Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Antivirus with Ten Lines of Code

attactics.org

Post reply on HN
Print view View original

51–60 of 100 posts

Re: Bypassing Antivirus with Ten Lines of Code

#51

Post by [deleted] »

Razengan wrote: post #45
lqdc13 wrote: post #41

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated…

> What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After th…

[deleted]

Re: Bypassing Antivirus with Ten Lines of Code

#52

Post by seanp2k2 »

Razengan wrote: post #45
lqdc13 wrote: post #41

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated…

> What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After th…

Re: OS nags...Windows is the worst IMO since UAC basically just asks ~it looks like you're trying to do a thing, are you sure you want to do that thing? The "open this program FROM THE INTERNET????" nag on OSX and Win are also pretty pointless. I've never not clicked yes, but there's not an easy way to disable this. It looks like it CAN be disabled with registry tweaks or GPEdit: http://www.sevenforums.com/tutorials/182353-open-file-securi... but kind of ridiculous that it's not just an option, given how little it increases security (how many people don't just blindly click "open"?)

Re: Bypassing Antivirus with Ten Lines of Code

#53

Post by moonshinefe »

hayao wrote: post #37
wolfgke wrote: post #9

Earlier quoted context omitted.

> Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.

In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.

Use an ad blocker (uBlock origin), keep your OS/Browser up to date. If you really want to get paranoid you can use NoScript or something like that (but you'll give up some convenience).

The main thing is to make sure you trust the things you're clicking on.

If you have to visit websites or try programs you don't trust, some people have virtual machines specifically for those situations. They'll visit the site/open the program inside the VM, and if something sketchy does happen, it'll be contained within the VM and not infect the host OS (unless it's incredibly sophisticated malware that can break out of VMs--but very unlikely you'd be targeted by something like that).

Re: Bypassing Antivirus with Ten Lines of Code

#54

Post by Kenji »

AV is a little and often useless supplement to security, nothing more. It has always been trivially easy for a script kiddie to write malicious software that passes all of VirusTotal. In the decade I've been using AV, I had less true positives than false positives (yes please auto-delete my patches, hacktools and software I've written myself, idiot AV program) and of course some false negatives that wrecked me because I executed them. Since I stopped using AV and became more careful (e.g. use VM for suspicious files) I was never infected again.

Re: Bypassing Antivirus with Ten Lines of Code

#55

Post by kbenson »

hayao wrote: post #37
wolfgke wrote: post #9

Earlier quoted context omitted.

> Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.

In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.

Well, if you really want to sandbox some internet behavior (for example, porn, which I imagine has the highest percentage of sites delivering a malicious payload), use a virtual machine manager (VirtualBox) and set up a virtual machine (some Linux variant may serve best) for that specific type of access. You can do this multiple times, once for each type of access, such as a dedicated VM for accessing your bank website.

If you're really paranoid, you can save the state of the virtual machine before use, and restore the prior state every time you use, it, preventing any changes to the VM. You would occasionally want to start it up, install all the recommended updates, and then save the state again though.

Re: Bypassing Antivirus with Ten Lines of Code

#56

Post by eru »

K0nserv wrote: post #16

This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0] 0: http://www.sevagas.c…

I guess you could only fix this with a whitelist instead of a blacklist approach.

Re: Bypassing Antivirus with Ten Lines of Code

#57

Post by eru »

devit wrote: post #7
mettamage wrote: post #3

Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.

No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.

If you are happy to get lots of false alarms, it's doable with a whitelist approach.

Re: Bypassing Antivirus with Ten Lines of Code

#58

Post by awqrre »

It appears that not much have changed in the last ~20 years, when looking at mainstream antivirus software... I used to be able to move around a few assembly instructions inside a virus to avoid detection while still maintaining 100% of the virus' features

Re: Bypassing Antivirus with Ten Lines of Code

#59

Post by eru »

ams6110 wrote: post #14
feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

Neat, but most people will just click "yes." See Windows Vista.

That's why we need reliable undo, not confirmation dialogues.

Re: Bypassing Antivirus with Ten Lines of Code

#60

Post by ad_hominem »

feelix wrote: post #46
21 wrote: post #42

Earlier quoted context omitted.

> You can literally intentionally download and run any virus, with full confidence that you can easily stop it from doing anything you dont want it to. Since a dialog box is created before it can read or write to any file, there is literally nothing it can do without your permission. What about a virus that reads your keystrokes or screenshots your screen and sends them to the Internet? Or a virus that spams or does…

That's the beauty of it. Take the keystrokes example you gave. Run it. Allow it to monitor your keystrokes (by clicking "Allow" when it's doing stuff related to that). Allow it to create the file logging your keystrokes, if you want (granting it write only access when the dialog box comes up). But after you have toyed with it, you might stop it at the point when it attempts to read from that file, in order to transmi…

Isn't it dangerous to assume all malicious programs will use scratch files before communicating across the network? Won't you miss programs that use purely in-memory structures?
Post reply on HN