Slashdot Mirror
Google Security Engineer Issues Sophos Warning
angry tapir writes "Google security engineer Tavis Ormandy discovered several flaws in Sophos antivirus and says the product should be kept away from high value information systems unless the company can avoid easy mistakes and issue patches faster. Ormandy has released a scathing 30-page analysis (PDF) 'Sophail: Applied attacks against Sophos Antivirus,' in which he details several flaws 'caused by poor development practices and coding standards,' topped off by the company's sluggishly response to the warning he had working exploits for those flaws. One of the exploits Ormandy details is for a flaw in Sophos' on-access scanner, which could be used to unleash a worm on a network simply by targeting a company receiving an attack email via Outlook. Although the example he provided was on a Mac, the 'wormable, pre-authentication, zero-interaction, remote root' affected all platforms running Sophos. (Ormandy released the paper as an independent researcher, not in his role as a Google employee.)"
Why a user would not simply install MS Security Essentials and be done with it?
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
Let the lawsuits begin!!!
Any wagers on whether they sue Google, based on some strained argument that they are responsible for his views, even when acting independently?
Sheesh, evil *and* a jerk. -- Jade
So he lets Sophos have a 2 month window, but when Microsoft doesn't give him special priority rights and enters him into the same bug system everyone else gets, he full discloses?
Wow where would we be if not for ol Tavvy. I work in emerging threats for a large company, and totally remember that wave of helpcenter exploits we had BEFORE he fully disclosed, and then AFTER he disclosed we totally had zero exploits that copied his complicated embedded vbscript chain with the""%%A" sequences exactly.
Google probably only keep him employed so he doesn''t fully disclose something he finds and doesn't get a response from the vendor 19 seconds after sending the email to their public email address.
I don't think there's an app for that. ;)
This was the subject of a talk given at Black Hat (or was it DEFCON?) in August out in 'Vegas. Why it's news now suddenly is a mystery to me. The guy did thoroughly hack the product to include reversing it's signature encryption (homebrew crypto?!) and figuring out that some features simply didn't work. However at the time of the talk he also told the audience that he had been working with the company and that they had changed some things and would be switching to standard crypto. I'd still agree the company comes across as slimy since some of their claims were pure crap (some signatures apparently obviously machine generated despite claims they didn't do that etc.) but now months later to post this like it's news? Really? Maybe he should have had this paper ready to roll right after the talk?
http://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html#Ormandy
Build it, Drive it, Improve it! Hybridz.org
Well for one thing, MSE only runs on Windows. Sophos runs on OS X and Linux as well. Remember, this is a business-oriented product.. In fact, one of the big concerns here is that there are so many bugs in the Sophos scanner that, if it's installed on a server (email, proxy/firewall, whatever), it's easy to compromise that server. This applies even if running Linux.
There's no place I could be, since I've found Serenity...
From http://nakedsecurity.sophos.com/2012/11/05/tavis-ormandy-sophos/ and reprinted here in case of slashdotting...
As a security company, keeping customers safe is Sophos's primary responsibility. As a result, Sophos experts investigate all vulnerability reports and implement the best course of action in the tightest time period possible.
Recently, researcher Tavis Ormandy contacted Sophos about an examination he had done of Sophos's anti-virus product, identifying a number of issues:
A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed Visual Basic 6 compiled files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
The Sophos web protection and web control Layered Service Provider (LSP) block page was found to include a XSS flaw. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
An issue was identified with the BOPS technology in Sophos Anti-Virus for Windows and how it interacted with ASLR on Windows Vista and later. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
An issue was identified in how Sophos protection interacts with Internet Explorer's Protected Mode. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers cbegan: 5 November 2012 (56 days later)
Vulnerabilities were found in how Sophos's anti-virus engine handles malformed CAB files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)
Vulnerabilities were found in how Sophos's anti-virus engine handles malformed RAR files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 10 September 2012
Roll-out of a fix for Sophos customers began: 5 November 2012 (56 days later)
A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed PDF files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
First reported to Sophos: 5 October 2012
Roll-out of a fix for Sophos customers began: 5 November 2012 (31 days later)
Tavis Ormandy has provided examples of other malformed files which can cause the Sophos anti-virus engine to halt - these are being examined by Sophos experts. Sophos has seen no evidence of this occurring in the wild.
First reported to Sophos: 4 October 2012
Roll-out of a fix for Sophos customers will begin: 28 November 2012 (55 days later)
Best practice
Sophos customers are reminded of the following best practices:
1. Keep systems patched and up to date
2. Upgrade to the latest version of Sophos software to get the best protection
Responsible disclosure
Sophos believes in responsible disclosure.
The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products. On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach.
In Soviet Russia, Trojan exploits YOU!
not enough
FTW ??
Fuck
The
World
!
!
Why to so many people look at the clothes people are wearing, their hair cut, shave, attitude, the car they drive etc when forming opinions about the information other people put out? None of that changes the points and the information.
Take the information and use it as you see fit and form your own opinion based on the information, judge it for what it is.
A hospital I worked at had a horrible USB stick virus (which I ended up getting). Sophos didn't work, and the IT guy I reported it to just updated the definition file, and tried to scan again (and it obviously didn't work).
