Endpoint
8/9/2011
09:44 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Google Researcher Dissects Sophos Antivirus Software

AV product vendors don't provide sufficient technical details on how their products work, researcher says at Black Hat USA

A security researcher at Black Hat USA last week shared his findings from reverse-engineering Sophos' core antivirus engine software in an effort to uncover more details on just how the product actually works.

Click here for more of Dark Reading's Black Hat articles.

Google researcher Tavis Ormandy, who conducted the research independently, performed an in-depth analysis of Sophos' core AV engine in Sophos Antivirus 9.5 for Windows. Ormandy's premise for his research was that when AV firms falsely or inadequately advertise their features in product specifications, it misleads customers.

"AV vendors won't explain what it is they do," he said. They don’t publish technical specifications, so there's no way to really understand or test their claims, he said.

And poorly implemented features in AV software expand the attack surface, according to Ormandy, who pointed out such weaknesses in the Sophos engine. These are not traditional vulnerabilities, but instead how Sophos designed the code and implemented its features, he said.

Among the flaws in the design were some in the product's signatures, which Ormandy described as weak and relying heavily on CRC32 and "matching irrelevant or dead-code sequences." He also scrutinized Sophos' buffer overflow protection system (BOPS) in its host-intrusion prevention system, which he said works only in earlier Windows versions (prior to Vista) and employs weak runtime exploit mitigation, as well as weak crypto to protect it from attackers.

Overall, Sophos employs a weak encryption scheme within its products that is dated and could ultimately be beaten, he said. "Sophos tried to hide the key within the product [with this encryption scheme]," Ormandy said. "That reduces it to an obfuscation scheme. Sophos uses obfuscation where real cryptography could work."

Among the other features Ormandy studied in Sophos' product were native code emulation, unpackers, and "genes and genotypes." He concluded that its native code emulation could be bypassed or detected by an attacker, and its native unpackers could be gamed by bypassing the blacklisting feature.

Sophos was briefed on his findings prior to his talk. "I shared some drafts with Sophos. They were good-natured about it and receptive to criticism," he said.

Chester Wisniewski, senior security adviser at Sophos Canada, said Ormandy's work was "a pretty nice audit of the code."

"What he did in pulling apart the source code was quite impressive ... it was clearly his approach of what he normally does, looking for vulns and that type of thing, even though he was not looking for vulnerabilities here," Wisniewski said. "He looked at tiny, detailed views of the overall picture."

Wisniewski said Sophos considered one of Ormandy's most constructive points to be adding support for SSL/TLS and encrypting update downloads. "[Download encryption is] already in our Mac product," Wisniewski said. "We're going to deliver updates differently [for Windows as well], so we definitely felt those criticisms were very valid."

But Sophos took issue with some of Ormandy's assessment of the product, including Sophos' encryption scheme, which he said was intended for obfuscation.

"Some things we disagree with," Wisniewski said, such as Ormandy's claim that weaknesses he found in the product left it open for attack. "He kept calling it an 'attack surface,' but none of this compromises our ability to protect [customers]."

Wisniewski also noted that Sophos doesn't employ BOPS in Vista or Windows 7 versions because those operating systems use Microsoft's ASLR for that type of protection. "[BOP] is for protecting those old legacy Windows 95/98 systems," he said.

However, Sophos still plans to add BOPS to the newer Windows OSes, he said.

"We have found that some of the Microsoft stuff is not working as well as when it was first launched and can be bypassed, so to get the next step ahead, we are going to implement BOPS in Vista and Windows 7 as well," Wisniewski said.

Meanwhile, Ormandy said he will release free tools that he developed while researching the Sophos software. His main take on the product: It doesn't live up to its claims. "It's safe to say that Sophos' technology is not really equipped to deliver on the promise they made," Ormandy said.

For full technical details of Ormandy's research, download his report here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2008-3277
Published: 2014-04-15
Untrusted search path vulnerability in a certain Red Hat build script for the ibmssh executable in ibutils packages before ibutils-1.5.7-2.el6 in Red Hat Enterprise Linux (RHEL) 6 and ibutils-1.2-11.2.el5 in Red Hat Enterprise Linux (RHEL) 5 allows local users to gain privileges via a Trojan Horse p...

CVE-2010-2236
Published: 2014-04-15
The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3.0, allows remote authenticated users with permissions to administer monitoring probes to execute arbitrary code via unspecified vectors, rela...

CVE-2011-3628
Published: 2014-04-15
Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.0...

CVE-2012-0214
Published: 2014-04-15
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user fro...

CVE-2013-4768
Published: 2014-04-15
The web services APIs in Eucalyptus 2.0 through 3.4.1 allow remote attackers to cause a denial of service via vectors related to the "network connection clean up code" and (1) Cloud Controller (CLC), (2) Walrus, (3) Storage Controller (SC), and (4) VMware Broker (VB).

Best of the Web