Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Antivirus with Ten Lines of Code

attactics.org

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Bypassing Antivirus with Ten Lines of Code

#81

Post by Someone »

lqdc13 wrote: post #41

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated…

"the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users)."

Isn't that what Gatekeeper (https://support.apple.com/en-us/HT202491) is supposed to be?

One weird thing w.r.t. Gatekeeper is that it seems to depend on everybody who downloads signed executables not via the App Store to blacklist them (by adding some extended attribute to the file)

I think a whitelist would be more reliable.

Re: Bypassing Antivirus with Ten Lines of Code

#82

Post by arm »

kobayashi wrote: post #79
feelix wrote: post #62

Earlier quoted context omitted.

Yes, it is. And that was just a simplified example. In practice if you were running something you were very distrustful of, you would block access to almost all of its file access. You also wouldn't leave it running for long enough to feed it enough keystrokes to get you into trouble. But even if you did, you would catch it with all the file opens (and network connection open's) before it could transmit your keystrok…

Does Hands Off! actually provide the level of security that you're discussing?

From my experience using it, yes. You can set it to always ask (per application)¹ whether to allow or deny the application from writing to a file.

――――――

¹ — http://www.oneperiodic.com/products/handsoff/tutorials/img/p...

Re: Bypassing Antivirus with Ten Lines of Code

#83

Post by biot »

feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

CoreForce had this for Windows 2000/XP: http://www.coresecurity.com/corelabs-research/projects/core-...

It was based on a port of OpenBSD's PF firewall and let you set fine-grained permissions on file, network, and registry access. It's a painful training process for newly-installed software (lots and lots of prompts) but I haven't seen anything else come close to what it offered. I wonder if that pain is why they seem to have abandoned it; at some point the average user would end up just uninstalling it or clicking "Allow" for every prompt.

Once up and running, however, you could do some really cool things such as giving a process read-only access to its installed directory plus the ability to read/write to a specific folder you store that program's documents in. Attempts by the program to read outside those directories would be rejected, with mixed results (from gracefully handling it, to endless alert dialog looping, to crashing) depending on how well the software was written.

Re: Bypassing Antivirus with Ten Lines of Code

#84

Post by feelix »

arm wrote: post #80
feelix wrote: post #63

Earlier quoted context omitted.

Sure, that should be possible. Considering the failure of my OS X version I'd need to see some demand for it beforehand.

I’ve been using Hands Off! for the functionality for the past few years, but if I had known that the functionality was based on your kernel extension, I would’ve switched away from Hands Off! in a heartbeat (I already get the firewall features of Hands Off! from Little Snitch , so the only reason I use Hands Off! is for the disk access control feature). Out of curiosity, could you provide a link to the website advert…

Sorry for being unclear, I didn't mean to say that it was based on my kernel extension. I meant to say that we both based it off of the same kernel extension. The extension in question is called kAuthORama and is provided by Apple. (note: I'm not 100% sure that they did use that, that was just an educated guess).

Re: Bypassing Antivirus with Ten Lines of Code

#85

Post by wmt »

JoachimSchipper wrote: post #77
Natsu wrote: post #72

Earlier quoted context omitted.

It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.

Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.

If you just read the reasons why you shouldn't use it for comparisons, you should also understand why it's pointless to use VT for testing if you bypass AV or not. To quote:

-VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.

-In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups.

-Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration.

Re: Bypassing Antivirus with Ten Lines of Code

#86

Post by grub5000 »

JoachimSchipper wrote: post #77
Natsu wrote: post #72

Earlier quoted context omitted.

It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.

Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.

> -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc.

It says right in the parent comment that the VT results may not actually reflect how the product performs in the real world.

Re: Bypassing Antivirus with Ten Lines of Code

#87

Post by feintruled »

I suppose the value in AV is that you are like one of the proverbial guys being chased by the lion - you don't need to outrun the lion, only the other guy. In this case, you just hope any malware hits enough other poor suckers first that your AV of choice is updated in time to save you.

Re: Bypassing Antivirus with Ten Lines of Code

#88

Post by feintruled »

CyberDildonics wrote: post #31

I've said it before but as hard as it might be to believe, I think smalltalk was 30 years ahead of its time when every program was packaged inside its own OS image. Anti-virus bypasses and even exploits are extremely common. My current line of thinking is that the best way to take control of your computer is to use virtualization to run many separate OS images for different sets of uses.

Interesting, but would have obvious drawbacks when it comes to addressing any OS vulnerabilities or improvements - suddenly you have to reinstall ALL your applications!

This reminds me of Nintendo's approach to emulation for their Virtual Console, actually. Rather than having a standalone emulator that you download images for, they package the emulator with the game. This way they never have to worry about inadvertantly breaking anything with a future release, but on the other hand any subsequent emulator improvements do not retroactively apply.

Re: Bypassing Antivirus with Ten Lines of Code

#89

Post by bitwize »

catnaroek wrote: post #15
bitwize wrote: post #10

You're not secure until you whitelist. And even that's not a guarantee; it's a necessary but sufficient condition. But systems which do not run signed, whitelisted code from boot time forward are as good as pwnt.

> You're not secure until you whitelist. No, a whitelist isn't good enough. You can't anticipate an exhaustive list of the programs the user will want to run. What you can do, however, is enforce a policy by which programs are required to provide machine-checkable evidence, also known as proof-carrying code [ https://en.wikipedia.org/wiki/Proof-carrying_code ], that they respect the system's safety policy. > it's a n…

Yes, that's what I meant -- not sufficient.

Whitelisting seems to be working out well for Apple. It's a big part of why they're the most secure smartphone platform.

Re: Bypassing Antivirus with Ten Lines of Code

#90

Post by ryao »

feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

You can likely use DTrace to implement something like this now.
Post reply on HN