The thing that annoyed me the most was there was no way I could easily forward the virus files to Sophos. No way of communicating with them. I guess they just don't care. Making software work costs money. That money is best spend on marketing.
Fortunately there was nothing important on my card, and I have never allowed autorun, but it made me hate AV software even more.
Frankly, a bit of arrogance is pretty normal here. I mean, this guy does what most people not only can't do, but treat as a kind of black magic... and he does it well. Lots of vulnerabilities are found each year. Some of them are known to be serious enough to be a major threat (i.e. all layers of defense can be cut through to produce a working exploit). A handful of them have exploits actually written, though usually with benign payloads (popping up Calculator is a popular choice in the community). Tavis not only did that, he did it multiple times to a high-profile target in the security field! That's a hell of a coup.
I actually think the tone of the paper was pretty good. It didn't read like some lawyer/marketing-whitewashed press release, it wasn't painfully dry and boring to wade through like so many academic papers, and it wasn't really gloating either. Yeah, he calls Sophos out and doesn't pull his punches much when pointing out their mistakes, but that's how the security world works, and this is doubly a matter of security (not just security flaws, but in a security product). Besides, he *did* pull his punches some; read the stuff on the revision history of the paper, and you'll see several indications of changes made at Sophos' behest.
There's no place I could be, since I've found Serenity...
It's hardly unique. Lots of AV has giant flaws. Here's one we tested recently: eScan
Remember 2 months ago? http://tech.slashdot.org/story/12/09/20/1645202/sophos-anti-virus-update-identifies-sophos-code-as-malware
They are shipping totally untested code.
This fall, never before seen in cinema, a new type of hero, the geeky Sophos Patcher, finds himself fighting a virus in corporate HQ: The question of the universe and everything and zombies... Get ready to be patched...
About two years ago Sophos was highly critical of the way Tavis disclosed a high profile vulnerability in Windows calling it irresponsible.
http://nakedsecurity.sophos.com/2010/06/11/google-engineer-act-irresponsibly-microsoft-zeroday-disclosure/
Looks like Tavis did not too took it too well and has been since going after Sophos products.His tone in the latest paper is simply a reflection of the feud between the two.
Sophos initially estimated it would take six months to produce a patch that involved fixing a “single line of code”. According to Ormandy, Sophos subsequently agreed to two months.
That's nothing... Microsoft hasn't fixed a single-line error that's been in SQL Server Reporting Services since it was released, causing it to break CSV encoded files when a field contains a linebreak. [It's supposed to quote the field, but the line in question throws away the result of the string.replace() function.] That's been nearly twelve years.
Just in case someone wants the numbers.
Includes eight points of document, attack points, response and versions of product in which they were fixed and dates the fixed versions released.
Sophos KB Article 118424
Where this all started back in July 2012:
Small children shouldn't cast stones
Ongoing "drama"
A dish best served with Ketchup
The "sequel"
Never let a good Rant get the best of you
And today "When last we Left Lost.."
How you Americans an Jews "legitimize" your Permanent Warfare. So nice how you rationalize why it is basically OK to drive away families from their land at gunpoint. So nice when you whine about "your loved ones" being killed in retaliation.
Mr Ahmadinejad merely helps the oppressed an downtrodden to fight back against the injustice and brutality financed by US taxpayers. Now take your SUV and burn Arab oil stolen at gunpoint to "feel free".
Several of these bugs sound as if they were typical C and/or C++ issues. These are caused by developers being under pressure to "deliver features" by management. They simply can't deliver perfect code. Nobody in a commercial setting can (maybe with the exception of flight control, and even those have some ugly videos on youtube).
We need to move away from C or C++ towards Memory Safe Languages, as this will immediately eliminate a large part (about 50% of reported) exploits. The often cited "overhead" is actually not that dramatic (probably less than 15% of CPU time) and there is no need to use VMs and bytecode to achieve memory safety.
Here is my attempt to build a memory-safe derivative of C++, complete with synchronous destructors and refcounted pointers:
http://sourceforge.net/p/sappeurcompiler/code-0/2/tree/trunk/
And yes, it is quite rough around the edges, but it demonstrates that you don't need to pay the Java or C# tax to get more robustness. Neither do you need to run the security risk called "JVM".
That will certainly improve, well, financial results. Meanwhile Chicom Intel will walk away with your balls and you will discover it only when you want to make sex with momma the day after tomorrow.
We are led by sleazebags who first and foremost are experts in covering up and covering their rectums. See RSA/Lockheed and how Chicom got them.
"it wasn't really gloating either."
He's toned things down in the last year - have you read the original sophail from spring last year? He rips sophos' head off and pisses down their gullet. It's arrogant showboating, but absolutely perfect given the shambles he's covering. There's nothing wrong in making stupid companies which pretend that they are not stupid appear stupid.
Also FatPhil on SoylentNews, id 863
his tone on the previous paper (sophail, April 2011, IIRC) is much more a reflection of that. Except it's not a feud there, it's a DM-wearing kick-fest, and Sophos is the intoxicated tramp. You can almost hear /Singing in the Rain/ playing whilst reading it.
Also FatPhil on SoylentNews, id 863
Surprisingly:
System Center 2012 Extends Client Management and Security to Mac and Linux