Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Security Engineer Issues Sophos Warning

Posted by Soulskill on from the you-have-been-called-out dept.

angry tapir writes "Google security engineer Tavis Ormandy discovered several flaws in Sophos antivirus and says the product should be kept away from high value information systems unless the company can avoid easy mistakes and issue patches faster. Ormandy has released a scathing 30-page analysis (PDF) 'Sophail: Applied attacks against Sophos Antivirus,' in which he details several flaws 'caused by poor development practices and coding standards,' topped off by the company's sluggishly response to the warning he had working exploits for those flaws. One of the exploits Ormandy details is for a flaw in Sophos' on-access scanner, which could be used to unleash a worm on a network simply by targeting a company receiving an attack email via Outlook. Although the example he provided was on a Mac, the 'wormable, pre-authentication, zero-interaction, remote root' affected all platforms running Sophos. (Ormandy released the paper as an independent researcher, not in his role as a Google employee.)"

28 of 89 comments (clear)

  1. Can someone explain by mrbluze · · Score: 4, Insightful

    Why a user would not simply install MS Security Essentials and be done with it?

    --
    Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
    1. Re:Can someone explain by Anonymous Coward · · Score: 2, Informative

      Because large organisations don't have users installing unmanaged anti-virus software on company owned endpoints.

      Sophos (at least in my country) barely rates a mention in the consumer/home user anti-virus market, but they are massive in the enterprise market.

    2. Re:Can someone explain by fuzzyfuzzyfungus · · Score: 3, Informative

      Why a user would not simply install MS Security Essentials and be done with it?

      Among other considerations(like central management), I'm pretty sure that the MSSE license frowns on use in anything larger than a home/home office type environment.

    3. Re:Can someone explain by Rennt · · Score: 4, Informative

      Users don't install Sophos. It's the kind of product that is marketed to the CEO level (thus forced on enterprise IT departments).

    4. Re:Can someone explain by Anonymous Coward · · Score: 2, Informative

      Then again, Dave Kennedy recently recommended MSE at a security conference I went to. Says it's much better than most of the other AVs he tested by far. It might be a desktop oriented product, but it does the job.

    5. Re:Can someone explain by LordLimecat · · Score: 5, Informative

      Security essentials is packaged for businesses as Forefront, and can be managed centrally.

      Being "massive in the enterprise market" doesnt mean youre good at it.

    6. Re:Can someone explain by Ritz_Just_Ritz · · Score: 4, Informative

      Bingo. I work at a large fortune 10 company with a few hundred thousand employees and it seems like a monthly occurrence where Sophos actively gets in the way. If it's not flagging benign content, it's causing resource problems on end-user systems. To call their support sluggish would be doing it a kindness. I believe we're actively looking for a replacement.

    7. Re:Can someone explain by cbhacking · · Score: 4, Funny

      I could email you a PDF to install that replacement for you...

      No, not a PDF on *how* to install it, one that *would* do so (or rather, cause Sophos to do so) as soon as it entered your email server! :-)

      --
      There's no place I could be, since I've found Serenity...
    8. Re:Can someone explain by clarkn0va · · Score: 4, Informative

      Security essentials is packaged for businesses as Forefront

      You're so last month! We're calling it System Center Endpoint Protection now, because it rolls off the tongue more naturally.

      --
      I am literally 3000 tokens away from the chaotic crossbow --Stephen
    9. Re:Can someone explain by TheLink · · Score: 3, Informative

      And many here said I was stupid not to run antivirus software on my personal system. Fact is, Sophos and the rest of the AV idiots prove that the cure can be worse than the disease especially if you know how to avoid the disease.

      I generally still believe that most normal Windows users are better off with some AV software, but nowadays when they still get infected and I still have to fix their frigging machines for them, it starts making me wonder whether they really are better off - the malware people do have access to the AV software so they can tweak their malware till it passes all of them.

      Even though I don't use AV software, I won't get badly affected by most drive-bys since my browser does not run as the same user account as the account I use to log in to windows. The drive-by might set up the autorun and start up hooks, but they only apply to the browser account, which I don't use to log in. That browser has noscript and adblock too. I also use different browsers for banking (so pwning my Slashdot browser won't get you my bank stuff).

      And I know how to upload stuff to virustotal to check before running it. So if the 30+ different AV software can't spot the virus, the virus would not be detected either if I installed AV software on my computer. The difference is the installed AV software would be using up my system resources every day, whereas I only need to do that check once in a long while. And the AV stuff is often exploitable[1] and they also have a habit of marking important stuff (or almost everything) as malware every few years.

