Endpoint
8/9/2011
09:44 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google Researcher Dissects Sophos Antivirus Software

AV product vendors don't provide sufficient technical details on how their products work, researcher says at Black Hat USA

A security researcher at Black Hat USA last week shared his findings from reverse-engineering Sophos' core antivirus engine software in an effort to uncover more details on just how the product actually works.

Click here for more of Dark Reading's Black Hat articles.

Google researcher Tavis Ormandy, who conducted the research independently, performed an in-depth analysis of Sophos' core AV engine in Sophos Antivirus 9.5 for Windows. Ormandy's premise for his research was that when AV firms falsely or inadequately advertise their features in product specifications, it misleads customers.

"AV vendors won't explain what it is they do," he said. They don’t publish technical specifications, so there's no way to really understand or test their claims, he said.

And poorly implemented features in AV software expand the attack surface, according to Ormandy, who pointed out such weaknesses in the Sophos engine. These are not traditional vulnerabilities, but instead how Sophos designed the code and implemented its features, he said.

Among the flaws in the design were some in the product's signatures, which Ormandy described as weak and relying heavily on CRC32 and "matching irrelevant or dead-code sequences." He also scrutinized Sophos' buffer overflow protection system (BOPS) in its host-intrusion prevention system, which he said works only in earlier Windows versions (prior to Vista) and employs weak runtime exploit mitigation, as well as weak crypto to protect it from attackers.

Overall, Sophos employs a weak encryption scheme within its products that is dated and could ultimately be beaten, he said. "Sophos tried to hide the key within the product [with this encryption scheme]," Ormandy said. "That reduces it to an obfuscation scheme. Sophos uses obfuscation where real cryptography could work."

Among the other features Ormandy studied in Sophos' product were native code emulation, unpackers, and "genes and genotypes." He concluded that its native code emulation could be bypassed or detected by an attacker, and its native unpackers could be gamed by bypassing the blacklisting feature.

Sophos was briefed on his findings prior to his talk. "I shared some drafts with Sophos. They were good-natured about it and receptive to criticism," he said.

Chester Wisniewski, senior security adviser at Sophos Canada, said Ormandy's work was "a pretty nice audit of the code."

"What he did in pulling apart the source code was quite impressive ... it was clearly his approach of what he normally does, looking for vulns and that type of thing, even though he was not looking for vulnerabilities here," Wisniewski said. "He looked at tiny, detailed views of the overall picture."

Wisniewski said Sophos considered one of Ormandy's most constructive points to be adding support for SSL/TLS and encrypting update downloads. "[Download encryption is] already in our Mac product," Wisniewski said. "We're going to deliver updates differently [for Windows as well], so we definitely felt those criticisms were very valid."

But Sophos took issue with some of Ormandy's assessment of the product, including Sophos' encryption scheme, which he said was intended for obfuscation.

"Some things we disagree with," Wisniewski said, such as Ormandy's claim that weaknesses he found in the product left it open for attack. "He kept calling it an 'attack surface,' but none of this compromises our ability to protect [customers]."

Wisniewski also noted that Sophos doesn't employ BOPS in Vista or Windows 7 versions because those operating systems use Microsoft's ASLR for that type of protection. "[BOP] is for protecting those old legacy Windows 95/98 systems," he said.

However, Sophos still plans to add BOPS to the newer Windows OSes, he said.

"We have found that some of the Microsoft stuff is not working as well as when it was first launched and can be bypassed, so to get the next step ahead, we are going to implement BOPS in Vista and Windows 7 as well," Wisniewski said.

Meanwhile, Ormandy said he will release free tools that he developed while researching the Sophos software. His main take on the product: It doesn't live up to its claims. "It's safe to say that Sophos' technology is not really equipped to deliver on the promise they made," Ormandy said.

For full technical details of Ormandy's research, download his report here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.