Slashdot Mirror
How AV Can Open You To Attacks That Otherwise Wouldn't Be Possible (arstechnica.com)
Antivirus suites expose a user's system to attacks that otherwise wouldn't be possible, a security researcher reported on Friday. From a report: On Friday, a researcher documented a vulnerability he had found in about a dozen name-brand AV programs that allows attackers who already have a toehold on a targeted computer to gain complete system control. AVGater, as the researcher is calling the vulnerability, works by relocating malware already put into an AV quarantine folder to a location of the attacker's choosing. Attackers can exploit it by first getting a vulnerable AV program to quarantine a piece of malicious code and then moving it into a sensitive directory such as C:\Windows or C:\Program Files, which normally would be off limits to the attacker. Six of the affected AV programs have patched the vulnerablity after it was privately reported. The remaining brands have yet to fix it, said Florian Bogner, a Vienna, Austria-based security researcher who gets paid to hack businesses so he can help them identify weaknesses in their networks. Bogner said he developed a series of AVGater exploits during several assignments that called for him to penetrate deep inside customer networks. Using malicious phishing e-mails, he was able to infect employee PCs, but he still faced a significant challenge. Because company administrators set up the PCs to run with limited system privileges, Bogner's malware was unable to access the password database -- known as the Security Account Manager -- that stored credentials he needed to pivot onto the corporate network.
They "patched the vulnerable"? Really?
At this rate english will be a dead language within three or four generations.
I wonder if this is being exploited in the wild
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
I know it's quite common to bash Antivirus, from "they create the viruses themselves to create a market" to "they are snakeoil anyway", so the headline is very Slashdot-y, but please realize that this is exploitable because three things come together:
1. The way Windows symlinks is FUBAR.
2. There are STILL programs that simply go by the logic of "let's just load every DLL in this directory".
3. A program (in this case an AV tool) allows to "restore" files into a directory, does not double check where that ends up and has admin privileges.
You can probably get the same effect with backup programs.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Linux is better at resisting these things than MS windows. one can argue that Linux is less targeted, but whatever the reason, Linux (there is Apple based on BSD, but Apple has hooks in their products that are not open source). No system is foolproof. and some of these attacks used phishing techniques which someone who is watching can probably spot. But hopefully the AV companies will get better staying ahead of the curve.
"Imagination is more important than knowledge" - Einstein
They "patched the vulnerable"? Really?
It's a close relative of Do the needful.
Jackson Klaxon, a 32 year old software developer from Nohope Idaho, was today arrested outside a local dentist's office for indecent behaviour, stealing a llama from a nearby llama farmer and suspicion of being under the influence of hallucinogens.
"The door to the surgery opened and I was shocked to see Mr Klaxon standing there naked, particularly as he didn't have an appointment", said Ethel Mercaptan, Receptionist, mother of six and part-time meth addict. "He turned round, a sight none of us was ready for, and dragged a large, somewhat reluctant animal in after him. I thought it was a stretch goat but was later informed it's what they call a llama. I became alarmed when Mr Klaxon started dancing and waving his arms around in Reception, all the time singing a silly song."
"I told him he had to stop but he took no notice so I called the police, I mean we had women and children waiting and going to the dentist can be stressful enough. It's true some of the children were laughing and clapping and a couple of the adults were smiling but we really can't have that sort of behavior."
"We'll have to have the carpet replaced because of the mess. What? No, the llama was well behaved by comparison. I'm afraid most of it was Mr Klaxon."
News at 1942!
Seriously though.. antivirus software is software, and many of them are very complex pieces of software given that they all seem to incorporate some combination of the primary AV, a firewall, malware scanners, webpage scanners, filesystem monitors, kitchen sinks, etc.
Its kind of like expecting that your doctor can't get sick just because she's a doctor.
Most anti-malware programs are nonfree (user-subjugating, proprietary) software. So it stands to reason that since people make mistakes and sometimes purposefully either don't fix exploitable bugs or put them there intentionally, nonfree anti-malware programs should be treated no differently from other non-free software—don't run nonfree software. The solution becomes obvious: run free software anti-malware programs instead. Apparently privatization got us to where we are: a series of untrustable nonfree programs with weaknesses only they're allowed to fix; weaknesses which can be exploited to do the very thing the programs aren't supposed to allow.
This is also the proper reason to not trust Kaspersky's anti-malware software: not because it's Russian, not because its recent issues might be the CIA's work posing as something its not, but because it is nonfree. Yes, I'm aware that Kaspersky allows some people to inspect what may well be its source code (perhaps under a non-disclosure agreement). But that is not software freedom because it doesn't grant those few people the freedom to run, share, and modify the code. Also because that limited permission doesn't include Kaspersky's users. All computer users deserve software freedom for all of the software they run. Together we can improve the software and end up with something we can trust. I don't think businesses deserve primacy, and we have n obligation to turn everything into a question of 'how can someone make money with this?', but we could give a research lab funding to continue their work investigating malware and coming up with improvements to anti-malware programs. Given how many people use computers (in other words, they're not optional anymore), we should seriously consider federal funding and long-term employment for this.
Digital Citizen