Slashdot Mirror
Antivirus Firms Out of Their League With Stuxnet, Flame
Hugh Pickens writes "Mikko Hypponen, Chief Research Officer of software security company F-Secure, writes that when his company heard about Flame, they went digging through their archive for related samples of malware and were surprised to find that they already had samples of Flame, dating back to 2010 and 2011, that they were unaware they possessed. 'What this means is that all of us had missed detecting this malware for two years, or more. That's a spectacular failure for our company, and for the antivirus industry in general.' Why weren't Flame, Stuxnet, and Duqu detected earlier? The answer isn't encouraging for the future of cyberwar. All three were most likely developed by a Western intelligence agency as part of covert operations that weren't meant to be discovered and the fact that the malware evaded detection proves how well the attackers did their job. In the case of Stuxnet and DuQu, they used digitally signed components to make their malware appear to be trustworthy applications and instead of trying to protect their code with custom packers and obfuscation engines — which might have drawn suspicion to them — they hid in plain sight. In the case of Flame, the attackers used SQLite, SSH, SSL and LUA libraries that made the code look more like a business database system than a piece of malware. 'The truth is, consumer-grade antivirus products can't protect against targeted malware created by well-resourced nation-states with bulging budgets,' writes Hypponen, adding that it's highly likely there are other similar attacks already underway that we haven't detected yet because simply put, attacks like these work. 'Flame was a failure for the antivirus industry. We really should have been able to do better. But we didn't. We were out of our league, in our own game.'"
I mean seriously does anyone think the OS companies aren't in on this type of operation?
It reminds me of the CIA-Xerox story.
http://dagmar.lunarpages.com/~parasc2/articles/0197/xerox.htm
I love Jesus, except for his foreign policy.
Then they started using custom packers and obfuscaters, making them as hard to reverse engineer as Skype.
But anti-virus software just started detecting the packers and obfuscators, which no legitimate code would have...
So, now they went back to using generic tools and libraries. Full circle!
If these things really are being written by western intelligence agencies then don't think that Windows is the only platform they can compromise.
AntiFA: An abbreviation for Anti First Amendment.
http://www.lua.org/about.html
You cannot solve the virus problem as it is an impossible situation.
The only thing you can do is NOT MAKE VULNERABILITIES. And actually FIX the ones you find.
The proprietary vendors are failing at that. Their fault is in the "not invented here" area as they cannot allow non-proprietary solutions to exist. And when they prevent shared solutions, they leave things overlooked, and then bugs, and then allow for virus entry.
Not everyone can know everything - especially isolationist companies. These do not hire people that worked with other companies very well, as they are afraid of "code contamination". Those that have significant cross licensing powers could hire... but they usually also have "anti-poaching" agreements as well. This results in the lack of cross training in various techniques of programming, and promote internal bad practice... and the development of bad policies on how to program.
Come on OS's, raise that bar so that AV companies can do the same.
Wha. We suck. But, what can you do?
Your subscription has expired. Please upgrade to Our Steaming Pile 2013. Now with more steam. Also, we hid some options to make it more challenging/interesting for you!
Your products do have a tendency to delete system files though. Maybe antivirus software should be a bit more than writing definitions to known CVSs and some anomaly engine which thinks every file in a profile directory is suspicious. While antivirus software is another layer of security, it's a pretty shitty one.
With a western government involved, is it much more of a stretch to include assistance from Microsoft and even the AV companies? These companies might feel a sense of duty and might earn a lot of money to boot.
Ray Seyfarth, ray.seyfarth@gmail.com, http://rayseyfarth.blogspot.com
Interesting article at the Internet Storm Center "Why Flame is Lame"
http://isc.sans.edu/diary.html?storyid=13342#comment
crappy Malware and Anti-virus both crush the performance of the machines they're on...why bother? Oh yeah, and the anit-virus software doesn't work. Is it just to keep the masses from spreading too much?
Anti-virus software companies need to acquire, profile, and create removal code for new threats before they can do much to mitigate it. Now obviously, that's going to take genuine time and effort in cases where they didn't write the virus themselves.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
By the author's own admission, they didn't "fail to detect". They HAD copies of the virus in their reporting database but ignored them. Why are customers reporting samples if the antivirus companies aren't paying any attention? I'd like to hear more on that explanation and not more excuses like "well, it works like a business database".
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
I've not held much faith for anti-virus companies. Never was I under the idea that AV software would stop a *real* virus. To me, anti-virus software is just a way to keep the script kiddies and adware ActiveX controls off a system. Good computing habits preclude the need for AV software. Just my two cents.
Seriously, how is this news? Anyone who has even the slightest clue as to how software security vulnerabilities work (or just what turing completeness and the halting problem are) knows that anti-virus software does not and can not exist, and has known that for decades. Just because some marketing people keep pretending there is such a thing doesn't mean there actually is.
