Slashdot Mirror
Malware Modification Contest Has Antivirus Vendors Upset
SkiifGeek writes "Race to Zero, a sideline competition being set up at this year's DefCon, already has some Antivirus vendors steaming over the objectives of the contest. They are upset because it is essentially a polymorphism exercise. Entrants are given a set of malware samples which they must then modify to pass through a battery of antivirus scanners without detection while still carrying a viable payload. Even if competitors ignore the published vulnerabilities and weaknesses affecting antivirus vendors, the competition should turn up some interesting results. It may provide technical insight and concepts for further research as similar competitions have done in the past."
We may have to fix our software!
By having some top-notch creative talent (never mind which color hat they're wearing) take a stab at creating new styles of malware under controlled conditions, they're giving the antivirus vendors a great opportunity to study these creations -- and therefore to be better able to protect against them.
Heck, if I were Symantec, McAffee et al -- I'd take the opportunity to try to *recruit* programmers who had interesting entries in the contest! (Better to have them working for you, right?)
Paleotechnologist and connoisseur of pretty shiny things.
Waaaaah, they'll point out all the holes in our shitty software, no fair! Mummy!
lets translate FTFA "It will do more harm than good to our company," said Paul Ferguson, a researcher with antivirus vendor TrendMicro. "Responsible disclosure is one thing, but now actually encouraging people to do this (as if the NSA isn't already doing so), as a contest is a little over the top.When really smart people start working on malicious software, we won't be able to keep up" Bold edits added by me.
How about this slogan "Unsafe with any version!"
I think they are afraid that regular joe end users are about to find out that programs meant to protect your pc are always an after the fact effort which leaves you vulnerable until you update and that there is no way to keep you safe from a zero-day facebook exploit. Even the government websites can be malicious until patched/fixed.
And soon, the conclusion will be
Wow, it would be such a shame if joe bloggs end user found out the truth. tisk tisk
Support NYCountryLawyer RIAA vs People
The AV vendors who are complaining are more afraid of *other* vendors than xploits... If anything found here goes to all then it levels the playing field open source style...
Andy
It would be good to have more contests like these as they would help strengthen existing security software by finding flaws in them.
Bypassing current antivirus process is almost trivial. Just change a few lines and the signature based antivirus will not detect your virus. Now, create a process that automatically changes the few lines in a random order, but create this process as a random evolving like the virus and payload itself. Random jumps (with next payload at good place) with random junk in between should be sufficient to bypass heuristics (who said goto was dead :)). Then you've just killed the whole antivirus industry as we know today.
Hey,why are the cops ringing at my door???
I gave up with the idea of an useful sig...
I wonder if the only vendors upset, are the ones that are used to vet the entries... Anyone have data? At the end of the contest, all their competitors will be able to know just how badly they did against the polymorphic techniques the entrants used. I imagine that would upset the PR people at those companies. As usual, the technical merit of such a competition is NOT the driving force for any discussion, just money.
Wouldn't you think that AV firms would be glad of this type of competition? It will allow them to (possibly) find and fix a problem or problems, BEFORE they are found in the wild! This will make them PRO active instead of RE active, and will make them more efficient. If they were to try employing malware/virus writers, to create these software problems for them, instead of waiting for them to arrive at peoples computers, then people might actually think their products are worth paying for!
The present crop of virus scanners are a really dumb idea, since they don't provide any real protection. Consequently I am all for this kind of competition. Hopefully it will force Microsoft and the AV parasites to create a proper security solution for the MS crapware.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Malware=problem, antivirus/security products are part of the solution. But what if you hit a problem that have no (practical) solution? What if next generation of malware using that technique make very hard/impossible to deal with them? Once you reach the point that you cant tell when something is even potentially malware, all are in trouble.
Probably would be more clear if they were investigating with genetics/biological malware instead of computer one.
By Rice's theorem, proving any non-trivial property of a program is equivalent to the halting problem. Hence AV detection is an ultimately losing battle.
But what if what the antivirus vendors need is not time to study but time to come up with cures? I've worked on plenty of software where the problem was well-understood, but you could be so pestered to death by people trying to tell you there was a problem that you had no time left to work on a cure.
