Slashdot Mirror
How AV Can Open You To Attacks That Otherwise Wouldn't Be Possible (arstechnica.com)
Antivirus suites expose a user's system to attacks that otherwise wouldn't be possible, a security researcher reported on Friday. From a report: On Friday, a researcher documented a vulnerability he had found in about a dozen name-brand AV programs that allows attackers who already have a toehold on a targeted computer to gain complete system control. AVGater, as the researcher is calling the vulnerability, works by relocating malware already put into an AV quarantine folder to a location of the attacker's choosing. Attackers can exploit it by first getting a vulnerable AV program to quarantine a piece of malicious code and then moving it into a sensitive directory such as C:\Windows or C:\Program Files, which normally would be off limits to the attacker. Six of the affected AV programs have patched the vulnerablity after it was privately reported. The remaining brands have yet to fix it, said Florian Bogner, a Vienna, Austria-based security researcher who gets paid to hack businesses so he can help them identify weaknesses in their networks. Bogner said he developed a series of AVGater exploits during several assignments that called for him to penetrate deep inside customer networks. Using malicious phishing e-mails, he was able to infect employee PCs, but he still faced a significant challenge. Because company administrators set up the PCs to run with limited system privileges, Bogner's malware was unable to access the password database -- known as the Security Account Manager -- that stored credentials he needed to pivot onto the corporate network.
They "patched the vulnerable"? Really?
At this rate english will be a dead language within three or four generations.
I wonder if this is being exploited in the wild
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
I know it's quite common to bash Antivirus, from "they create the viruses themselves to create a market" to "they are snakeoil anyway", so the headline is very Slashdot-y, but please realize that this is exploitable because three things come together:
1. The way Windows symlinks is FUBAR.
2. There are STILL programs that simply go by the logic of "let's just load every DLL in this directory".
3. A program (in this case an AV tool) allows to "restore" files into a directory, does not double check where that ends up and has admin privileges.
You can probably get the same effect with backup programs.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
.. probably patched it. It's been busy updating itself on the various systems here.
Linux is better at resisting these things than MS windows. one can argue that Linux is less targeted, but whatever the reason, Linux (there is Apple based on BSD, but Apple has hooks in their products that are not open source). No system is foolproof. and some of these attacks used phishing techniques which someone who is watching can probably spot. But hopefully the AV companies will get better staying ahead of the curve.
"Imagination is more important than knowledge" - Einstein
They "patched the vulnerable"? Really?
It's a close relative of Do the needful.
Jackson Klaxon, a 32 year old software developer from Nohope Idaho, was today arrested outside a local dentist's office for indecent behaviour, stealing a llama from a nearby llama farmer and suspicion of being under the influence of hallucinogens.
"The door to the surgery opened and I was shocked to see Mr Klaxon standing there naked, particularly as he didn't have an appointment", said Ethel Mercaptan, Receptionist, mother of six and part-time meth addict. "He turned round, a sight none of us was ready for, and dragged a large, somewhat reluctant animal in after him. I thought it was a stretch goat but was later informed it's what they call a llama. I became alarmed when Mr Klaxon started dancing and waving his arms around in Reception, all the time singing a silly song."
"I told him he had to stop but he took no notice so I called the police, I mean we had women and children waiting and going to the dentist can be stressful enough. It's true some of the children were laughing and clapping and a couple of the adults were smiling but we really can't have that sort of behavior."
"We'll have to have the carpet replaced because of the mess. What? No, the llama was well behaved by comparison. I'm afraid most of it was Mr Klaxon."
See subject & APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads/script/malware rob speed/security/privacy/bandwidth.
Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirect (99.999% of ISP DNS != patched vs. it) + DNS tracking & lighten DNS load & resolve faster from local RAM!
* Via what u NATIVELY have in a FASTER kernelmode IP stack!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/ (self checking code vs. infection of it built-in)
With less complexity 4 exploit APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads/script/malware rob speed/security/privacy/bandwidth.
Hosts add speed (hardcodes/adblocks), security (bad sites/malware/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers).
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!
Avoids DNSChangers in routers/IP settings & dns redirect (99++% of ISP DNS != patched vs. it) + DNS tracking & lighten DNS load & resolve faster from local RAM!
* Via what u NATIVELY have in a FASTER kernelmode IP stack!
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/ (self checking code vs. infection of it built-in)
News at 1942!
Seriously though.. antivirus software is software, and many of them are very complex pieces of software given that they all seem to incorporate some combination of the primary AV, a firewall, malware scanners, webpage scanners, filesystem monitors, kitchen sinks, etc.
Its kind of like expecting that your doctor can't get sick just because she's a doctor.
You just keep on proving that you are a retard. Making all sorts of false claims, lying about your file aggregators abilities and in general being a whining little bitch. You can't even do the hard work of curating and vetting the lists your overly complex bloated software consumes. Don't worry I will continue to point out your retarded lies.
I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
(APK's) work, I've flat out said it's good by BronsCon
I've tried his hosts file generating software. It works by bmo
APK your posts on this & the hosts file posts, and more, have never been in error &/or bad advice by BlueStrat
Your premise that hostfiles are a good way to deal with advertising & malvertising is quite valid by JazzLad
I like your host file system by Karmashock
(NEED MORE?)
* Hosted by Malwarebytes' hpHosts!
See subject: You've done better?
APK
P.S.=> China imitated me http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/ ... apk
So if he had an appointment, the stretch goat and nakedness would have been fine?
Most anti-malware programs are nonfree (user-subjugating, proprietary) software. So it stands to reason that since people make mistakes and sometimes purposefully either don't fix exploitable bugs or put them there intentionally, nonfree anti-malware programs should be treated no differently from other non-free software—don't run nonfree software. The solution becomes obvious: run free software anti-malware programs instead. Apparently privatization got us to where we are: a series of untrustable nonfree programs with weaknesses only they're allowed to fix; weaknesses which can be exploited to do the very thing the programs aren't supposed to allow.
This is also the proper reason to not trust Kaspersky's anti-malware software: not because it's Russian, not because its recent issues might be the CIA's work posing as something its not, but because it is nonfree. Yes, I'm aware that Kaspersky allows some people to inspect what may well be its source code (perhaps under a non-disclosure agreement). But that is not software freedom because it doesn't grant those few people the freedom to run, share, and modify the code. Also because that limited permission doesn't include Kaspersky's users. All computer users deserve software freedom for all of the software they run. Together we can improve the software and end up with something we can trust. I don't think businesses deserve primacy, and we have n obligation to turn everything into a question of 'how can someone make money with this?', but we could give a research lab funding to continue their work investigating malware and coming up with improvements to anti-malware programs. Given how many people use computers (in other words, they're not optional anymore), we should seriously consider federal funding and long-term employment for this.
Digital Citizen