      If you pwn my video driver or do other stuff (zero day OS privilege escalation) then sure you can pwn me, but I bet the AV crap won't stop you either.

      [1] Sophos, Symantec, McAfee, etc if you can crash them, they are likely to be exploitable, and their crappy software runs with higher privileges than my browsers.

      --
    10. Re:Can someone explain by CodeheadUK · · Score: 2

      Yep. I used to look after Sophos in what should have been a very secure network.

      Sophos set the virus signature updates out monthly on CD-ROM.

      We replaced it with McAfee. Not much better, but at lest the updates hit every days or two.

    11. Re:Can someone explain by MrIlios · · Score: 2

      I've used Sophos for around 7 years at different organisations and have always received updates automatically over the internet every few hours. Perhaps the installation on the 'very secure network' was set up a very long time ago and never reviewed - either that or the 'very secure network' was designed not to be internet connected and the update was specified to be delivered via physical media? I've had a few issues with the software in past, including recent wide-spread false-positive problem (http://www.sophos.com/en-us/support/knowledgebase/118311.aspx), but generally I've found the central management and reporting utility to be pretty good.

    12. Re:Can someone explain by Xest · · Score: 2

      I don't know why the viewpoint your put forward is so unpopular on Slashdot, I've said the same sorts of things before and been modded into oblivion for it over the years.

      It's a shame because it's true. If you're sensible in what you execute and don't visit untrusted websites with the likes of Javascript turned on in a browser running as administrator, and don't open fishy e-mail attachments etc. then there's really not much that can go wrong. You're not invulnerable by any measure, but the amount of times I've seen viruses fly right by AV software like McAfee and Sophos when I was working at tech support I'm not convinced you're any worse off either. What you do gain is system stability and system performance, as AV software is a horrendous drain on resources and tends to be of horrendous quality softwarewise, something this article points out too.

      Honestly, fighting AV software always took up far far more time when I worked in support than viruses and other malware did, and regularly existed on machines that had AV installed.

      The problem is that still, to this day, AV vendors are pushing a rather archaic model that is largely reactive in dealing with a number of types of threat. A number of viruses over the years demonstrated how fruitless the method was when the likes of msblast.exe spread so far and wide before the AV vendors offered any kind of defence against it that the damage was already done by the time their software had any relevance to securing systems against it. The only real defence at the time was a sensible patching regime against it.

    13. Re:Can someone explain by tibit · · Score: 2

      CCleaner isn't for the paranoid, it's simply a tool every administrator needs. Its functionality has nary nothing to do with viruses or malware. If you value your time, you won't be waiting for the microsoft-written add/remove software box to come up. It takes 15 fucking seconds to come up on a clean, less than a year old i7 system running Windows 7. Ccleaner's remove software pane comes up instantly.

      --
      A successful API design takes a mixture of software design and pedagogy.
    14. Re:Can someone explain by TheLink · · Score: 2

      As I mentioned, if you run the browser as a different (even more restricted) user, the damage is usually limited, unless the malware uses a privilege escalation exploit. So even if you have javascript enabled, you could still be OK.

      From a Computer Science perspective the AV vendors are attempting something "harder" than solving the Halting Problem. They are not always able to have the full inputs or the full description of the program, and "harm"/"evilness" sometimes is harder to define.
      Halting Problem: given a program and its inputs figure out whether it will halt or run forever.
      Malware detection problem: given part of a program, and part of the inputs figure out whether it will cause significant harm.

      Hence I prefer sandboxing, or running stuff with more limited privileges. Which is a bit like solving the Halting Problem by setting a limit on how long the program can run, no matter what it tries to do.

      Of course in the real world, heuristics are sometimes good enough. But when the malware authors also have access to VirusTotal and AV software in general, they can ensure that their stuff passes all the tests.

      I believe Android and other systems require the program to specify up front what privileges they want (and presumably then enforce it with sandboxing). I've proposed something similar before to Ubuntu: https://bugs.launchpad.net/ubuntu/+bug/156693

      Requiring new programs to state what privileges they need (before deciding whether to run them or not) would be way better than the AV approach. Makes it easier to judge whether they will do something fishy or not - a screensaver is normally not likely to need network access.

      --
  2. MS Security Essentials on a Mac? by dclozier · · Score: 4, Funny

    I don't think there's an app for that. ;)

  3. Released.... in August! by BLKMGK · · Score: 4, Informative

    This was the subject of a talk given at Black Hat (or was it DEFCON?) in August out in 'Vegas. Why it's news now suddenly is a mystery to me. The guy did thoroughly hack the product to include reversing it's signature encryption (homebrew crypto?!) and figuring out that some features simply didn't work. However at the time of the talk he also told the audience that he had been working with the company and that they had changed some things and would be switching to standard crypto. I'd still agree the company comes across as slimy since some of their claims were pure crap (some signatures apparently obviously machine generated despite claims they didn't do that etc.) but now months later to post this like it's news? Really? Maybe he should have had this paper ready to roll right after the talk?

    http://www.blackhat.com/html/bh-us-11/bh-us-11-briefings.html#Ormandy

    --
    Build it, Drive it, Improve it! Hybridz.org
    1. Re:Released.... in August! by BLKMGK · · Score: 4, Insightful

      Oh yeah, I asked the guy after his talk if he was going to research any other AV products - his response was that no he wasn't. I wish he would or that perhaps someone else would. I'm pretty sure Sophos isn't the high bar in AV but I'm betting that there may be some others with some pretty crappy behavior out there that haven't been highlighted. Why not give them a shot too? Wasn't clear why these guys were such a target although he did mention their being used in various hardware products as an AV engine as part of the reason .

      --
      Build it, Drive it, Improve it! Hybridz.org
    2. Re:Released.... in August! by BLKMGK · · Score: 2

      Meh, he gave enogh detail on how their sandbox couldn't handle specific processor instructions and would bypass files that had them to be pretty effective against the AV I'd say. I think there was also a specific number of instructions the sandbox would run before passing the file too but I might be thinking of another AV.

      I'll grant that he didn't give a script that one could just copy and paste but I think he gave plenty of information to a pretty interested audience that could act on it back in August! If nothing he described their crypto well enough for someone to duplicate his work if inclined and pointed out many areas that were weak. The paper just documents and supports his claims is what I'd say. Even when he spoke he admitted that Sophos was working to fix things already. Sophos wasn't squeeky clean, don't get me wrong, but this is so long after the fact that I'd pretty much forgotten about it so to me it comes across as his wanting to make a second splash with the research is all...

      --
      Build it, Drive it, Improve it! Hybridz.org
  4. Re:release the lawyers! by cbhacking · · Score: 3, Interesting

    Sue for what? This was responsibly disclosed, and the facts are straightforward so it's not like they can sue for libel. In fact, Sophos requested and was granted a number of redactions and different phrasings throughout the paper. You can read about it in the document history section, near the bottom.

    Yes, I read the whole paper... some 8 hours ago. Slashdot is slow.

    --
    There's no place I could be, since I've found Serenity...
  5. MSE is for home or small business use. by cbhacking · · Score: 2

    Well for one thing, MSE only runs on Windows. Sophos runs on OS X and Linux as well. Remember, this is a business-oriented product.. In fact, one of the big concerns here is that there are so many bugs in the Sophos scanner that, if it's installed on a server (email, proxy/firewall, whatever), it's easy to compromise that server. This applies even if running Linux.

    --
    There's no place I could be, since I've found Serenity...
  6. Official Sophos Response. by Deathlizard · · Score: 5, Informative

    From http://nakedsecurity.sophos.com/2012/11/05/tavis-ormandy-sophos/ and reprinted here in case of slashdotting...

    As a security company, keeping customers safe is Sophos's primary responsibility. As a result, Sophos experts investigate all vulnerability reports and implement the best course of action in the tightest time period possible.

    Recently, researcher Tavis Ormandy contacted Sophos about an examination he had done of Sophos's anti-virus product, identifying a number of issues:

    A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed Visual Basic 6 compiled files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    The Sophos web protection and web control Layered Service Provider (LSP) block page was found to include a XSS flaw. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    An issue was identified with the BOPS technology in Sophos Anti-Virus for Windows and how it interacted with ASLR on Windows Vista and later. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    An issue was identified in how Sophos protection interacts with Internet Explorer's Protected Mode. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers cbegan: 5 November 2012 (56 days later)

    Vulnerabilities were found in how Sophos's anti-virus engine handles malformed CAB files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers completed: 22 October 2012 (42 days later)

    Vulnerabilities were found in how Sophos's anti-virus engine handles malformed RAR files. These vulnerabilities could cause the Sophos engine to corrupt memory. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 10 September 2012
    Roll-out of a fix for Sophos customers began: 5 November 2012 (56 days later)

    A remote code execution vulnerability was discovered in how the Sophos anti-virus engine scans malformed PDF files. Sophos has seen no evidence of this vulnerability being exploited in the wild.
    First reported to Sophos: 5 October 2012
    Roll-out of a fix for Sophos customers began: 5 November 2012 (31 days later)

    Tavis Ormandy has provided examples of other malformed files which can cause the Sophos anti-virus engine to halt - these are being examined by Sophos experts. Sophos has seen no evidence of this occurring in the wild.
    First reported to Sophos: 4 October 2012
    Roll-out of a fix for Sophos customers will begin: 28 November 2012 (55 days later)

    Best practice
    Sophos customers are reminded of the following best practices:

    1. Keep systems patched and up to date

    2. Upgrade to the latest version of Sophos software to get the best protection

    Responsible disclosure
    Sophos believes in responsible disclosure.

    The work of Tavis Ormandy, and others like him in the research community, who choose to work alongside security companies, can significantly strengthen software products. On behalf of its partners and customers, Sophos appreciates Tavis Ormandy's efforts and responsible approach.

    --
    In Soviet Russia, Trojan exploits YOU!
    1. Re:Official Sophos Response. by Anonymous Coward · · Score: 2, Funny

      Best practice
      Sophos customers are reminded of the following best practice:

      0. Uninstall Sophos

    2. Re:Official Sophos Response. by Anonymous Coward · · Score: 5, Insightful

      What's worse?
      1. That a security company had so many serious flaws in a flagship product
      2. That the same security company considers it OK to take (on average) over 40 days to fix the issues. Remember that this is an Anti-virus product. One of the main use cases is to respond quickly to flaws in other software, to cover the period between the flaw becoming known, and the vendor releasing a fix.
      3. That most clients won't see a problem with 2.

    3. Re:Official Sophos Response. by Anonymous Coward · · Score: 2, Insightful

      1. Well now it has that many fewer flaws. Yeah, it seems like a lot, but I'm not convinced Sophos has significantly more flaws than any other software. The previous AV product we used (McAfee) was buggy as hell, all the time. How many patches has Windows or Linux, or any other AV product or frankly any other significant piece of non-trivial software product on the market received? I'm confident the answer is 'more than 8' in all cases.

      2. 40 days for a vulnerability which has not been disclosed publicly and is not being exploited in the wild isn't the worse thing in the world. It's not great, but it could be a McAfee product, and your computer could just freeze up periodically for minutes at a time when it updates.

      3. The company I work for uses Sophos. Sure, I'd like to see the problems fixed sooner. Were the circumstances different (publicly release vulnerability and/or actively exploited) no doubt it would have been patched sooner, but the patch would have been less thoroughly tested. I'm happy with this response.

  7. Re:release the lawyers! by Anonymous Coward · · Score: 2, Funny

    Again with the $10,000 bets! Mitt, shouldn't you be focused on the election right now?

  8. Re:Arrogance/ego/"INDEPENDANT" hiatus. by cbhacking · · Score: 2

    Frankly, a bit of arrogance is pretty normal here. I mean, this guy does what most people not only can't do, but treat as a kind of black magic... and he does it well. Lots of vulnerabilities are found each year. Some of them are known to be serious enough to be a major threat (i.e. all layers of defense can be cut through to produce a working exploit). A handful of them have exploits actually written, though usually with benign payloads (popping up Calculator is a popular choice in the community). Tavis not only did that, he did it multiple times to a high-profile target in the security field! That's a hell of a coup.

    I actually think the tone of the paper was pretty good. It didn't read like some lawyer/marketing-whitewashed press release, it wasn't painfully dry and boring to wade through like so many academic papers, and it wasn't really gloating either. Yeah, he calls Sophos out and doesn't pull his punches much when pointing out their mistakes, but that's how the security world works, and this is doubly a matter of security (not just security flaws, but in a security product). Besides, he *did* pull his punches some; read the stuff on the revision history of the paper, and you'll see several indications of changes made at Sophos' behest.

    --
    There's no place I could be, since I've found Serenity...
  9. Re:Hospital by myxiplx · · Score: 4, Interesting

    No way to easily report the files? You just email them in, a 30 second phone call to Sophos will get you the details.

    In a previous role we would help clean users home computers from time to time, and we discovered a good number of new viruses. I submitted half a dozen viruses to Sophos that weren't being picked up by any virus scanners. They confirmed them all within a few days, and signatures were added within weeks. The whole process is incredibly easy.