Attacks/Breaches
5/11/2010
09:53 AM
Connect Directly
RSS
E-Mail
50%
50%

Malware Attack Bypasses Major Defenses

Almost all known anti-virus PC security suites are vulnerable to the bait-and-switch attack which cloaks attack code from security scanners.

Security firm Matousec said it has discovered a vulnerability affecting almost all known security software. Malware can bait-and-switch security scanners, using unsuspicious system-level calls that get a secure green light, and then altering the calls to include attack code before they get executed.

According to Matousec’s advisory, "the results can be summarized in one sentence: If a product uses SSDT [system service descriptor table ] hooks or other kinds of kernel-mode hooks on a similar level to implement security features, it is vulnerable. In other words, 100% of the tested products were found vulnerable."

Tested products included all major antivirus vendors PC security suites, such as Kaspersky Internet Security 2010, McAfee Total Protection 2010, Norton Internet Security 2010, Sophos Endpoint Security and Control 9.0.5 and Trend Micro Internet Security Pro 2010.

At issue is hooking -- the prevailing technique that security software uses to protect a PC. Security suites often "hook" into the operating system at the user level, which Matousec said is inherently unsafe, or else lower down in the stack, through Windows DLL (dynamic link library) files, evaluating all calls and only allowing through ones they deem safe, thus preventing malicious processes or applications from running.

Next, any safe calls proceed, often via a bottom-level DLL file that communicates directly with the kernel. (The kernel is the bridge between applications and data processing.)

The attack affects both the user- and kernel-hooking techniques, and appears to also work on accounts which do not have administrator-level privileges. According Matousec, "all dynamic link libraries belonging to [the] Windows API reside in the user-mode portion of processes' address space, hence the application code might avoid calling them, which effectively bypasses hooks made by security software. If the application needs to communicate with the kernel, it can use the system call instruction directly. And this action cannot be caught or prevented by any type of user mode hooking."

Matousec said it developed proof-of-concept attack code, which it used to test numerous products. The firm declined to release the code, or to publish its recommendations for preventing hooking attacks, but said it notified affected vendors of the problem in October 2008 and that "some vendors confirmed the vulnerability."

Until vendors patch their software, Matousec recommends against installing multiple security products in an attempt to remediate the vulnerability. "One might think that installing two security applications will protect against the argument-switch attack. This makes, however, the situation even worse."

The problem, beyond a performance hit, is that both products will compete to "hook" any process first, making it unclear which product is at work at any given moment. Furthermore, products do not work in parallel; the attack can simply defeat whichever first grabs the hook.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.