Endpoint
8/9/2011
09:44 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Google Researcher Dissects Sophos Antivirus Software

AV product vendors don't provide sufficient technical details on how their products work, researcher says at Black Hat USA

A security researcher at Black Hat USA last week shared his findings from reverse-engineering Sophos' core antivirus engine software in an effort to uncover more details on just how the product actually works.

Click here for more of Dark Reading's Black Hat articles.

Google researcher Tavis Ormandy, who conducted the research independently, performed an in-depth analysis of Sophos' core AV engine in Sophos Antivirus 9.5 for Windows. Ormandy's premise for his research was that when AV firms falsely or inadequately advertise their features in product specifications, it misleads customers.

"AV vendors won't explain what it is they do," he said. They don’t publish technical specifications, so there's no way to really understand or test their claims, he said.

And poorly implemented features in AV software expand the attack surface, according to Ormandy, who pointed out such weaknesses in the Sophos engine. These are not traditional vulnerabilities, but instead how Sophos designed the code and implemented its features, he said.

Among the flaws in the design were some in the product's signatures, which Ormandy described as weak and relying heavily on CRC32 and "matching irrelevant or dead-code sequences." He also scrutinized Sophos' buffer overflow protection system (BOPS) in its host-intrusion prevention system, which he said works only in earlier Windows versions (prior to Vista) and employs weak runtime exploit mitigation, as well as weak crypto to protect it from attackers.

Overall, Sophos employs a weak encryption scheme within its products that is dated and could ultimately be beaten, he said. "Sophos tried to hide the key within the product [with this encryption scheme]," Ormandy said. "That reduces it to an obfuscation scheme. Sophos uses obfuscation where real cryptography could work."

Among the other features Ormandy studied in Sophos' product were native code emulation, unpackers, and "genes and genotypes." He concluded that its native code emulation could be bypassed or detected by an attacker, and its native unpackers could be gamed by bypassing the blacklisting feature.

Sophos was briefed on his findings prior to his talk. "I shared some drafts with Sophos. They were good-natured about it and receptive to criticism," he said.

Chester Wisniewski, senior security adviser at Sophos Canada, said Ormandy's work was "a pretty nice audit of the code."

"What he did in pulling apart the source code was quite impressive ... it was clearly his approach of what he normally does, looking for vulns and that type of thing, even though he was not looking for vulnerabilities here," Wisniewski said. "He looked at tiny, detailed views of the overall picture."

Wisniewski said Sophos considered one of Ormandy's most constructive points to be adding support for SSL/TLS and encrypting update downloads. "[Download encryption is] already in our Mac product," Wisniewski said. "We're going to deliver updates differently [for Windows as well], so we definitely felt those criticisms were very valid."

But Sophos took issue with some of Ormandy's assessment of the product, including Sophos' encryption scheme, which he said was intended for obfuscation.

"Some things we disagree with," Wisniewski said, such as Ormandy's claim that weaknesses he found in the product left it open for attack. "He kept calling it an 'attack surface,' but none of this compromises our ability to protect [customers]."

Wisniewski also noted that Sophos doesn't employ BOPS in Vista or Windows 7 versions because those operating systems use Microsoft's ASLR for that type of protection. "[BOP] is for protecting those old legacy Windows 95/98 systems," he said.

However, Sophos still plans to add BOPS to the newer Windows OSes, he said.

"We have found that some of the Microsoft stuff is not working as well as when it was first launched and can be bypassed, so to get the next step ahead, we are going to implement BOPS in Vista and Windows 7 as well," Wisniewski said.

Meanwhile, Ormandy said he will release free tools that he developed while researching the Sophos software. His main take on the product: It doesn't live up to its claims. "It's safe to say that Sophos' technology is not really equipped to deliver on the promise they made," Ormandy said.

For full technical details of Ormandy's research, download his report here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web