behavior-based detection and application whitelisting can be used to prevent many of these attacks.
Bypassing Antivirus with Ten Lines of Code
11–20 of 100 posts
Re: Bypassing Antivirus with Ten Lines of Code
#12I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file.
It was basically a firewall on the kernel level.
It worked splendidly, however, I was never able to gain any traction in marketing it. That was back at around OS X 10.4 now. I've been waiting for another company to come along with something similar - since it really does seem a comprehensive way of blocking viruses (albeit more suited to more advance uses). I'm still waiting for something like that.
Re: Bypassing Antivirus with Ten Lines of Code
#13Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.
> It's impossible to determine whether software is malicious or not (Rice's theorem).
Which is why proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code] is a good idea: the onus ought to be on the programmer to provide (machine-checkable) evidence that their program is safe to use, for whatever notion of “safe” might make sense in your system.
Re: Bypassing Antivirus with Ten Lines of Code
#14I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…
Neat, but most people will just click "yes."
See Windows Vista.
Re: Bypassing Antivirus with Ten Lines of Code
#15You're not secure until you whitelist. And even that's not a guarantee; it's a necessary but sufficient condition. But systems which do not run signed, whitelisted code from boot time forward are as good as pwnt.
> You're not secure until you whitelist.
No, a whitelist isn't good enough. You can't anticipate an exhaustive list of the programs the user will want to run.
What you can do, however, is enforce a policy by which programs are required to provide machine-checkable evidence, also known as proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code], that they respect the system's safety policy.
> it's a necessary but sufficient condition
Perhaps you mean “not sufficient”?
Re: Bypassing Antivirus with Ten Lines of Code
#16This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0]
Re: Bypassing Antivirus with Ten Lines of Code
#17Laughable. Ages ago I realised you could just take an exploit, base64 the contents of the binary code, save it in a string. You could then unbase64 it and execute the binary in memory. Nothing seemed to catch it.
You'd still need a decoding stub which can be fingerprinted. An XOR "decoder" is far smaller in shellcode and can be custom written in asm to reduce time-to-first-signature.
You could just pepper the b64 with jmp statements and randomly intersperse your decoder code.
Re: Bypassing Antivirus with Ten Lines of Code
#18We just need a better sandboxing environment and individual permissions per excitable i.e. "Can this excitable connect to blah blah up?" , "can this program read outside of its sandbox folder?"
When you don't root your android or iPhone they handle it a lot better than desktop operating systems.
Re: Bypassing Antivirus with Ten Lines of Code
#19So what's this line all about:
((void(*)())exec)();
Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
Re: Bypassing Antivirus with Ten Lines of Code
#20Most Antivirus software makes your system work like it has a virus. Most of them will eventually let intruder in. Waste of money in my opinion.