Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Antivirus with Ten Lines of Code

attactics.org

Post reply on HN
Print view View original

41–50 of 100 posts

Re: Bypassing Antivirus with Ten Lines of Code

#41

Post by lqdc13 »

A couple of things:

- This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable.

- Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated. If that obfuscator is not commonly used in goodware programs, it is marked as malware. This is kind of a dumb strategy on the part of AV engines, but it works okay.

You're not going to catch new malware with static (or dynamic for that matter) analysis anyway. Thing is, the problem is ill-defined.

What is malware?

Is it a program that does something a user doesn't want? If users knew what regular programs do, they wouldn't be okay with most of it either.

Is it a program that does some obfuscating tricks and exploits undocumented functionality in the system? Plenty of legit programs including a lot of AV engines do that as well.

The only usable definition in my opinion is that it is a program that makes the user unhappy with no easily accessible way of removing it completely.

This is why the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users).

Re: Bypassing Antivirus with Ten Lines of Code

#42

Post by 21 »

feelix wrote: post #40
arm wrote: post #35

Earlier quoted context omitted.

Hands Off!¹ has done this for a while now (been around since 2011 if I remember correctly). ―――――― ¹ — http://www.oneperiodic.com/products/handsoff/

Yes, the file access part of this product is exactly what I wrote too. They even made it with just the same codebase, inside the bundle "HandsOff.kext" is where all the action is. It's commendable that these guys have made it & kept it going and have it running as a product. It is so much more difficult than it initially appears. One of the first things that you come up against is you find out that at the kernel leve…

> You can literally intentionally download and run any virus, with full confidence that you can easily stop it from doing anything you dont want it to. Since a dialog box is created before it can read or write to any file, there is literally nothing it can do without your permission.

What about a virus that reads your keystrokes or screenshots your screen and sends them to the Internet? Or a virus that spams or does DDOS attacks?

Re: Bypassing Antivirus with Ten Lines of Code

#44

Post by yoklov »

vortico wrote: post #38
Uptrenda wrote: post #34

So after the program is actually compiled into binary code do the resulting instructions become so simple (and so fundamental to the operation of programs) that any attempt to write a heuristics rule to stop this technique would break thousands of programs or are heuristics just so inherently shitty that this technique works? Because I would still think that this line here: void *exec = VirtualAlloc(0, sizeof c, MEM_…

I believe this is how JIT compilation works. So this would trigger a false positive on the Java VM, Javascript V8 interpreter, Spidermonkey, and C# runtime.

Also, most emulators of reasonably modern systems. Although JITs in VMs are a few orders of magnitude more common.

Re: Bypassing Antivirus with Ten Lines of Code

#45

Post by Razengan »

lqdc13 wrote: post #41

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated…

> What is malware? Is it a program that does something a user doesn't want?

OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS.

Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works."

After that, automatic backups will let users revert any undesirable changes to their data, whether they were made by their own selves or by malware.

I think operating systems should just do a better job of making the user more aware of all recently-modified files, especially if a process has been modifying a large number of them in a short time (the recent ransomware comes to mind) or if a third-party background process has been generating an uncanny amount of network traffic.

Seeing something like "1,590 files modified" on log-on or in a notification, is way more alarming and would make users take immediate action, compared to all the usual OS or antivirus nags that we are all accustomed to subconsciously agreeing to.

Re: Bypassing Antivirus with Ten Lines of Code

#46

Post by feelix »

21 wrote: post #42
feelix wrote: post #40

Earlier quoted context omitted.

Yes, the file access part of this product is exactly what I wrote too. They even made it with just the same codebase, inside the bundle "HandsOff.kext" is where all the action is. It's commendable that these guys have made it & kept it going and have it running as a product. It is so much more difficult than it initially appears. One of the first things that you come up against is you find out that at the kernel leve…

> You can literally intentionally download and run any virus, with full confidence that you can easily stop it from doing anything you dont want it to. Since a dialog box is created before it can read or write to any file, there is literally nothing it can do without your permission. What about a virus that reads your keystrokes or screenshots your screen and sends them to the Internet? Or a virus that spams or does…

That's the beauty of it. Take the keystrokes example you gave. Run it. Allow it to monitor your keystrokes (by clicking "Allow" when it's doing stuff related to that). Allow it to create the file logging your keystrokes, if you want (granting it write only access when the dialog box comes up). But after you have toyed with it, you might stop it at the point when it attempts to read from that file, in order to transmit it over the internet, or whatever it's going to do with it.

Same with the screenshots. You'd allow it to do whatever you feel like, but you might stop it when it tries to actually create the screenshot file, but allow it to do everything else in order to monitor its behavior. And since it's all in real time, with dialog boxes coming up for each of its actions, it makes it quite interesting to do so.

Re: Bypassing Antivirus with Ten Lines of Code

#47

Post by gus_massa »

cryowaffle wrote: post #21

How many times do you plan on posting this?

This has been postested 3 times. From the FAQ:

> Are reposts ok?

> If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok.

> Please don't delete and repost the same story, though. Accounts that do that eventually lose submission privileges.

Looking at the public available data of the 3 submitters, they look like real independent user (not sockpuppets or something).

Re: Bypassing Antivirus with Ten Lines of Code

#48

Post by dublinben »

hayao wrote: post #37
wolfgke wrote: post #9

Earlier quoted context omitted.

> Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.

In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.

Don't run Windows, and don't run Javascript.

Re: Bypassing Antivirus with Ten Lines of Code

#49

Post by jacquesm »

feelix wrote: post #46
21 wrote: post #42

Earlier quoted context omitted.

> You can literally intentionally download and run any virus, with full confidence that you can easily stop it from doing anything you dont want it to. Since a dialog box is created before it can read or write to any file, there is literally nothing it can do without your permission. What about a virus that reads your keystrokes or screenshots your screen and sends them to the Internet? Or a virus that spams or does…

That's the beauty of it. Take the keystrokes example you gave. Run it. Allow it to monitor your keystrokes (by clicking "Allow" when it's doing stuff related to that). Allow it to create the file logging your keystrokes, if you want (granting it write only access when the dialog box comes up). But after you have toyed with it, you might stop it at the point when it attempts to read from that file, in order to transmi…

Would you be interested in making a linux version of this?
Post reply on HN