Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Antivirus with Ten Lines of Code

attactics.org

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Bypassing Antivirus with Ten Lines of Code

#71

Post by JoachimSchipper »

rmdoss wrote: post #69

That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ: At VirusTotal we are tired of repeating that the service was not designed as a tool to perform antivirus comparative analyses, but as a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. Those who use VirusTot…

I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.

Re: Bypassing Antivirus with Ten Lines of Code

#72

Post by Natsu »

JoachimSchipper wrote: post #71
rmdoss wrote: post #69

That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ: At VirusTotal we are tired of repeating that the service was not designed as a tool to perform antivirus comparative analyses, but as a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. Those who use VirusTot…

I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.

It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.

Re: Bypassing Antivirus with Ten Lines of Code

#73

Post by self_awareness »

feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

You've basically written a HIPS - Host Intrusion Prevention System, or at least a base layer of it. Antiviruses on Windows are popular to have this kind of protection, I don't know of commercial solutions for other systems.

Re: Bypassing Antivirus with Ten Lines of Code

#74

Post by self_awareness »

gvb wrote: post #28
feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

That is an example of a mandatory access control (MAC) framework[1]. SELinux[1] is a MAC for linux systems and is very effective if the user doesn't disable it due to frustrations over false positives or due to true positives that are viewed by the user as false. OSX has discretionary access control, which can be configured to be a full MAC[3]. Starting in OS X v10.5, the kernel includes an implementation of the Trus…

There is MAC framework inside MacOS X kernel, but it's only for Apple usage. Developers arent' supposed to use it, because Apple states that it has no ABI stability and it can change unexpectedly from version to version. That is probably why it's not used by any commercial software (or it's so rare).

Instead, Apple designed a KAUTH framework, which is way more limited than MAC, but can be used to implement some features that will be stable across kernels (it has ABI stability). There are already some AVs that are using KAUTH.

Re: Bypassing Antivirus with Ten Lines of Code

#75

Post by flyinghorse »

Try running the binary instead of just scanning it for signatures. It will be detected by the heuristics engines of most AVs. I'm not saying that AVs are good but articles like this that only focus on defeating signatures while leaving away heuristics (emulation, behavior detection, and even white listing to some extent) don't do the subject justice.

Re: Bypassing Antivirus with Ten Lines of Code

#76

Post by wepple »

lets not forget that this isn't actually all that practical in practice.

It's not executing any old binary: the 'shellcode' has to be position-independent and can't rely on any normal PE features; it has to do all it's library loading on it's own etc.

yes, very possible to create. but if your malware/tool you want to run is large, it will take a fair amount of time to convert.

Re: Bypassing Antivirus with Ten Lines of Code

#77

Post by JoachimSchipper »

Natsu wrote: post #72
JoachimSchipper wrote: post #71

Earlier quoted context omitted.

I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.

It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.

Does the comment actually say that, though? It would make sense if the comment said that, but e.g.

> perform antivirus comparative analyses

is not what is happening here.

Re: Bypassing Antivirus with Ten Lines of Code

#78

Post by kobayashi »

feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

When I read this, I thought, "Hey, that sounds a lot like Little Snitch but for disks." Then I read below that LS' main competitor, Hands Off!, seems to have that functionality. Very interesting...

Re: Bypassing Antivirus with Ten Lines of Code

#79

Post by kobayashi »

feelix wrote: post #62
ad_hominem wrote: post #60

Earlier quoted context omitted.

Isn't it dangerous to assume all malicious programs will use scratch files before communicating across the network? Won't you miss programs that use purely in-memory structures?

Yes, it is. And that was just a simplified example. In practice if you were running something you were very distrustful of, you would block access to almost all of its file access. You also wouldn't leave it running for long enough to feed it enough keystrokes to get you into trouble. But even if you did, you would catch it with all the file opens (and network connection open's) before it could transmit your keystrok…

Does Hands Off! actually provide the level of security that you're discussing?

Re: Bypassing Antivirus with Ten Lines of Code

#80

Post by arm »

feelix wrote: post #63
jacquesm wrote: post #49

Earlier quoted context omitted.

Would you be interested in making a linux version of this?

Sure, that should be possible. Considering the failure of my OS X version I'd need to see some demand for it beforehand.

I’ve been using Hands Off! for the functionality for the past few years, but if I had known that the functionality was based on your kernel extension, I would’ve switched away from Hands Off! in a heartbeat (I already get the firewall features of Hands Off! from Little Snitch, so the only reason I use Hands Off! is for the disk access control feature).

Out of curiosity, could you provide a link to the website advertising your kernel extension (if it still exists)? As an OS X user, I feel pretty bad that I wasn’t aware of its existence (I would’ve certainly recommended it to my friends).

Post reply on HN