Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

landave.io

Post reply on HN
Print view View original

11–20 of 30 posts

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#11

Post by fulafel »

Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc.

Though probably their customers are mainly corporate "intranet" environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware infections - which are not av focused yet.

(1) or whatever the average AV detection rate is these days.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#12

Post by megaman22 »

fulafel wrote: post #11

Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc. Though probably their customers are mainly corporate "intranet" environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware inf…

I'm skeptical of any AV provider. Most try to lock shit down insanely, and thash my disk more insanely. I rebelled against having to use the top-of-the-line AV tool my company tried to enforce because it crippled development speed, scanning and locking files breaking builds.

It feels like grade-school collective punishment because the office dope is watching anime porn on sketchy sites on the office subnet.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#13

Post by __m »

brokenmachine wrote: post #10

I've been using computers my entire life but this read like it was in Greek to me. Very impressive that people out there actually understand all that stuff. I'm not sure where to begin learning about that.

Not Greek, Assembly :) C for the most part but Assembly gives you the understanding

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#14

Post by zaarn »

fulafel wrote: post #11

Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc. Though probably their customers are mainly corporate "intranet" environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware inf…

From experience; no.

A/Vs are largely attack vectors, a huge number of malware already tries to detect if an A/V is present and then uses it to get SYSTEM level privilege fairly easily.

The number of actually good A/Vs is low and in my opinion, simply use Microsoft Defender on Windows. For 0-days it's detection rate is, to my knowledge, not significantly worse than any other A/V and unlike other products they properly integrate into the system and don't disable almost all security measures of the kernel like ASLR and friends so they can inject some garbage DLL into any process.

The best protection for the intranet customer is training and regular software updates. For the average user it's to tighten up security, lock them out and then run regular updates.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#15

Post by AstralStorm »

saurik wrote: post #9
TheDong wrote: post #8

Earlier quoted context omitted.

That is false. It's likely the end-user can update it, but the LGPL does not prevent it from being impossible. The LGPL makes it perfectly legal for the closed-source antivirus component to not load any 7zip .so binary that is not signed by the antivirus vendor, of a known hash, or so on... and the code loading said shared-object need not be available or modifiable, just the code for the vulnerable .so they do ship.

The LGPL clearly states that a Combined Work which includes the the Library must "1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version." as well as insisti…

I always wondered whether code signed deployment is not compliant with LGPL and where the threshold lies.

Specifically, if forcing to sign a package with a different key (making it a different package) for private purposes is enough, or if the redistribution rights of the whole is required. Finally, if you cannot replace the software because of code signing and no public debug mode, that seems incompatible too...

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#17

Post by landave »

sebazzz wrote: post #7
youseecomrade wrote: post #6

And MalwareBytes is still using 7zip 18.01

7-zip is licensed LGPL, so you should be able to replace the 7z support library with a newer version.

LGPL or not, if I remember correctly, F-Secure does not enforce a valid signature of the 7-Zip library, so you can replace it yourself. Don't quote me on this though.

However, F-Secure applies several patches to harden 7-Zip and to fix bugs that are not yet fixed in the public 7-Zip version. So it is not clear whether it is always such a good idea to do this.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#18

Post by skocznymroczny »

zaarn wrote: post #14
fulafel wrote: post #11

Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc. Though probably their customers are mainly corporate "intranet" environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware inf…

From experience; no. A/Vs are largely attack vectors, a huge number of malware already tries to detect if an A/V is present and then uses it to get SYSTEM level privilege fairly easily. The number of actually good A/Vs is low and in my opinion, simply use Microsoft Defender on Windows. For 0-days it's detection rate is, to my knowledge, not significantly worse than any other A/V and unlike other products they properl…

My main reason for using Microsoft Defender is the business model. It's in best interest of A/V companies for people to have viruses, it's in best interest of Microsoft for people not to have viruses on Windows.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#19

Post by alibert »

skocznymroczny wrote: post #18
zaarn wrote: post #14

Earlier quoted context omitted.

From experience; no. A/Vs are largely attack vectors, a huge number of malware already tries to detect if an A/V is present and then uses it to get SYSTEM level privilege fairly easily. The number of actually good A/Vs is low and in my opinion, simply use Microsoft Defender on Windows. For 0-days it's detection rate is, to my knowledge, not significantly worse than any other A/V and unlike other products they properl…

My main reason for using Microsoft Defender is the business model. It's in best interest of A/V companies for people to have viruses, it's in best interest of Microsoft for people not to have viruses on Windows.

But it's not? If people catches viruses with an AV installed, they are not going to be happy with their AV solution...

Also, top AV are better at catching viruses and have less performance impact than Defender.

https://www.av-comparatives.org/tests/real-world-protection-...

https://www.av-comparatives.org/tests/performance-test-april... (Recent Defender has the most impact on system performance on all AV tested)

Obviously, it's up to you to choose between:

* Using Defender and suffer the worse system performance impact of all AV

* Not using AV but a higher risk of catching viruses

* Use third party AV with better detection and less performance impact but risk opening new vulnerability on your system.

Re: F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

#20

Post by [deleted] »

alibert wrote: post #19
skocznymroczny wrote: post #18

Earlier quoted context omitted.

My main reason for using Microsoft Defender is the business model. It's in best interest of A/V companies for people to have viruses, it's in best interest of Microsoft for people not to have viruses on Windows.

But it's not? If people catches viruses with an AV installed, they are not going to be happy with their AV solution... Also, top AV are better at catching viruses and have less performance impact than Defender. https://www.av-comparatives.org/tests/real-world-protection-... https://www.av-comparatives.org/tests/performance-test-april... (Recent Defender has the most impact on system performance on all AV tested) Obvi…

[deleted]
Post reply on HN