I don't follow this community closely, but speaking from general knowledge of software projects over several decades ...
It seems likely that these competitions do not teach the antivirus vendors what they don't know. It probably creates a firedrill internally where a long-range effort to do a substantive upgrade that would do what people wish for is side-tracked by a short-term need to make sure that people's machines are not broken into by a new stupid trick today, thanks to additional resources provided by well-meaning but "mal-informed" volunteers.
Resources are always in short supply in companies, and there's a constant need to triage between short-term and long-term planning. Events like this increase the stress on short-term projects, causing them to draw precious resources away from long-term projects. The claim that this provides valuable data to the vendors sounds like spin created by malware vendors who are chuckling all the way to the bank because they get free help from a community of people who I suspect don't realize the harm they are doing.
What they should be having is competitive events to come up with cool public-domain techniques for recognizing and stopping such malware in the general cases, thus reducing short-term strain on anti-virus vendors.
Kent M Pitman
Philosopher, Technologist, Writer
One of the purposes of this contest is to "call out" poorly performing antivirus vendors. The reason people are up in arms is that they area afraid that the results are going to reflect negatively on them. In other words, you're taking a bunch of really smart people and putting them against antivirus and asking them to look for a vulnerability. Although the antivirus are getting a free quality check, they are risking bad press.
Oh honey look... How cute... an angry slashdotter!
You're right that it's about secure users, but it's much easier to be a secure user on Linux, precisely because you would never download foo.exe -- or foo.sh, or whatever. For the most part, you get things through your package manager, or not at all.
As such, it is not particularly easy to download and run SomeFamousPersonNaked.bin -- you have to download it to somewhere, then you have to change its permissions, and then you have to run it -- and even then, they still don't have root.
However, for a very long time, an antivirus actually made some sort of sense on Windows, because you would have exploits from visiting a webpage or reading an email. You actually had a situation where the most security-conscious users would never use the Preview Pane, so that they could delete suspicious emails without looking at them. In that particular kind of insane world, it makes sense to have antivirus -- and that is precisely why antivirus seems so laughable now.
Don't thank God, thank a doctor!
...that Michelle Madigan would love to get an undercover report of all the big mean hackers making new viruses in Las Vegas. Too bad she was busted last time she tried to spy on Defcon.
Random Thoughts From A Diseased Mind (Not For Dummies)
The vendors reply is just classic. It's essentially an admission that their products don't work. The whole AV industry is built on trying to idenitify existing viruses, and have a signature for them.
Of course, if you find the virus out in the wild and identify it, you've already failed for a lot of people. (but I'm sure they don't like to talk about that).
This is like a safe manufacturer objecting to someone actually trying to break open a safe like a real criminal would. "What! You used a crowbar and liquid nitrogen?! You're just letting the criminals know more about cold+crowbar usage!!! You should know OUR safes protect against sledgehammers VERY well."
Get real AV vendors. Everyone already knows you can't stand up to new viruses, and only protect against the known ones. People still buy your damn software anyway, because it's better than nothing.
AccountKiller
"you mean they're making viruses other than ours?" ... panic.. panic.. panic..
"shit, they'll all find out!"
Hackers have long memories. It works both ways.
Actually, I think this is a great exercise!
AV companies have ignored spyware/malware threats for years and treated them as any standard Trojan/worm/virus. It is AMAZING to see how easily a Windows workstation is compromised even with proper AV/AS software installed. If Microsoft and the AntiVirus/AntiSpyware companies don't straighten their act, I can see us going to signed apps in the near future.
The fact is, many spyware/malware packages are toting along very malicious Trojans. The initial downloader Trojan almost always makes it under the detection line of the AV/AS software. While the AV/AS software may detect the malicious Trojan upon download from the downloader Trojan, the downloader Trojan is sometimes started as a service or as a component of Winlogon. This typically gives it an edge on the AV/AS software where it can download and install the malicious Trojan before the AV/AS even starts.
The most amazing thing to do with a spyware infected PC is to scan it with everything you got, make sure all hidden and system files are viewable from Folder Options, then go into windows\system32 and sort the items by date modified or date created. You'll see a wonderful list of kjsdhfkjsh.exe, sdkssk.dll, sdkfjhsl.sys, etc that went completely undetected. This, of course, is completely ignoring the existence of rootkits, Browser Helper Objects, Winsock LSP entries, and a host of other fun stuff.
I often ask myself why the location I work for even bothers purchasing $90,000 worth of antivirus + antispyware products when over 75% of the stuff we deal with every single day goes undetected.
Since we have removal down to a science where I work, I often wonder if the $90,000 would be better spent on two more admins with similar knowledge.
This seems like a great opportunity for the AV vendors to set up some microphones and video cameras and try to capture as much of the thought process of the entrants as possible. It's not often they'll have dozens of diversely creative programmers explicitly demonstrating in a controlled environment how the products would be attacked in the wild. I'm sure the AV vendors have teams that do this sort of stuff in-house, but having complete outsiders do something will ALWAYS show a team where they've made bad assumptions or gotten too insular in their thinking.
This is basically the same thing they'd get from paying outside consultants 50 grand for a week of brainstorming, the difference being that the results here will be more honest and they can't bury the report afterwards if it damages their egos.
Recursive: Adj. See Recursive.
The race is meaningless. Nobody cares a damn about your "most elegant polymorphism", "dirtiest obfuscation hack" or the like any more.
The glitch is, you code must have a viable payload according to race rules and that's exactly what we see in real life, too. Modern, professionally developed chinese/russian malware titles have a viable payload, because those gangs are profit-oriented or they are after stealing information and secrets for various three-letter agencies of your liking.
Sorrowfully, your viable payload will be picked up and stopped in its track by modern AV software. They are no longer traditional, fingerprint-only scanners, now they have sandboxing, IPS, heuristics AND comprehensive system check integrated.
The latter one will catch and stop the malware attack as soon as it tries to fiddle with Windows or user-space programs to make something viable illegal profit producing change.
As far as I know, the best such interceptor technology today is finnish F-Secure's "Deepguard 2.0", which integrates sandboxing, personal firewall, IPS and system activity monitoring with a multiple engined fingerprint + heuristic scanner. It is essentially indefeatible according to Dec 2007 german C'T tests, but makes your computer run about 30-50% slower due to its immense resources use.
BTW, please note you cannot test these modern AV defences for efficiency, unless you actually try to run your malware sample. The huge system resource requirement for systems like DeepGuard means they are not used for "on demand" (i.e. manually started scans) because a full HDD check would take several days or weeks to finish.
They are only active for "on-access" scenarios, that is real-life "I'm surfin and some hacked page tries to infect me". This is why AV companies oppose writing new viruses for tests: you have to run them on the AV protected target to fully see if AV can stop them - it probably can, but if not, there is a risk of proliferation and hurting by-stander netizens.
Antivirus detection efficency cannot be adequately tested against idle archive of stored virus file image collections any more, proper, modern testing requires dynamic execution, which should have the IT equivalent of a "Biohazard Level 4 laboratory" environment to be safe.
In fact about 2/3 of all AV vendors have recently started a brand new AV-testing organization to work out safe and sound test procedures and make them into industral standards, because the current hallmark VB100% test is totally outdated.
On the face of it, malware is bad by definition. Those who make their living defending against such malignant cleverness should give pause to consider their visceral response:
Mr. Gates cannot be faulted for the marketing genius that has driven our industry forward, but evolution is a natural selection process (i.e. what does not kill you makes your stronger) There are whole classes of leeches worshiping at the M$ alter, some of them are very well intentioned and bear no malice at all. The priesthood, however, are very aware of their position in this carnival and thus should be wary of allowing members of their congregations from biting the hand that feeds them (just for supplying the food too fast).
As with all religions, the true panic among the priesthood is that a lack of censorship on the transfer of knowledge will overwhelm them and actually expose truth that would deprive them of their livelihood... in this case, universal adoption of a secure operating system (as demonstrated by the recent CanSecWest hacking contest).
There's not need for elevated permissions.
