Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/9/2011
09:44 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Google Researcher Dissects Sophos Antivirus Software

AV product vendors don't provide sufficient technical details on how their products work, researcher says at Black Hat USA

A security researcher at Black Hat USA last week shared his findings from reverse-engineering Sophos' core antivirus engine software in an effort to uncover more details on just how the product actually works.

Click here for more of Dark Reading's Black Hat articles.

Google researcher Tavis Ormandy, who conducted the research independently, performed an in-depth analysis of Sophos' core AV engine in Sophos Antivirus 9.5 for Windows. Ormandy's premise for his research was that when AV firms falsely or inadequately advertise their features in product specifications, it misleads customers.

"AV vendors won't explain what it is they do," he said. They don’t publish technical specifications, so there's no way to really understand or test their claims, he said.

And poorly implemented features in AV software expand the attack surface, according to Ormandy, who pointed out such weaknesses in the Sophos engine. These are not traditional vulnerabilities, but instead how Sophos designed the code and implemented its features, he said.

Among the flaws in the design were some in the product's signatures, which Ormandy described as weak and relying heavily on CRC32 and "matching irrelevant or dead-code sequences." He also scrutinized Sophos' buffer overflow protection system (BOPS) in its host-intrusion prevention system, which he said works only in earlier Windows versions (prior to Vista) and employs weak runtime exploit mitigation, as well as weak crypto to protect it from attackers.

Overall, Sophos employs a weak encryption scheme within its products that is dated and could ultimately be beaten, he said. "Sophos tried to hide the key within the product [with this encryption scheme]," Ormandy said. "That reduces it to an obfuscation scheme. Sophos uses obfuscation where real cryptography could work."

Among the other features Ormandy studied in Sophos' product were native code emulation, unpackers, and "genes and genotypes." He concluded that its native code emulation could be bypassed or detected by an attacker, and its native unpackers could be gamed by bypassing the blacklisting feature.

Sophos was briefed on his findings prior to his talk. "I shared some drafts with Sophos. They were good-natured about it and receptive to criticism," he said.

Chester Wisniewski, senior security adviser at Sophos Canada, said Ormandy's work was "a pretty nice audit of the code."

"What he did in pulling apart the source code was quite impressive ... it was clearly his approach of what he normally does, looking for vulns and that type of thing, even though he was not looking for vulnerabilities here," Wisniewski said. "He looked at tiny, detailed views of the overall picture."

Wisniewski said Sophos considered one of Ormandy's most constructive points to be adding support for SSL/TLS and encrypting update downloads. "[Download encryption is] already in our Mac product," Wisniewski said. "We're going to deliver updates differently [for Windows as well], so we definitely felt those criticisms were very valid."

But Sophos took issue with some of Ormandy's assessment of the product, including Sophos' encryption scheme, which he said was intended for obfuscation.

"Some things we disagree with," Wisniewski said, such as Ormandy's claim that weaknesses he found in the product left it open for attack. "He kept calling it an 'attack surface,' but none of this compromises our ability to protect [customers]."

Wisniewski also noted that Sophos doesn't employ BOPS in Vista or Windows 7 versions because those operating systems use Microsoft's ASLR for that type of protection. "[BOP] is for protecting those old legacy Windows 95/98 systems," he said.

However, Sophos still plans to add BOPS to the newer Windows OSes, he said.

"We have found that some of the Microsoft stuff is not working as well as when it was first launched and can be bypassed, so to get the next step ahead, we are going to implement BOPS in Vista and Windows 7 as well," Wisniewski said.

Meanwhile, Ormandy said he will release free tools that he developed while researching the Sophos software. His main take on the product: It doesn't live up to its claims. "It's safe to say that Sophos' technology is not really equipped to deliver on the promise they made," Ormandy said.

For full technical details of Ormandy's research, download his report here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd