Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/28/2016
01:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Multiple Major Security Products Open To Big Vulns Via 'Hooking Engines'

Black Hat USA talk will show how flawed implementation of hooking techniques are putting security and other software at risk.

The momentum's been growing the last few years for the security community to turn its microscope inward as security researchers start to dig in earnest for serious vulnerabilities within security products. That'll be reflected in several talks at Black Hat USA in Las Vegas next week -- including research from enSilo that takes a thorough look at six different common security issues stemming from faulty implementation of code hooking and injections techniques.

Spread across 15 different products--many of them antivirus and security platforms--the discoveries resonate due to the fact that many security products and other applications use the same vulnerable hooking engines, making for a much broader attack surface area than if these hooking functions were developed on a one-off basis.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Used by a range of products that depend on virtualization, sandboxing, performance management, or otherwise changing the behavior of operating system functions, hooking is an especially important technique for security products that depend on it to monitor for malicious activity on systems.

According to Udi Yavo and Tomer Bitton, co-founders enSilo, when they began the work that eventually blossomed into what would become their talk scheduled for next week, "Captain Hook: Pirating AVs to Bypass Exploit Mitigations," they initially thought they'd only found an isolated flaw in the anti-malware hooking engine of a single security product. But the scope of the problems grew as the pair found that many security platforms and other software are prone to serious vulnerabilities in the way their hooking engines interact with underlying system processes.

"Overall, hooking and injections are an important part of security products, because they have to monitor what’s happening in the system to operate,” Yavo says. “However, they must realize that doing such intrusive operations has implications that affect security. Ironically, the fact that they are in the system and vulnerable bypasses the security controls of the underlying operating system."

Not Just Security Software

Vulnerabilities in hooking engines also go beyond security products, the researchers say. As part of their presentation, they'll also discuss issues in the Microsoft Detours hooking engine, which is due out for a patch in August. However, it was the security product implications that really resonated with the duo; issues in these types of products are particularly insidious because security practitioners tend to view them as inviolate.

For example, if a security product were to report an attack through a vulnerable security product, most security teams would likely mark it as a false positive and move on, Yavo says. Security products are generally trusted, and the overwhelming number of alerts would probably cause most organizations to overlook such a warning, he warns.

Yavo and Britton found a number of exploits that would be effective against some of the security products they examined. Affected vendors included AVG, Kaspersky, McAfee, Symantec, Trend Micro, Bitdefender, Webroot, AVAST and Vera. For example, in one AV, they were able to show that an attacker could exploit improper hooking implementations to bypass ASLR in both 32-bit and 64-bit applications.

 "There was also another vendor which was maybe even a bit worse,” Yavo says. “If you combined all the issues that they had with the injections and the hooking, it allowed the attacker to gain persistency on the system because the injection method was not secure. An attacker could message their injection method to get injected into every process in the system, because the hooking engine was also flawed.”

The presentation is scheduled for Wednesday, August 3, but those interested in the presentation can get a technical teaser of some of the pair's findings in a blog they recently posted about their work.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30477
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
CVE-2021-30478
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the sa...
CVE-2021-30479
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
CVE-2021-30487
PUBLISHED: 2021-04-15
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
CVE-2020-36288
PUBLISHED: 2021-04-15
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused ...