Vulnerabilities / Threats

7/28/2016
01:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
100%
0%

Multiple Major Security Products Open To Big Vulns Via 'Hooking Engines'

Black Hat USA talk will show how flawed implementation of hooking techniques are putting security and other software at risk.

The momentum's been growing the last few years for the security community to turn its microscope inward as security researchers start to dig in earnest for serious vulnerabilities within security products. That'll be reflected in several talks at Black Hat USA in Las Vegas next week -- including research from enSilo that takes a thorough look at six different common security issues stemming from faulty implementation of code hooking and injections techniques.

Spread across 15 different products--many of them antivirus and security platforms--the discoveries resonate due to the fact that many security products and other applications use the same vulnerable hooking engines, making for a much broader attack surface area than if these hooking functions were developed on a one-off basis.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Used by a range of products that depend on virtualization, sandboxing, performance management, or otherwise changing the behavior of operating system functions, hooking is an especially important technique for security products that depend on it to monitor for malicious activity on systems.

According to Udi Yavo and Tomer Bitton, co-founders enSilo, when they began the work that eventually blossomed into what would become their talk scheduled for next week, "Captain Hook: Pirating AVs to Bypass Exploit Mitigations," they initially thought they'd only found an isolated flaw in the anti-malware hooking engine of a single security product. But the scope of the problems grew as the pair found that many security platforms and other software are prone to serious vulnerabilities in the way their hooking engines interact with underlying system processes.

"Overall, hooking and injections are an important part of security products, because they have to monitor what’s happening in the system to operate,” Yavo says. “However, they must realize that doing such intrusive operations has implications that affect security. Ironically, the fact that they are in the system and vulnerable bypasses the security controls of the underlying operating system."

Not Just Security Software

Vulnerabilities in hooking engines also go beyond security products, the researchers say. As part of their presentation, they'll also discuss issues in the Microsoft Detours hooking engine, which is due out for a patch in August. However, it was the security product implications that really resonated with the duo; issues in these types of products are particularly insidious because security practitioners tend to view them as inviolate.

For example, if a security product were to report an attack through a vulnerable security product, most security teams would likely mark it as a false positive and move on, Yavo says. Security products are generally trusted, and the overwhelming number of alerts would probably cause most organizations to overlook such a warning, he warns.

Yavo and Britton found a number of exploits that would be effective against some of the security products they examined. Affected vendors included AVG, Kaspersky, McAfee, Symantec, Trend Micro, Bitdefender, Webroot, AVAST and Vera. For example, in one AV, they were able to show that an attacker could exploit improper hooking implementations to bypass ASLR in both 32-bit and 64-bit applications.

 "There was also another vendor which was maybe even a bit worse,” Yavo says. “If you combined all the issues that they had with the injections and the hooking, it allowed the attacker to gain persistency on the system because the injection method was not secure. An attacker could message their injection method to get injected into every process in the system, because the hooking engine was also flawed.”

The presentation is scheduled for Wednesday, August 3, but those interested in the presentation can get a technical teaser of some of the pair's findings in a blog they recently posted about their work.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.