Vulnerabilities / Threats

7/28/2016
01:00 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
100%
0%

Multiple Major Security Products Open To Big Vulns Via 'Hooking Engines'

Black Hat USA talk will show how flawed implementation of hooking techniques are putting security and other software at risk.

The momentum's been growing the last few years for the security community to turn its microscope inward as security researchers start to dig in earnest for serious vulnerabilities within security products. That'll be reflected in several talks at Black Hat USA in Las Vegas next week -- including research from enSilo that takes a thorough look at six different common security issues stemming from faulty implementation of code hooking and injections techniques.

Spread across 15 different products--many of them antivirus and security platforms--the discoveries resonate due to the fact that many security products and other applications use the same vulnerable hooking engines, making for a much broader attack surface area than if these hooking functions were developed on a one-off basis.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Used by a range of products that depend on virtualization, sandboxing, performance management, or otherwise changing the behavior of operating system functions, hooking is an especially important technique for security products that depend on it to monitor for malicious activity on systems.

According to Udi Yavo and Tomer Bitton, co-founders enSilo, when they began the work that eventually blossomed into what would become their talk scheduled for next week, "Captain Hook: Pirating AVs to Bypass Exploit Mitigations," they initially thought they'd only found an isolated flaw in the anti-malware hooking engine of a single security product. But the scope of the problems grew as the pair found that many security platforms and other software are prone to serious vulnerabilities in the way their hooking engines interact with underlying system processes.

"Overall, hooking and injections are an important part of security products, because they have to monitor what’s happening in the system to operate,” Yavo says. “However, they must realize that doing such intrusive operations has implications that affect security. Ironically, the fact that they are in the system and vulnerable bypasses the security controls of the underlying operating system."

Not Just Security Software

Vulnerabilities in hooking engines also go beyond security products, the researchers say. As part of their presentation, they'll also discuss issues in the Microsoft Detours hooking engine, which is due out for a patch in August. However, it was the security product implications that really resonated with the duo; issues in these types of products are particularly insidious because security practitioners tend to view them as inviolate.

For example, if a security product were to report an attack through a vulnerable security product, most security teams would likely mark it as a false positive and move on, Yavo says. Security products are generally trusted, and the overwhelming number of alerts would probably cause most organizations to overlook such a warning, he warns.

Yavo and Britton found a number of exploits that would be effective against some of the security products they examined. Affected vendors included AVG, Kaspersky, McAfee, Symantec, Trend Micro, Bitdefender, Webroot, AVAST and Vera. For example, in one AV, they were able to show that an attacker could exploit improper hooking implementations to bypass ASLR in both 32-bit and 64-bit applications.

 "There was also another vendor which was maybe even a bit worse,” Yavo says. “If you combined all the issues that they had with the injections and the hooking, it allowed the attacker to gain persistency on the system because the injection method was not secure. An attacker could message their injection method to get injected into every process in the system, because the hooking engine was also flawed.”

The presentation is scheduled for Wednesday, August 3, but those interested in the presentation can get a technical teaser of some of the pair's findings in a blog they recently posted about their work.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cybersecurity Must Be an International Effort
Kelly Sheridan, Associate Editor, Dark Reading,  12/6/2017
NIST Releases New Cybersecurity Framework Draft
Jai Vijayan, Freelance writer,  12/6/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.