What does exist is black-list filters for some well-known attacks. Which obviously is completely pointless to even try unless you are an idiot and you insist on using software that's equally well-known for its lack of security, in which case such a black list can keep the inconvenience down a tiny bit. Or you own a business that makes money by selling unsuspecting people "protection".
Release armies of flying cats.
Because if you're going to ignore what's in your database for two years, well, flying cats are better.
https://www.youtube.com/watch?feature=player_embedded&v=-S4DZ_aWNuU#!
--
BMO
Did you really mean "First, antivirus authors used generic tools"?
Mind, I don't object to the classification of much antivirus software as evil, but it gets a bit kinky later where they're detecting themselves...
Q: Why is starting a comment in the Subject: line incredibly annoying?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
but it gets a bit kinky later where they're detecting themselves...
It's not kinky at all. They all do it, most of them nearly every day, but few of them admit it.
Kinky is two of them detecting each other...
I can see the fnords!
Seen another way: Like all artillery system designers, you study the target, understand the medium thru which the the shell must transverse, and get the payload to the target.
To think that Symantec and AVG and Kaspersky et al are omnipotent is silly. At some point, each of these companies has to avoid false positives because they get the worst PR possible when they make mistakes. There are millions of legitimate apps out there, no matter how well or poorly written. It's a matter of getting to the correct controller, seeding it with destructive code, and making sure the code survives long enough to deliver the damaging payload that's necessary. Certainly the explanation is vastly more simple than the deed, but it's the deed that was successful. Does one generate malware detection that traps such a thing: Maybe-- but you don't give it to anyone because no civilians have centrifuges that are used to make weapons grade material.
---- Teach Peace. It's Cheaper Than War.
My Dad's work PC got infected with "Smart Fortress 2012" mid-May. My mistake, I wasn't taking care of Flash and Acrobat reader. But an otherwise up-to-date XP, with an up-to-date Norton antivirus installed, got infected through a webpage. And even though the account was not an administrator account, Smart Fortress 2012 not only disabled Norton antivirus but rendered it inoperable - it had to be reinstalled (through the Administrator account).
Lesson learned. Don't trust much Norton, don't trust much anything else and tighten up as much as possible.
Well, DUH.
AV kits can only protect against attacks that are known. They may be able to detect new variants of attacks, so once a certain botnet type is known they may well be able to find zero-day developments if their heuristics are good (not a trivial task, but some have mighty good detection rates against unknown variants), but how are they supposed to detect what is simply not known to be a threat?
And likewise they cannot protect against attacks that target YOUR and only YOUR company. Where'd they get samples of it in the first place?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They do not flag such files as "malware". They flag them as "heuristics found suspicious files that have properties often used in malware".
If you actually read the text that your anti-virus software outputs on your screen, this becomes very obvious. Unfortunately most people, apparently including yourself, do not read these messages and instead assume your file has been filed as malware when you're looking as a false positive hit from heuristics engine warning your about suspicious properties of your file.
Actual malware that is known is labelled very differently by most anti-virus software.
Civilian-grade bullet-proof vests won't stop bullets fired from the primary weapons carried by military personnel. Conversely, military-grade body armor will stop rounds fired by 99% of the weapons held by civilians. The most heavily armored of civilian vehicles (and I do mean armored, as in cars that have been retrofitted, or the BMW models that can be bought pre-armored) would not stand up to military weaponry, while any armored military vehicle would shrug off an attack using weapons available to civilians. There are many other analogues involving surveillance technologies, etc. that show the dichotomy that has always existed between the military/intelligence communities and the civilian world.
But so what? Of course their tools are more sophisticated...they should be. The day when civilians have the same capability to do harm that the military and intelligence communities do, things will go very, very badly.
For your security, this post has been encrypted with ROT-13, twice.
With a western government involved, is it much more of a stretch to include assistance from Microsoft and even the AV companies? These companies might feel a sense of duty and might earn a lot of money to boot.
In order to evaluate your theory, we'd have to put it to the Occam's Razor test.
The simplest answer is that Windows really does have lots of vulnerabilities, and the security companies really are in over their head.
Obviously, this is patently false. Windows is widely known to be bug-free and highly secure, and the security companies have developed a suite of efficient, stable software to help us defend against viruses. So your theory obviously has merit. How could it be otherwise?
The truth is, consumer-grade antivirus products can't protect against targeted malware created by well-resourced nation-states with bulging budgets.
You don't say.
I have seen it on here lately - cleanMyPC or something like that....pretty good so I have heard........
Once you are hit, it is already too late.
What we as sysadmins and users should focus on instead is prevention.
Unfortunately, prevention relies mostly on end user education. They will always download that cool image, or play that game, forward that e-card, etc. You can't cure user stupidity with technology. The car analogy would be, well, eliminate cars and make everyone take the train.
stop using windows bro
But without windows, the house is so dark!
