F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking

Post by yborg » Thu, Jun 07, 2018, 2:53 PM UTC

zaarn wrote: post #14

fulafel wrote: post #11

Are any AV vendors marketing themselves as more secure than the competition, with technically founded evidence? Such as memory-safe PLs, VM or OS sandboxes, running 3rd party native code in an emulator, bug bounties, etc. Though probably their customers are mainly corporate "intranet" environments where users open random content with Acrobat, Office etc and the high bit is to just halve (1) the daily mass malware inf…

From experience; no. A/Vs are largely attack vectors, a huge number of malware already tries to detect if an A/V is present and then uses it to get SYSTEM level privilege fairly easily. The number of actually good A/Vs is low and in my opinion, simply use Microsoft Defender on Windows. For 0-days it's detection rate is, to my knowledge, not significantly worse than any other A/V and unlike other products they properl…

Post by kevin_b_er » Thu, Jun 07, 2018, 6:11 PM UTC

saurik wrote: post #9

TheDong wrote: post #8

Earlier quoted context omitted.

That is false. It's likely the end-user can update it, but the LGPL does not prevent it from being impossible. The LGPL makes it perfectly legal for the closed-source antivirus component to not load any 7zip .so binary that is not signed by the antivirus vendor, of a known hash, or so on... and the code loading said shared-object need not be available or modifiable, just the code for the vulnerable .so they do ship.

The LGPL clearly states that a Combined Work which includes the the Library must "1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version." as well as insisti…

Post by youseecomrade » Thu, Jun 07, 2018, 6:50 PM UTC

landave wrote: post #16

youseecomrade wrote: post #6

And MalwareBytes is still using 7zip 18.01

Why do you think so? It seems they have updated to 7-Zip 18.05 on May 11, 2018: https://forums.malwarebytes.com/topic/228610-vulnerability-i...

Post by zaarn » Fri, Jun 08, 2018, 6:43 AM UTC

kevin_b_er wrote: post #24

zaarn wrote: post #14

Earlier quoted context omitted.

From experience; no. A/Vs are largely attack vectors, a huge number of malware already tries to detect if an A/V is present and then uses it to get SYSTEM level privilege fairly easily. The number of actually good A/Vs is low and in my opinion, simply use Microsoft Defender on Windows. For 0-days it's detection rate is, to my knowledge, not significantly worse than any other A/V and unlike other products they properl…

So is Defender. The scanner runs as NT AUTHORITY/SYSTEM without any sandbox. One flaw in the scanner is a widespread and nearly wormable exploit. You can infect an entire company by just spamming them if you found an exploit in the file type parsers it uses. Here's a bug found by Project Zero. The researcher had trouble getting the test case to Microsoft because Defender was running on their middleware boxes and woul…

Post by tripzilch » Sat, Jun 09, 2018, 6:08 PM UTC

alibert wrote: post #19

skocznymroczny wrote: post #18

Earlier quoted context omitted.

My main reason for using Microsoft Defender is the business model. It's in best interest of A/V companies for people to have viruses, it's in best interest of Microsoft for people not to have viruses on Windows.

But it's not? If people catches viruses with an AV installed, they are not going to be happy with their AV solution... Also, top AV are better at catching viruses and have less performance impact than Defender. https://www.av-comparatives.org/tests/real-world-protection-... https://www.av-comparatives.org/tests/performance-test-april... (Recent Defender has the most impact on system performance on all AV tested) Obvi…