Attacks/Breaches
5/11/2010
09:53 AM
50%
50%

Malware Attack Bypasses Major Defenses

Almost all known anti-virus PC security suites are vulnerable to the bait-and-switch attack which cloaks attack code from security scanners.

Security firm Matousec said it has discovered a vulnerability affecting almost all known security software. Malware can bait-and-switch security scanners, using unsuspicious system-level calls that get a secure green light, and then altering the calls to include attack code before they get executed.

According to Matousec’s advisory, "the results can be summarized in one sentence: If a product uses SSDT [system service descriptor table ] hooks or other kinds of kernel-mode hooks on a similar level to implement security features, it is vulnerable. In other words, 100% of the tested products were found vulnerable."

Tested products included all major antivirus vendors PC security suites, such as Kaspersky Internet Security 2010, McAfee Total Protection 2010, Norton Internet Security 2010, Sophos Endpoint Security and Control 9.0.5 and Trend Micro Internet Security Pro 2010.

At issue is hooking -- the prevailing technique that security software uses to protect a PC. Security suites often "hook" into the operating system at the user level, which Matousec said is inherently unsafe, or else lower down in the stack, through Windows DLL (dynamic link library) files, evaluating all calls and only allowing through ones they deem safe, thus preventing malicious processes or applications from running.

Next, any safe calls proceed, often via a bottom-level DLL file that communicates directly with the kernel. (The kernel is the bridge between applications and data processing.)

The attack affects both the user- and kernel-hooking techniques, and appears to also work on accounts which do not have administrator-level privileges. According Matousec, "all dynamic link libraries belonging to [the] Windows API reside in the user-mode portion of processes' address space, hence the application code might avoid calling them, which effectively bypasses hooks made by security software. If the application needs to communicate with the kernel, it can use the system call instruction directly. And this action cannot be caught or prevented by any type of user mode hooking."

Matousec said it developed proof-of-concept attack code, which it used to test numerous products. The firm declined to release the code, or to publish its recommendations for preventing hooking attacks, but said it notified affected vendors of the problem in October 2008 and that "some vendors confirmed the vulnerability."

Until vendors patch their software, Matousec recommends against installing multiple security products in an attempt to remediate the vulnerability. "One might think that installing two security applications will protect against the argument-switch attack. This makes, however, the situation even worse."

The problem, beyond a performance hit, is that both products will compete to "hook" any process first, making it unclear which product is at work at any given moment. Furthermore, products do not work in parallel; the attack can simply defeat whichever first grabs the hook.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?