Who benefits from the success of Stuxnet, Flame, et.al.? The U.S. has a simple method, (publicly tested, and verified), of bringing down a countries entire electrical system, and that includes those systems that have backups. Anytime the U.S. wants to "turn off" the power to a country like Iran, it can. But the U.S. hasn't, so who else? I don't see complexity here, I see simple economic warfare. And I see where, Iran could easily handle a problem like a war with guns; but Iran is helpless against a war with credit cards. If I were Iran I would not look west, their guns are chillingly clean.
Of course they are out of their league with stuxnet and flame. The AV companies are used to fighting teenage hackers and Russian mobsters, they aren't prepared to fight the two of the highest funded militaries in the world (USA and Israel). It's hard to beat the enemy when they outnumber and "outgun" you by a factor of 100,000
who is that 'U' who keeps failing (according to you) ? there is no user named 'U' on slashdot, so who is it ?
Whoever replies to apk fails. I've done it. Don't do it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Or, put another way, "extraordinary claims require extraordinary evidence."
From a certain attacker competence and resource level upwards, a leaky bucket like Windows cannot be fixed anymore. It takes competent system administration on a solid platform and a minimal attack surface. It also takes quality engineering with security in mind on everything that is reachable over the network. Most current software is so pathetically insecure (and yes, that includes quite a bit of FOSS software), that no amount of add-ons will ever make it secure.
On the other hand, software that was done with sound secure software engineering practices, competent personnel and adequate resources is very hard to attack and will quite often be impossible to attack. The saying that everything can be attacked is just a lame excuse for insecure software. It has no relation to what can actually be done.
What the article also shows is that the reactive, try-to-patch-thousands-of-tiny-holes-on-insecure-platforms-by-external-software that the AV companies are selling is fundamentally limited. This is not a surprise to any real security expert.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Flamer has been out in the wild since cca. 2007, with a MS signed certificate, and the first IT security organization that decides to bring it to public attention is a Russian company, and the first removal tool is from a Romanian company. Right, because all of these antivirus companies are so dumb they cannot detect a 20 MB spyware pack on Windows machines for four years.
The most bothersome statement to me is right here:
>consumer-grade antivirus products
Look, we all know that more advanced solutions are out there, antivirus techniques that rely on advanced chipset features and even custom hardware modules to protect systems. Yet we're still stuck using the same old known-signature-scanning, high-level-OS-API-using *shit* that wasn't up to the job a decade ago. Why? Are the billions of dollars a year in claimed corporate losses to computer intrusions insufficient profit motive for someone to bring something better to market? Are we really expected to believe that billion dollar companies like Intel, Microsoft, Google, and Apple simply aren't up to the technical challenge, let alone government agencies like the NSA whose job it is supposed to be to protect the security of America's communications? I guess they're too busy violating that security to care, these days.
The pace of progress on the consumer internet used to be blinding. Now, with the network mostly taken over by large corporations and the governments they are symbiotic with, and the capture of the knowledge and creative spheres by government dollars and NDAs, the internet is becoming just as dysfunctional as the lumbering dinosaurs all-too-willing to ruin anything and hurt anyone necessary to ensure their continued place at the head of the table.
As if biological virus detection works any differently. There's an inherent problem of identifying what is "good" and what is "bad" if you have a complicated system. The virus detection companies have a problem that mirrors the complexity of the biological varieties. Sure you can detect certain "signatures" of potentially bad invaders, but evolutionary pressure will weed those out and then you are leave you the ones that are harder to detect...
Another option seems to be to attempt to identify "self" and not-self. Unfortutnatly, although that's potentially easier, the fact that the apple closed eco-system and the proposed win8 closed eco-system ruffles so many feathers, yet doesn't seem to be fool-proof either.
Sadly for many of us (meaning the tinkers of the world), perhaps the better answer is complete lock-down. If you can't install or un anything, then less options exist for problems. Although this probably won't work either (bugs are inevitible and now they will be hard coded-in).
What does that leave? Probably we need to flip this around evolve and learn to live with viruses. Viruses are inevitable, and the problem we have is that we trust each other too much. So how do we (as in human biological systems) deal with viruses? In addition to the ability to We have evolved get "sick" (when we get a virus) and evolved to learn how to detect when our comrades are sick and avoid them. Perhaps OS vendors and anti-virus firms should concentrate more on teaching our computers how to recognize when they are in contact with other "sick" computer (basically a firewall on steroids). Some commercial devices are doing this already (they look through emails, torrents, etc to try to identify stuff like high-risk data, etc). We probably need to get better at this stuff... On how to force computers to get "sick" (other than slow down), perhaps anonymity is the biggest problem (in an anonymous situation, biological vectors tend to spread faster).