No there is need. Under Linux a non privileged software has only access to high-level network access, such as opening a regular connection. There's no low-level access to network (crafting the data packets as wished) for non privileged software.
Thus a potential running virus, *COULD* connect to its C&C if it receives its orders from an IRC channel.
But the virus won't be able to create spoofed packets (used for sophisticated bounces and DDOS) or specially crafted packets to exploit flaws on the target system.
Whereas under Windows, non-privileged applications CAN craft packets, and users run as administrators anyway.
A non privileged process CAN download Ads from the internet, but it will have a harder time injecting them into the browser window.
An admin-privileged process in Windows could hijack the network stack and rewrite HTML on the fly inserting pop-ups and ads.
Under a non-privileged account in Linux, it can't. The virus will need instead to be able to rewrite the configuration of all gazillion of browser that exist in Linux, either injecting a spyware plugin or rerouting the traffic through a proxy process spawned by the virus. Anyway, the absence of a single point of attack, and the lack of monoculture make Linux a more complicated target.
Also, few user-friendly type distros (Ubuntu and the like) come with a sendmail (or equivalent) configured out-of-the-box for internet message delivery. Usually it's only configured to deliver alerts to the local user account.
A potential operational Spam bot would either have to send directly the spam to the internet and both hope that the network isn't configured to reject email not going out through the SMTP server and hope that the infected machine doesn't sit on a dynamic IP which will automatically get discarded on the receiving machine.
Or the potential Spam Bot will need additional complexity to retrieve the user's SMTP configuration, which will be difficult, both because there's a gazillion of different mail clients under linux, and both because several of them password-encrypt the credential (Thunderbird can do it and all KDE software store their passwords in KWallet which is masterpassword-encrypted by default).
This is security by diversity, and why it's good to avoid monocultures.
This is opposed to Windows, where most users have outlook express, which lacks the ability to encrypt the credentials.
Under Linux, it takes several step to execute code downloaded from a browser, as a reference, see the HOWTOs about downloading the latest GPU drivers straigth from the constructor site instead of using whatever is the regular package management/delivery mechanism used by the distro (you have to manually chmod it "executable". Clicking on it usually opens an editor).
And that's neglecting that it is possible to "noexec" the whole home, in which case it's not even possible to *run* code from ~.
So even if he wanted to, a linux user can't just click on "NataliePortmanNaked.sh" and execute it (unless its a regular package inside Synaptic or YaST, of course) whereas a Windows user can click on "PetrifiedWithHotGrits.exe".
Also, downloading software from random websites isn't as common in Linux as in Windows. Mostly only geeks download software for Linux and usually they download it in (controllable) source form, where anomalies could more easily get spotted.
The regular user will employ the package management system for the distro to get the needed package from the regular repository instead, as because of the diversity of Linux distros, he'll need a custom compiled packagee for the present distro,
ie.: Windows wanting kitten-powered screensaver will google around to find a page proposing some spyware infested screensaver. Anyone can download, but you *need* to be computer-literate and careful about your source to *avoid* getting undesired stuff.
The Linux users will browser Synaptic and download the package "omg-lol-ponie
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"drive a truck through the holes in their systems and it isn't going to take much for competitors to bypass most tools."
Trucks are interesting
What about the van?
http://en.wikipedia.org/wiki/Magic_Lantern_(software)
That would be a fun contest.
Find the shoulder road.
Domestic spying is now "Benign Information Gathering"
It's too easy! Pack it with something tweaked and it'll probably go through. Sorry but the sandbox and heuristic crap just isn't that great. Turn it up and it falses like crazy. When my AV product claims that Skype is a keylogger how likely am I to trust it? And yes I'm serious an AV product did just that and quite a bit more. Just watch, this contest will be a feeding frenzy....
I'm going to second the anonymous coward on this one. Unless you boot from read-only media once it's running privilege escalations are common enough on all systems that -- it's true -- if they can get you to download, chmod and run their code they can install an invisible rootkit capable of all the nastiness that Windows rootkits can do. Once you're compromised, it's _always_ a wipe and reinstall even in BSD, osX or Linux.
