Antivirus Software Could Make Your Company More Vulnerable (csoonline.com)

itwbennett writes: Since June, researchers have found and reported several dozen serious flaws in antivirus products from vendors such as Kaspersky Lab, ESET, Avast, AVG Technologies, Intel Security (formerly McAfee) and Malwarebytes. Many of those vulnerabilities would have allowed attackers to remotely execute malicious code on computers, to abuse the functionality of the antivirus products themselves, to gain higher privileges on compromised systems and even to defeat the anti-exploitation defenses of third-party applications. And evidence suggests that attacks against antivirus products are both possible and likely. Some researchers believe that such attacks have already occurred, even though antivirus vendors might not be aware of them because of the very small number of victims. Among the emails leaked last year from Italian surveillance firm Hacking Team there is a document with exploits offered for sale by an outfit called Vulnerabilities Brokerage International. The document lists various privilege escalation, information disclosure and detection bypassing exploits for multiple antivirus products, and also a remote code execution exploit for ESET NOD32 Antivirus with the status 'sold.'

Comments

Re:Not quite AV, but close

[Dutch Gun]

I'll half agree with you... I think I know what you're getting at, but I think it's worth clarifying a bit. After all, it's not like any arbitrary code on a machine is vulnerable to random attacks from the internet.

Rather than talking about simplicity - because let's face it, that will never happen - we need to focus on minimizing and hardening the attack surface. For instance, if my personal machine sits behind a router, arbitrary incoming traffic from the internet is blocked. Anything that isn't blocked then has to make it past my personal machine's built-in firewall, which would tend to reject most anything else. Thus, it's likely that 99.999 percent of the code on my machine (any modern OS is *horribly* complex by nature) is completely immune to random internet-based attacks, at least ignoring user actions like launching an infected program or script.

A good example of minimizing attack surface is Amazon's recent release of a very tiny TLS library called s2n. With only 6000 lines of code, it's *much* easier to vet and declare secure than the feature rich but dangerously bloated OpenSSL library, which may put servers at risk with features they never used. Even the name (signal to noise) indicates the intent, which is to keep the library tiny and focused. We're discovering that there's a danger to letting code grow infinitely large and complex, and not depreciating it, because even if those old features work, they still may contain security issues. I'd be extremely surprised if s2n had any serious security flaws in its implementation simply due to its small size - there's just not as much that can go wrong there.

Re:cost and benifit

[DarkOx]

Seriously, if windows needs a 'security' kludge like UAC to stay secure, then it's not really secure at all.

That is seriously ignorant. What UAC is really under the hood is very similar to having two accounts. One privileged and one less so. The shell has some smarts in it to spot when things that are likely to need escalation such as programs named setup.exe are called and asks, when the user is privileged. Its also a little more convient for the user because the environment etc is shared, and depending on the registry settings they maybe don't need to type their password, and because the OS takes special steps to ensure programs cannot send events to UAC windows that is still somewhat tamper proof.

You could very correctly compare this to a Linux system where your user account is a member of the wheel group and wheel is allowed to run any command via sudo. The difference is UAC without a password can still be an effective security control while sudo without a password can't (the malware can just try and invoke it). So either sudo has to require password entry (annoying) or its only protecting the system from things like accidents like you thought the working directory was /home/myself/documents turns out wrong window and you are in /bin for whatever reason (still valuable).

Is the old advice of having an account that is not a local administrator and a separate account that is to use for things that need that, and then running them either via runas or via logout / login to the other account still be better. Probably, but years of practice has shown us users won't as a general rule do that. Which is why the UNIX and like world has sudo and Windows now has UAC.

The alternative is everyone runs around running everything privileged all the time. Which years of practice has shown us means malware gets to do whatever it wants.