This is perhaps the most unfortunate realization that open-ness and anonymity are perhaps the environment that actually allows for viruses to cause the problem that exists to day (think shared needles in a heroin den or any other analogy you might think of).
MS has issued a security update KB2701704 that revokes some certificates, presumably the ones used in these attacks.
make imaginary.friends COUNT=100 VISIBLE=false
"Flame" isn't on the list of malware detected by the Microsoft Malicious Software Removal Tool. Why not?
Yeah, right. I constantly get warnings about packers (or even keyloggers, because they like hooking it up low level style I guess, and who can blame them) in code that isn't only legitimate, but blows all other code on my computer (including the AV software) out of the water. Things you'd download from scene.org or pouet.net. Sweet, sexy little things.
Sounds like what you are wanting is what Avast and Comodo already do, which is scan before load all web pages and sandbox the browser. This way if the website you try to hook to is "infected' instead of just running the code it blocks it and gives you a warning and since by default the browser is sandboxed anyway if something manages to get past their heuristics its not gonna be going anywhere anyway.
ACs don't waste your time replying, your posts are never seen by me.
Fyi, I do not reply as AC unless I have serious reason for it. Being asked for a clarification is not one of these things. As you can see from my posting history, I often argue on some pretty hot and difficult topics all under my own handle. Thanks for not assuming things and not getting some random flamer get his kicks.
On your point, you clearly state that the reason for the "false positive" was "certain techniques I used in the file, for good reasons". That's not malware detection hit - that's heuristics seeing certain properties of the file and labelling it as such. Malware detection usually hits on specific code inherent to particular malware, not methods of compression of the executable.
(Obvious caveat: typically. YMMV).
I'm not trying to be the last authority here, I'm merely pointing out that some parts of your story seem to not match other parts. Perhaps you overly assumed things about scanners that weren't true?
That guy just comes off as being an asshole and doesn't really provide any useful info whatsoever. He sounds bitter that someone was able to come up with a virus that didn't fit the preconceived package they expected and therefore fooled them all.
But anti-virus software just started detecting the packers and obfuscators, which no legitimate code would have...
You mean like they detect UPX'd apps as a "potential threat"?
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
How are you and the rest of the Wolverines going to do with small arms against drone warfare and nerve gas?
Look this is done by NSA or CIA or the like. That means they had help from M$ and the lot, and also from name-brand people in the open source world. This has to include possibly getting help from the virus protection makers themselves, who knows? . You can't know because where national security intersects with stuff we use from companies we know, lying becomes virtuous and anyone can be lying. You're through the looking glass now. That's how this game is played. So the fact that they were able to pass as a trusted application component is no surprise.
One thing that's distressing is that, just as in non-cyber warfare, the ability to invoke entropy exceeds the ability to preserve order. For example, we can't protect ourselves against nukes. In fact, we can't protect ourselves against most weapons. That's only going to become more true as weapons become fiercer. Worse, this is not just true of our side, it unfortunately holds for the other side. This fact holds huge political and societal ramifications.
As the ability to create destructive artifacts moves from the nation-state to the level of small groups and finally to the level of individual actors, then the interest of the majority- in the form of the state- in controlling and knowing the actions of not just nation states, but also small groups and finally individual actors will only increase.
If it only takes one guy (it's always a guy) to harm a lot of people in very bad or mortal ways, the state, unfortunately, has a legitimate interest in knowing as much as it can about everyone's doings :(
This is not even something that will be inflicted on an unwilling populace- it's something they'll demand.
You can see this principle in action today. Virus writers hurt a whole lot of people but it's just a little damage. So the state has created the new category of cybercrime and pursues offenders with a little vigor.
They pursue with a lot more vigor small groups who want to mortally harm small groups of people, say at a mall by shooting it up.
They pursue with yet vigor and money small groups who want to acquire WMD and any person or entity who wants to help them. This is something we (allegedly) go to war over, point being at least Congress conceives of this as being worthy of an all out national response, whether they're right on the facts or wrong is irrelevant in this context.
As technology progresses, the number of people needed to inflict damage tends towards one. The type of damage that person can inflict tends towards death and disability. The number of people that damage can be inflicted upon tends towards hundreds, then thousands then millions. All three variables moving independently yet all trending overall towards their mayhem extrema.
It will serve us to remember that this is a basic fact about the world and the future that is no one's fault. The changes to come between individuals and the state are inevitable.
The challenge for the future is how do we structure society and redefine the roles of state and individual so that we can keep ourselves safe against the lone psycho with the nano-lab in the basement AND ALSO have a free, democratic and trusted form of government? How can we create a government that is at once radically more transparent and trustworthy than the one we have now and also opaque enough to be able to wage devastating, indefensible, asymmetrical warfare on any one individual anywhere in the world at any time?
I dunno.