Attacks/Breaches
5/11/2010
09:53 AM
50%
50%

Malware Attack Bypasses Major Defenses

Almost all known anti-virus PC security suites are vulnerable to the bait-and-switch attack which cloaks attack code from security scanners.

Security firm Matousec said it has discovered a vulnerability affecting almost all known security software. Malware can bait-and-switch security scanners, using unsuspicious system-level calls that get a secure green light, and then altering the calls to include attack code before they get executed.

According to Matousec’s advisory, "the results can be summarized in one sentence: If a product uses SSDT [system service descriptor table ] hooks or other kinds of kernel-mode hooks on a similar level to implement security features, it is vulnerable. In other words, 100% of the tested products were found vulnerable."

Tested products included all major antivirus vendors PC security suites, such as Kaspersky Internet Security 2010, McAfee Total Protection 2010, Norton Internet Security 2010, Sophos Endpoint Security and Control 9.0.5 and Trend Micro Internet Security Pro 2010.

At issue is hooking -- the prevailing technique that security software uses to protect a PC. Security suites often "hook" into the operating system at the user level, which Matousec said is inherently unsafe, or else lower down in the stack, through Windows DLL (dynamic link library) files, evaluating all calls and only allowing through ones they deem safe, thus preventing malicious processes or applications from running.

Next, any safe calls proceed, often via a bottom-level DLL file that communicates directly with the kernel. (The kernel is the bridge between applications and data processing.)

The attack affects both the user- and kernel-hooking techniques, and appears to also work on accounts which do not have administrator-level privileges. According Matousec, "all dynamic link libraries belonging to [the] Windows API reside in the user-mode portion of processes' address space, hence the application code might avoid calling them, which effectively bypasses hooks made by security software. If the application needs to communicate with the kernel, it can use the system call instruction directly. And this action cannot be caught or prevented by any type of user mode hooking."

Matousec said it developed proof-of-concept attack code, which it used to test numerous products. The firm declined to release the code, or to publish its recommendations for preventing hooking attacks, but said it notified affected vendors of the problem in October 2008 and that "some vendors confirmed the vulnerability."

Until vendors patch their software, Matousec recommends against installing multiple security products in an attempt to remediate the vulnerability. "One might think that installing two security applications will protect against the argument-switch attack. This makes, however, the situation even worse."

The problem, beyond a performance hit, is that both products will compete to "hook" any process first, making it unclear which product is at work at any given moment. Furthermore, products do not work in parallel; the attack can simply defeat whichever first grabs the hook.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3966
Published: 2015-08-30
The IPsec SA establishment process on Innominate mGuard devices with firmware 8.x before 8.1.7 allows remote authenticated users to cause a denial of service (VPN service restart) by leveraging a peer relationship to send a crafted configuration with compression.

CVE-2015-4555
Published: 2015-08-30
Buffer overflow in the HTTP administrative interface in TIBCO Rendezvous before 8.4.4, Rendezvous Network Server before 1.1.1, Substation ES before 2.9.0, and Messaging Appliance before 8.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vect...

CVE-2015-5698
Published: 2015-08-30
Cross-site request forgery (CSRF) vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2015-4497
Published: 2015-08-29
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token...

CVE-2015-4498
Published: 2015-08-29
The add-on installation feature in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to bypass an intended user-confirmation requirement by constructing a crafted data: URL and triggering navigation to an arbitrary http: or https: URL at a certain early point i...

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.