New attack bypasses virtually all AV protection • Hacker News Board

Re: New attack bypasses virtually all AV protection

#11

Post by bensummers » Sun, May 09, 2010, 7:59 AM UTC

This project http://sysjail.bsd.lv/ was dropped because of exactly the same problem with systrace on BSD systems, found in 2007.

Details: http://www.lightbluetouchpaper.org/2007/08/06/usenix-woot07-... (Exploiting Concurrency Vulnerabilities in System Call Wrappers)

It's not really possible to write wrappers which can inspect system calls, allow them to be blocked or modified, AND be efficient. Therefore they're not useful for security purposes because of the inherent race conditions.

Re: New attack bypasses virtually all AV protection

#12

Post by bensummers » Sun, May 09, 2010, 8:00 AM UTC

Agent101 wrote: post #5

devinj wrote: post #3

What did the researchers propose as a solution? The article doesn't mention any way around this.

The first thing I would try is a bit hacky but might work. I'd take a copy of the data structures you are analysing when looking for malware and then copy it back to the original place just before you call the normal windows function. It would minimise the amount of time the malware had to get the data in. What you really need is to move the data into kernel space somehow. That would need a tweak to windows though. T…

Two problems:

1) Efficiency

2) When an argument refers to a large amount of data which is necessarily in the user's memory space - eg memory mapped files.

Re: New attack bypasses virtually all AV protection

#13

Post by [deleted] » Sun, May 09, 2010, 8:12 AM UTC

[deleted]

Re: New attack bypasses virtually all AV protection

#14

Post by Amnon » Sun, May 09, 2010, 9:09 AM UTC

Summary of the article: AV software hook into Windows system calls. When user-mode calls a kernel function, the AV hook handler first checks that the arguments comply with the security policy. If they do, it passes the arguments to Windows in order to execute the call. However, another user-mode thread can change the data between the time of the check and the execution. The AV will see valid data, but Windows itself will act upon the malicious data.

This is a vulnerability in AV software, not in Windows. If the attack succeeds the system remains just as secure as other operating systems which don't have AV.

How can the attack be prevented? I guess in the same way that the kernel itself prevents such attacks (after all, the kernel has its own checks, which presumably can't be bypassed). There's probably a way to make memory pages read-only for the duration of the system call, so the data can't be changed.

Re: New attack bypasses virtually all AV protection

#15

Post by wazoox » Sun, May 09, 2010, 1:46 PM UTC

xtacy wrote: post #9

In short, a race condition in Windows.

Not really. Actually Windows is a sophisticated form of distributed race condition.

Re: New attack bypasses virtually all AV protection

#16

Post by jmah » Sun, May 09, 2010, 2:56 PM UTC

Would this timing attack affect Google's NativeClient as well? http://code.google.com/p/nativeclient/

Re: New attack bypasses virtually all AV protection

#17

Post by mmphosis » Sun, May 09, 2010, 4:25 PM UTC

postfuturist wrote: post #10

This article is an abomination of journalism, go to the original site ( http://www.matousec.com/ ) for something that makes sense.

Thanks for the link. I found the article confusing.

Was the article specifically about the list of results in this posting: http://www.matousec.com/projects/proactive-security-challeng... I am sure that other systems can be compromised, but I gather this is concerning Windows only?

I ask because when reinstalling a Windows/PC last week, and I needed to copy some missing drivers (network/video) onto a USB flash drive from a working computer. I happened to notice there was a Ubuntu installer on the USB stick, and was very tempted to install Ubuntu!