Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Antivirus with Ten Lines of Code

attactics.org

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Bypassing Antivirus with Ten Lines of Code

#91

Post by ryao »

mettamage wrote: post #3

Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.

Antivirus software is as useful for security as monster HDMI cables are useful for improving digital picture quality, so this is not surprising.

The only thing that antivirus software does semi-decently is identify known software binaries. Antivirus software cannot reliably identify unknown binaries through heuristics because writing software to understand unknown software binaries is impossible in general. There are potentially an infinite number of ways of proving that, but the easiest way that occurs to me is that one of the many things necessary for understanding unknown software in general is solving the halting problem, which was proven to be impossible in general by Alan Turing.

Furthermore, the utility for a database of known malicious binaries is practically non-existent. Malicious software is always designed to exploit some vulnerability and once the vulnerability is fixed by the vendor, there is nothing for the antivirus software to do. If you could apply the definition update that the antivirus software needed to catch malicious software, you could have applied the vendor patch that fixed the vulnerability the malicious software used in the first place. That not only makes the definition update unnecessary, but handles the unknown things that the definition update would never have caught.

In the cases of a vendor being slow to patch, refusing to patch (e.g. the exploits used by the hot potato proof of concept code for all current Windows versions) or the user not applying the patch in time (e.g. lack of scheduled downtime), the inability of antivirus software to catch unknown software using those vulnerabilities provides a false sense of security. If a system is specifically targeted by a malicious hacker, the hacker would use something that antivirus software would not catch, such as a script kiddie tool against which there are no known definitions or custom code. Being unfortunate enough to be attacked by a virus, trojan, etcetera before they get definitions also means there is no protection.

Real security requires doing things like minimizing attack area and configuring things competently (e.g. not using your username as your password). That is something that you cannot get from an antivirus vendor.

Re: Bypassing Antivirus with Ten Lines of Code

#92

Post by ryao »

eru wrote: post #56
K0nserv wrote: post #16

This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0] 0: http://www.sevagas.c…

I guess you could only fix this with a whitelist instead of a blacklist approach.

Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with certificate revocation for anything bad that managed to be signed by a trusted certificate. That means you have both a whitelist (that is append only) and a blacklist (to fix mistakes in the append only whitelist).

Re: Bypassing Antivirus with Ten Lines of Code

#93

Post by daemin »

AnthonyMouse wrote: post #70
eru wrote: post #56

Earlier quoted context omitted.

I guess you could only fix this with a whitelist instead of a blacklist approach.

A whitelist might not even work. In practice whitelists end up with everything in the world on them. It might not be that hard to find a whitelisted program that would let you do the thing in the article just by passing it the right arguments. Certainly anything with a buffer overflow in it would work and there are probably a hundred other ways to do it too.

Yep, one place where I used to work, the owning company's policy had "Linux" on its whitelist, but not "Wireshark". Even though the company was developing software which communicated over the network in various protocols.

Re: Bypassing Antivirus with Ten Lines of Code

#94

Post by ryao »

lqdc13 wrote: post #64
seanp2k2 wrote: post #52

Earlier quoted context omitted.

Re: OS nags...Windows is the worst IMO since UAC basically just asks ~it looks like you're trying to do a thing, are you sure you want to do that thing? The "open this program FROM THE INTERNET????" nag on OSX and Win are also pretty pointless. I've never not clicked yes, but there's not an easy way to disable this. It looks like it CAN be disabled with registry tweaks or GPEdit: http://www.sevenforums.com/tutorials/…

What if it's a browser exploit that basically got the browser to "download and open"? Then this would be the second line of defense - something is about to run even though you didn't know expect it to run.

The "execute downloaded executable" protection predates UAC. It was introduced in Windows XP SP2 and UAC implemented its own version of it, which created double prompts:

https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-...

That being said, the "execute downloaded executable" protection only applies when the binaries are marked as being from the internet, which is easy to bypass. You just need to download the software in a way that the mark is not applied (e.g. not through a software mechanism designed to apply it). Furthermore, attacks need not rely on "execute downloaded executable". They just need to achieve code injection, which bypasses the need to run through the "execute downloaded executable" process. However, any injected code would be able to download and open without triggering UAC by not marking the file as having been downloaded from the internet. Such file marking is entirely voluntary and malicious code would likely never voluntarily do it.

Protection against inadvertent execution of software downloaded from the internet is the only function in UAC that is useful. The other functions are designed to operate on already executing software. Since already executing software can gain system privileges (above administrator privileges) via vulnerabilities the that Microsoft refused to fix, it can do basically anything it wants. UAC is fairly useless against it because anything it wants includes turning off UAC. I know enough about Windows security that I stopped using Windows years ago, so I do not know whether UAC would require malicious software that has gained system privileges to turn it off. If it does, it should be a simple matter. Anyway, the hot potato proof of concept code demonstrates gaining system privileges by exploiting such vulnerabilities:

http://foxglovesecurity.com/2016/01/16/hot-potato/ https://youtu.be/Nd6f5P3LSNM

The video of it running on Windows 7 uses the system privileges to give a regular user administrator privileges. There is a Windows firewall prompt that appears in the video, but it does not stop the exploit. The appearance of the prompt ought to be avoidable because whatever triggered the Windows firewall prompt was not necessary for the exploit and could be removed.

Re: Bypassing Antivirus with Ten Lines of Code

#95

Post by ryao »

hayao wrote: post #37
wolfgke wrote: post #9

Earlier quoted context omitted.

> Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.

In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.

The best way would be to stop using Windows. Windows is the only platform where you see backward things like:

1. Antivirus software that gives a false sense of security being popular.

2. The vendor refusing to fix vulnerabilities that give attackers complete control because of backward compatibility concerns:

http://foxglovesecurity.com/2016/01/16/hot-potato/

3. UAC prompts that annoy users to the point where the user either turns them off or automatically clicks yes. This is in part because of the even weirder situation of legitimate software often being written to touch things that it has no business touching.

4. End users trained to execute software obtained from random internet sites.

5. File names used to identify files as executable.

There are probably other backward things with regard to security too, although I cannot think of them offhand.

Your best choices would be installing a Linux distribution or buying an Apple machine running Mac OS X. If you must use some sort of Windows, check out ReactOS:

https://www.reactos.org/

That likely does something by virtue of not having same bugs and not having yet implemented the legacy things that exploits often target. It is not as good for security as Linux or Mac OS X though.

Re: Bypassing Antivirus with Ten Lines of Code

#96

Post by ryao »

001spartan wrote: post #11

Yes, this shows that antivirus is trivial to bypass. However, antivirus is not the last word in endpoint protection. While this method can be used to get otherwise ordinary payloads past antivirus, behavior-based detection and application whitelisting can be used to prevent many of these attacks.

Proper security hygiene can prevent most attacks, not better antivirus software. Proper security hygiene means:

* applying security updates

* enforcing least privilege

* reducing attack surface (e.g. Does your desktop really need open ports?)

* using decent passwords and two factor authentication when possible

* not reusing passwords in case a place where you used a password is compromised

* not executing code from untrusted sources

* checking whether code from a trusted source is vulnerable to a MITM attack before executing it

* saying no to prompts for elevated privileges unless you can prove to yourself that there is a good reason for them and finding out what caused a prompt for elevated privileges when you see no legitimate reason for it

* wiping a system should you think it might have been compromised and maybe also discarding the hardware just in case firmware was altered, which is what the US government tells US CEOs to do with things that they bring to China

* not providing confidential information (e.g. your password) just because someone claiming to be a trusted party such as IT called asking for it

That last one is how the NSA red team hacked the Pentagon's Joint Staff intelligence directorate when doing penetration testing as part of a "war game" in 1997:

http://www.slate.com/articles/technology/future_tense/2016/0...

That said, there are likely more when thinking about confidentiality (the other half of security), but these are the ones that occur to me when I think about ensuring system integrity.

Anyway, antivirus does not save you if you fail to do any of those things. Anything that could get by all of that would be a zero-day attack where antivirus software is likely to be similarly useless. Not all zero-day attacks can get past all of that (minimal attack surface is awesome). If you are the principle target (like the Pentagon was for the NSA red team), antivirus software has no chance of saving you against a zero-day attack.

Re: Bypassing Antivirus with Ten Lines of Code

#97

Post by tonyarkles »

feelix wrote: post #12

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it.…

I did something similar for a Computer Security class back in the day, but I did it from userland using dylib injection, and did it as a PoC of the malicious things you could do without getting root.

Once you've intercepted read() and write(), you control almost everything. One of the demos I did was injecting content into HTTP responses. Fun project, very glad I didn't ever share the code for it :)

Re: Bypassing Antivirus with Ten Lines of Code

#98

Post by ryao »

V-2 wrote: post #25
devit wrote: post #7

Earlier quoted context omitted.

No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.

That's not true - there's heurystic analysis techniques, generic signature detection etc. Of course they may not meet your definition of "reliably"

> That's not true - there's heurystic analysis techniques, generic signature detection etc. Of course they may not meet your definition of "reliably"

The only reliable things in security are the things that an attacker cannot bypass even when knowing that they in use (e.g. RSA). The premise of the article being discussed is that heuristics are trivial to bypass.

Re: Bypassing Antivirus with Ten Lines of Code

#99

Post by ryao »

devit wrote: post #7
mettamage wrote: post #3

Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.

No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.

Would you say that rice's theorem is a generalization of the halting problem?

It looks like "halting problem being unsolvable" -> "rice's theorem" by a subset relationship. Consequently, if rice's theorem were false, you could solve the halting problem by modus tollens.

That being said, I had using the halting problem as my way of saying that identification of malicious software is impossible because infinite loops can be malicious and I had been unaware of rice's theorem. I will use that in my explanations in the future.

Re: Bypassing Antivirus with Ten Lines of Code

#100

Post by CyberDildonics »

feintruled wrote: post #88
CyberDildonics wrote: post #31

I've said it before but as hard as it might be to believe, I think smalltalk was 30 years ahead of its time when every program was packaged inside its own OS image. Anti-virus bypasses and even exploits are extremely common. My current line of thinking is that the best way to take control of your computer is to use virtualization to run many separate OS images for different sets of uses.

Interesting, but would have obvious drawbacks when it comes to addressing any OS vulnerabilities or improvements - suddenly you have to reinstall ALL your applications! This reminds me of Nintendo's approach to emulation for their Virtual Console, actually. Rather than having a standalone emulator that you download images for, they package the emulator with the game. This way they never have to worry about inadvertan…

I think you could save and fork OS images. At the same time I would think vulnerabilities wouldn't matter as much, but you are right that it adds complexity to managing a system.
Post reply on HN