So when you're compiling random code snippets from anonymous donors - do it on a system with restricted rights that boots from read only media. A Knoppix or Ubuntu install CD or other "Live" distro will do the trick usually. Some distributions are engineered to run this way for this very reason -- you have to boot into a different mode in order to change the config or install software. There are also platforms designed this way, and you flash the EEPROM to change the settings.
That said Open software application developers are usually aware of security issues and don't execute every binary blob an anonymous website or mailserver sends them. So yeah, the problem is seen less often. Flash has an execution engine in it, and this is the commonest vector for exploitation on these platforms because they don't have IE, Outlook and ActiveX (the commonest Windows vectors). If you do get exploited, wipe and reinstall - always.
Help stamp out iliturcy.
1. NAV10 by Symantec was not able to detect a virus within a ZIP file even when that ZIP file was copied. Symantecs explanation (paraphrased): "there is no harm possible when a ZIP file containing a virus is just copied" (hinting to performance tradeoff)
2. NAV10 was not able to detect the ZIP file even when the ZIP file was opened and the contents viewed. Not with WINZIP, not with the Windows built in ZIP viewer. Symantecs explanation (paraphrased): "there is no harm possible when a ZIP file containing a virus is opened and viewed" (hinting to performance tradeoff)
3. NAV10 was not able to detect the malware without a signature. Now, the malware I am laking about was a primeval IRCbot that is known to mankind for many many years. It did nothing special to hide its actions nor did it contain any means of obfuscation techniques. It was a simple malware ddos bot, connecting to port 7776, updating itself by http, opening an tftp port, spreading through inclusion of itself in other ZIP files it got hold of and through writing itself into the root partitions and trying to start itself with an AUTORUN.INF. It modified the known regisitry keys for its startup and did no use any obfuscation or even rootkit technologies whatsoever. And this amazingly simple and primitive malware was not detected by the heurisitcs engine! Symantecs explanation (paraphrased): "well, bad luck. But with Symantec Endpoint Protection 11 that should be solved as SEP11 contains a behavioural analysis engine that checks for such typical malicious behaviur."
4. NAV10 does not detect the malware, which copies itself into the root partitions of every device it got hold of with the "hidden" attribute set, without the user explicitly chossing to view hidden files. So, if the users does not see the file, the AV realtime engine does not see it. Symantecs explanation (paraphrased): "if the user can not see the malware he can not execute it, therfore it poses no threat, exept if it started by other means (like autorun) but then other machanisms should catch it)"
5. After a signature had been supplied, the malware was wrongly detected as Spybot. Only after manual UPX decompression it was detected as an IRCbot. Symantecs explanation (paraphrased): "Bad luck. The UPX compressed signature looked like Spybot"
6. When the infection had occured prior to SAV10 containing a signature for the virus, SAV10s realtime protection did not detect an infection. Symantecs explanation (paraphrased): "Infected PCsshould get scanned in safe mode, only then detection of already running malware is nearly reliable, supposed that a signature for the malware is in place"
7. Even after two full scans of all ZIP files on our main fileserver not all instances of ZIP files containing the malware were identified, at least one instance was overlooked and only found when the virus scanner was set to scan the overlooked file IP alone. Symantecs explanation (paraphrased): "as it is not replicable, no comment"
8. Broken ZIP files containing the malware were not found at all. (But were found by a competitor). Symantecs explanation (paraphrased): "as the ZIP files were damaged beyond repair, there is no need to detect those"
9. Our File server had no Symantec realtime protection running, as with our OS version it was not able to handle the clustered loadsharing environment
10. The client side email database file scanning engine was disabled due to heavy performance issues and the users complaining. 11. The email server side AV scanning engine did not detect it due to an outdated scanning engine version
12. It took me more than tree months and over a week of work to get symantec support to even comment on the issues.
Quite simply, you CANNOT have excellent defence without a very-good knowledge of offence. As long as the attacking code is open-source, awesome knowledge of how offence does/can work would be gained, and great knowledge of how to defend would be gleened.
And really, I'm sorry, but what doesn't get these leaches in a tizzy? Anything that threatens their profit model....
College-Pages.com - Online Colleges, Degrees, and Programs