Endpoint
8/9/2011
09:44 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google Researcher Dissects Sophos Antivirus Software

AV product vendors don't provide sufficient technical details on how their products work, researcher says at Black Hat USA

A security researcher at Black Hat USA last week shared his findings from reverse-engineering Sophos' core antivirus engine software in an effort to uncover more details on just how the product actually works.

Click here for more of Dark Reading's Black Hat articles.

Google researcher Tavis Ormandy, who conducted the research independently, performed an in-depth analysis of Sophos' core AV engine in Sophos Antivirus 9.5 for Windows. Ormandy's premise for his research was that when AV firms falsely or inadequately advertise their features in product specifications, it misleads customers.

"AV vendors won't explain what it is they do," he said. They don’t publish technical specifications, so there's no way to really understand or test their claims, he said.

And poorly implemented features in AV software expand the attack surface, according to Ormandy, who pointed out such weaknesses in the Sophos engine. These are not traditional vulnerabilities, but instead how Sophos designed the code and implemented its features, he said.

Among the flaws in the design were some in the product's signatures, which Ormandy described as weak and relying heavily on CRC32 and "matching irrelevant or dead-code sequences." He also scrutinized Sophos' buffer overflow protection system (BOPS) in its host-intrusion prevention system, which he said works only in earlier Windows versions (prior to Vista) and employs weak runtime exploit mitigation, as well as weak crypto to protect it from attackers.

Overall, Sophos employs a weak encryption scheme within its products that is dated and could ultimately be beaten, he said. "Sophos tried to hide the key within the product [with this encryption scheme]," Ormandy said. "That reduces it to an obfuscation scheme. Sophos uses obfuscation where real cryptography could work."

Among the other features Ormandy studied in Sophos' product were native code emulation, unpackers, and "genes and genotypes." He concluded that its native code emulation could be bypassed or detected by an attacker, and its native unpackers could be gamed by bypassing the blacklisting feature.

Sophos was briefed on his findings prior to his talk. "I shared some drafts with Sophos. They were good-natured about it and receptive to criticism," he said.

Chester Wisniewski, senior security adviser at Sophos Canada, said Ormandy's work was "a pretty nice audit of the code."

"What he did in pulling apart the source code was quite impressive ... it was clearly his approach of what he normally does, looking for vulns and that type of thing, even though he was not looking for vulnerabilities here," Wisniewski said. "He looked at tiny, detailed views of the overall picture."

Wisniewski said Sophos considered one of Ormandy's most constructive points to be adding support for SSL/TLS and encrypting update downloads. "[Download encryption is] already in our Mac product," Wisniewski said. "We're going to deliver updates differently [for Windows as well], so we definitely felt those criticisms were very valid."

But Sophos took issue with some of Ormandy's assessment of the product, including Sophos' encryption scheme, which he said was intended for obfuscation.

"Some things we disagree with," Wisniewski said, such as Ormandy's claim that weaknesses he found in the product left it open for attack. "He kept calling it an 'attack surface,' but none of this compromises our ability to protect [customers]."

Wisniewski also noted that Sophos doesn't employ BOPS in Vista or Windows 7 versions because those operating systems use Microsoft's ASLR for that type of protection. "[BOP] is for protecting those old legacy Windows 95/98 systems," he said.

However, Sophos still plans to add BOPS to the newer Windows OSes, he said.

"We have found that some of the Microsoft stuff is not working as well as when it was first launched and can be bypassed, so to get the next step ahead, we are going to implement BOPS in Vista and Windows 7 as well," Wisniewski said.

Meanwhile, Ormandy said he will release free tools that he developed while researching the Sophos software. His main take on the product: It doesn't live up to its claims. "It's safe to say that Sophos' technology is not really equipped to deliver on the promise they made," Ormandy said.

For full technical details of Ormandy's research, download his report here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5104
Published: 2014-07-28
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action ...

CVE-2014-5105
Published: 2014-07-28
Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.

CVE-2014-5106
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.

CVE-2014-5107
Published: 2014-07-28
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.ph...

CVE-2014-5108
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.