New attack bypasses virtually all AV protection
theregister.co.uk
New attack bypasses virtually all AV protection
1–10 of 17 posts
Re: New attack bypasses virtually all AV protection
#2I love the arms race between AV and attacks. Always an interesting read.
Re: New attack bypasses virtually all AV protection
#3What did the researchers propose as a solution? The article doesn't mention any way around this.
Re: New attack bypasses virtually all AV protection
#4Since hardware virtualization was introduced, the whole system can be wrapped by an attacker. Therefore, well coded malware could use the SSDT vulnerability to virtualize the currently running OS and not even have to remove AV protection afterwards. Tech keeps getting more and more flakey :-/
Re: New attack bypasses virtually all AV protection
#5What did the researchers propose as a solution? The article doesn't mention any way around this.
The first thing I would try is a bit hacky but might work. I'd take a copy of the data structures you are analysing when looking for malware and then copy it back to the original place just before you call the normal windows function.
It would minimise the amount of time the malware had to get the data in.
What you really need is to move the data into kernel space somehow. That would need a tweak to windows though.
The difficulty for the attacker comes in creating the initial attacker and faker threads. Possibly AV can hook the creation of threads and examine new threads for this potential behaviour (this might kill heavily threaded apps though). Then the virus make would have to attack two separate threads.
Re: New attack bypasses virtually all AV protection
#6Since hardware virtualization was introduced, the whole system can be wrapped by an attacker. Therefore, well coded malware could use the SSDT vulnerability to virtualize the currently running OS and not even have to remove AV protection afterwards. Tech keeps getting more and more flakey :-/
Not really. Read "Reflections on Trusting Trust":
http://en.wikipedia.org/wiki/Backdoor_(computing)#Reflection...
Re: New attack bypasses virtually all AV protection
#7The last paragraph is interesting. How did bypassing AV become privilege escalation?
note: i have yet to read what matousec.com really says.
Re: New attack bypasses virtually all AV protection
#8A new attack on Windows machines. In the immortal words of the Slayer, "Dawn is in danger. It must be Tuesday."
Re: New attack bypasses virtually all AV protection
#9In short, a race condition in Windows.
Re: New attack bypasses virtually all AV protection
#10This article is an abomination of journalism, go to the original site (http://www.matousec.com/) for something that makes sense.