Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

landave.io

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#41

Post by _Codemonkeyism »

pjmlp wrote: post #37
_Codemonkeyism wrote: post #33

No one gets fired for installing Antivirus on every computer. From my experience enterprise IT is driven by checklist, looks good on paper, cover-my-* decisions. People are not interested in doing the right thing in large companies. In one company every developer was forced on Antivirus without file exceptions making compilations a huge pain.

The majority of customers I work with, that is part of the standard IT image, regardless which OS your computer might have.

Yes.

And I guess non-glued usb ports on every computer.

And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures".

Because

    CEO: Have we Antivirus installed?
    CIO: Yes.
Not

    CEO: Are we secure? 
         How does your risk analysis look like?
         Do we internal or perimeter defense?
    CIO: ...

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#42

Post by kbart »

landave wrote: post #40
skizm wrote: post #26

This is probably a dumb question: but how does someone look at the source code for a commercial product like Avast? Some sort of DLL decompiler or something? If that is the case are things like function and variable names conserved? This is probably super trivial, but reverse engineering / pen testing isn't my area.

Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works. So to be very clear: I reversed the functions and types without any symbols. All function names, type names, and variable names from the article are chosen by me. In the actual code, those names are most likely very different. Fo…

Do you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer.

0. https://landave.io/files/add_magicnum.png

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#43

Post by raverbashing »

zurn wrote: post #32
baq wrote: post #12

this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?

Yes. For organizations the harm is compounded because IT and users don't understand how limited AV is. They think AVs have good detection rate, and they think AVs can generally "disinfect" your computer when you get pwned, and think AV doesn't increase attack surface. This leads to the false conclusion that it's an acceptable risk to use Acrobat Reader and open attachments in Office etc.

It probably can catch your average mass-mailed word virus, or an infected usb drive brought from home, but not much more than that

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#44

Post by pjmlp »

_Codemonkeyism wrote: post #41
pjmlp wrote: post #37

Earlier quoted context omitted.

The majority of customers I work with, that is part of the standard IT image, regardless which OS your computer might have.

Yes. And I guess non-glued usb ports on every computer. And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures". Because CEO: Have we Antivirus installed? CIO: Yes. Not CEO: Are we secure? How does your risk analysis look like? Do we internal or perimeter defense? CIO: ...

They don't need to glue USB ports, because IT is intelligent enough to disable access to them via OS configuration.

I never understood the stupidity of some people to glue them instead of using OS policies.

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#45

Post by lmm »

baq wrote: post #12

this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?

It's been the case for decades now. Guess the world is finally catching on.

Write parsing for complicated formats in C/C++. Run it on suspicious files from the outside world. What could possibly go wrong? Play stupid games, win stupid prizes.

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#46

Post by ComodoHacker »

baq wrote: post #12

this is the second AV fiasco in recent months. is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?

>this is the second AV fiasco in recent months

First of all, this bug was fixed nine months ago (see Timeline).

This is in no way a "fiasco", this is normal process of improving security of the product. Bug reported and timely fixed, bounty paid, no exploit was found in the wild, no harm done. You can count yourself number of similar bugs fixed in Chrome or Firefox this year.

>is it safe to say that running an antivirus is actually increasing your risk instead of decreasing it?

Yes, running ANY software on your computer increases attack surface, thus increasing risks. In the same time running AV decreases many other risks.

My opinion is all in all AV still does more good then harm today, provided it's actively developed by credible shop and timely updated.

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#47

Post by landave »

kbart wrote: post #42
landave wrote: post #40

Earlier quoted context omitted.

Thanks for the question, I probably should have made this clearer in the article. Just presenting some pseudocode and typedefs of structs may have given a wrong impression of how this works. So to be very clear: I reversed the functions and types without any symbols. All function names, type names, and variable names from the article are chosen by me. In the actual code, those names are most likely very different. Fo…

Do you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer. 0. https:…

The graph is generated by binary ninja [1] fully automatically, and this is just a screenshot of the tool. Any alternative reversing platform or disassembly tool like IDA Pro can generate you something very similar.

[1] https://binary.ninja/

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#48

Post by Scea91 »

jacquesm wrote: post #14

Avast Antivirus, now with free remote reset option. I always hated anti virus packages both for the fact that AV vendors profit on something that shouldn't be required in the first place and because that software tends to hook into lots of places in the OS so if a backdoor is found you are immediately in big trouble.

> I always hated anti virus packages both for the fact that AV vendors profit on something that shouldn't be required in the first place

You must hate a lot of things then.

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#49

Post by _Codemonkeyism »

pjmlp wrote: post #44
_Codemonkeyism wrote: post #41

Earlier quoted context omitted.

Yes. And I guess non-glued usb ports on every computer. And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures". Because CEO: Have we Antivirus installed? CIO: Yes. Not CEO: Are we secure? How does your risk analysis look like? Do we internal or perimeter defense? CIO: ...

They don't need to glue USB ports, because IT is intelligent enough to disable access to them via OS configuration. I never understood the stupidity of some people to glue them instead of using OS policies.

I have never seen a company, large or small, which disabled USB ports. Because convenience is always higher rated than security.

Glueing is much easier, can't fail with wrong configurations or roll outs, works if people have too many permissions on Linux and in a myriad of other ways.

Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers

#50

Post by pjmlp »

_Codemonkeyism wrote: post #49
pjmlp wrote: post #44

Earlier quoted context omitted.

They don't need to glue USB ports, because IT is intelligent enough to disable access to them via OS configuration. I never understood the stupidity of some people to glue them instead of using OS policies.

I have never seen a company, large or small, which disabled USB ports. Because convenience is always higher rated than security. Glueing is much easier, can't fail with wrong configurations or roll outs, works if people have too many permissions on Linux and in a myriad of other ways.

The companies I work for, security is always higher rated than convenience.

You could buy several houses, or be settled for life, with the costs to cover an eventual security breach.

Post reply on HN