4 ms·

Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.

by tormeh 11y ago

zamalek 11y ago
> Many, many security patches are way late. My main point was: a virus that uses a 0-day (or unpatched/unfixed 0-day) is likely going to cause problems for an AV: > AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability. Over-exaggerating to clarify: AVs are like bringing a knife to a gunfight. You might just be actually able to eliminate the weaker opponents (who also brought knives), but you're going nowhere against the veterans.
- dogma1138 11y ago
  It takes about 5min to refactor the code of existing malware to avoid detection, heck playing around with compiler settings is enough in many cases. I've recompiled Netcat probably 200 times by now, small refactoring playing with compiler flags (compile with x64 profile, debug on, add some symbols etc..) and every time it avoids every AV out there. I usually use Virustotal which means that it will be short lived but i can do it over and over and over again ;)
  - brobinson 11y ago
    There's actually tools to automatically do what you're talking about for malware: http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai (Japanese for "it can't be helped")
    - dogma1138 11y ago
      Encoders and compactors are not good actually they usually leave too many patterns that are easy to detect. The might work on some binaries in some cases but if you want to avoid evasion refactor the malware yourself. Encoders and compactors are intended to modify existing binaries only :)
      - brobinson 11y ago
        That's what I'm seeing people doing (modify existing binaries): https://www.google.com/#q=shikata+ga+nai+antivirus https://www.google.com/#q=shikata+ga+nai+antivirus Seems like it's pretty effective for bypassing AV according to how everyone is using it.
        dogma1138 11y ago
        Well if you actually read the search results you'll see :) 1st result 2012: "If you want to avoid detection, a 60% success rate is not good enough. Remember, our implant was caught by 40% of the products, not 40% of the targets. Assuming the better anti-virus products have a larger market share, our 40% product failure rate could look more like an 80 or 90% detection rate on target machines. - See more at: http://www.digitalthreat.net/2012/02/anti-virus-evasion-choosing-a-payload/#sthash.htXfsyBb.dpuf" http://www.digitalthreat.net/2012/02/anti-virus-evasion-choo... 4th result 2014: "There are a couple of built in encoders in Metasploit (shikata ga nai is the most popular one), but these signatures have been updated in many Antivirus solutions, resulting in detection." Every decent AV out there today has signatures of packers and encoders they are very easy to find since the artifacts of things like PE headers and binary cave of the encoded binaries will be identical every time you use them. Most people who claim it works are simply rehashing the same old metasploit guides that are not really relevant in the real world anything that is wide used will be singnatured in a second by every AV company. Yes if you encode it and upload it to VirusTotal even today you might get 50% or more evasion but those 50% of products will have maybe 5% of the market, and pretty much zero enterprise users.
        brobinson 11y ago
        Thanks for the detailed reply!
    - thefreeman 11y ago
      That encoder is less for bypassing AV and more for replacing characters which cannot be transmitted in the payload (eg. null bytes)
      - brobinson 11y ago
        That's not what I'm reading on Google. Everyone is using it to bypass AV: https://www.google.com/#q=shikata+ga+nai+antivirus https://www.google.com/#q=shikata+ga+nai+antivirus
  - tormeh 11y ago
    How does that work against AVs with heuristics?
    - dogma1138 11y ago
      Heuristics is something that AV companies tac on when they mean they don't update their DB too often ;P In general heuristics work very poorly for binary detection some of them might look for various patterns e.g. block the creation of registry entries from non-installer based malware (which is a large amount of false positives) or look for various interactions like hooking into certain applications or functions but in general I haven't seen a good heuristics engine as of yet. There are some very interesting machine learning tools but they detect large scale anomalies that could indicate a breach, there are also some machine learning binary analysis tools but they work on a different level and they perform something more akin to reverse engineering. Signature based detection has it's uses and that's to detect common crap that is here to say. If you look at current trends then 70-90* of malware is unique for each organization (the large gap is due to different verticals) most of that malware when detected won't receive a public signature their AV vendor will release it for that organization only and maybe distribute it among that vertical or to similar organizations. And while you might think well that's bull you don't really want all those signatures anyhow for the AV DB to be effective it needs to be fast so vendors have to limit the amount of signatures they carry, to do that they also tend to remove malware which all of it's exploit have been patched or outdated malware which is no longer relevant (e.g. very small amount of infections). The signatures vary from time to time and if there will be an outbreak of old malware that has been removed the vendors will introduce those signatures again into the DB and they became quite good at predicting outbreaks of common malware. Now if AV's only detect 10-30% of stuff what detects the rest? Sandboxing doesn't really work, Windows isn't really built for that and to implement a security solution that actually provides true sandboxing for all applications is a nightmare, so you are left pretty much with detecting anomalies across the network. The malware it self is usually then discovered once a breach or an incident has been detected, the most common point of detection is when a breach is ongoing and you discover the egress, sometimes if you have really good monitoring across the board than your FIM(file integrity monitoring) or your user activity monitoring will start yelling very quickly. Now AV's still have their role they are quick and dirty an they usually work for most (home) users for stuff like thumb drives and simple mail attachment crap, and they are still one of the only tools that can provide real time on-excute/write binary detection most of the new heavy weights are based on detecting the malware post exploit. Some security solutions now claim to be "anti-exploit" the claim part is because their success rate varies they usually are much more focused for example will only protect browsers, office suits, and common PDF reader and what they do is a couple of things: 1 they know how an existing known exploit will look like when it's being triggered in the application and they will terminate it before the payload is executed (hopefully ;)), 2 they have the ability to detect various exploit oriented artifacts like ROP detection, 3 they do some behavior analysts as they usually only protect 10 or less applications they can application specific heuristics rather than attempt at creating general ones. Like AV's they usually excel at 1, 2 is tricky especially on 64bit applications because the virtual memory now is so large that it's hard (well impossible blindly) to look through it so ironically enough some "anti-exploits" apps actually require you to disable ASLR (a security feature randomized the memory address of an application across the entire/most of 64bit virtual address space to make it harder to exploit B/O's), and some of them are becoming quite good at 3. If you are an individual keeping basic opsec, using free AV for generic malware, and not running plugins like Java/Flash automatically should be good enough. If you are an organization then you need to have solutions in place across all tiers to actually detect malware, or at least it's activity since if you are infected you are most likely have been targeted so even if it's not a zero day it will be something unique for you.

Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.

by tormeh 11y ago

Many, many security patches are way late. AV software is nice when a vendor can't be bothered to update their software.

> Many, many security patches are way late. My main point was: a virus that uses a 0-day (or unpatched/unfixed 0-day) is likely going to cause problems for an AV: > AVs, typically, would struggle to catch an e.g. malicious BIOS flash resulting from an escalation vulnerability. Over-exaggerating to clarify: AVs are like bringing a knife to a gunfight. You might just be actually able to eliminate the weaker opponents (who also brought knives), but you're going nowhere against the veterans.

dogma1138 11y ago
It takes about 5min to refactor the code of existing malware to avoid detection, heck playing around with compiler settings is enough in many cases. I've recompiled Netcat probably 200 times by now, small refactoring playing with compiler flags (compile with x64 profile, debug on, add some symbols etc..) and every time it avoids every AV out there. I usually use Virustotal which means that it will be short lived but i can do it over and over and over again ;)
- brobinson 11y ago
  There's actually tools to automatically do what you're talking about for malware: http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai http://www.rapid7.com/db/modules/encoder/x86/shikata_ga_nai (Japanese for "it can't be helped")
  - dogma1138 11y ago
    Encoders and compactors are not good actually they usually leave too many patterns that are easy to detect. The might work on some binaries in some cases but if you want to avoid evasion refactor the malware yourself. Encoders and compactors are intended to modify existing binaries only :)
    - brobinson 11y ago
      That's what I'm seeing people doing (modify existing binaries): https://www.google.com/#q=shikata+ga+nai+antivirus https://www.google.com/#q=shikata+ga+nai+antivirus Seems like it's pretty effective for bypassing AV according to how everyone is using it.
      - dogma1138 11y ago
        Well if you actually read the search results you'll see :) 1st result 2012: "If you want to avoid detection, a 60% success rate is not good enough. Remember, our implant was caught by 40% of the products, not 40% of the targets. Assuming the better anti-virus products have a larger market share, our 40% product failure rate could look more like an 80 or 90% detection rate on target machines. - See more at: http://www.digitalthreat.net/2012/02/anti-virus-evasion-choosing-a-payload/#sthash.htXfsyBb.dpuf" http://www.digitalthreat.net/2012/02/anti-virus-evasion-choo... 4th result 2014: "There are a couple of built in encoders in Metasploit (shikata ga nai is the most popular one), but these signatures have been updated in many Antivirus solutions, resulting in detection." Every decent AV out there today has signatures of packers and encoders they are very easy to find since the artifacts of things like PE headers and binary cave of the encoded binaries will be identical every time you use them. Most people who claim it works are simply rehashing the same old metasploit guides that are not really relevant in the real world anything that is wide used will be singnatured in a second by every AV company. Yes if you encode it and upload it to VirusTotal even today you might get 50% or more evasion but those 50% of products will have maybe 5% of the market, and pretty much zero enterprise users.
        brobinson 11y ago
        Thanks for the detailed reply!
  - thefreeman 11y ago
    That encoder is less for bypassing AV and more for replacing characters which cannot be transmitted in the payload (eg. null bytes)
    - brobinson 11y ago
      That's not what I'm reading on Google. Everyone is using it to bypass AV: https://www.google.com/#q=shikata+ga+nai+antivirus https://www.google.com/#q=shikata+ga+nai+antivirus
- tormeh 11y ago
  How does that work against AVs with heuristics?
  - dogma1138 11y ago
    Heuristics is something that AV companies tac on when they mean they don't update their DB too often ;P In general heuristics work very poorly for binary detection some of them might look for various patterns e.g. block the creation of registry entries from non-installer based malware (which is a large amount of false positives) or look for various interactions like hooking into certain applications or functions but in general I haven't seen a good heuristics engine as of yet. There are some very interesting machine learning tools but they detect large scale anomalies that could indicate a breach, there are also some machine learning binary analysis tools but they work on a different level and they perform something more akin to reverse engineering. Signature based detection has it's uses and that's to detect common crap that is here to say. If you look at current trends then 70-90* of malware is unique for each organization (the large gap is due to different verticals) most of that malware when detected won't receive a public signature their AV vendor will release it for that organization only and maybe distribute it among that vertical or to similar organizations. And while you might think well that's bull you don't really want all those signatures anyhow for the AV DB to be effective it needs to be fast so vendors have to limit the amount of signatures they carry, to do that they also tend to remove malware which all of it's exploit have been patched or outdated malware which is no longer relevant (e.g. very small amount of infections). The signatures vary from time to time and if there will be an outbreak of old malware that has been removed the vendors will introduce those signatures again into the DB and they became quite good at predicting outbreaks of common malware. Now if AV's only detect 10-30% of stuff what detects the rest? Sandboxing doesn't really work, Windows isn't really built for that and to implement a security solution that actually provides true sandboxing for all applications is a nightmare, so you are left pretty much with detecting anomalies across the network. The malware it self is usually then discovered once a breach or an incident has been detected, the most common point of detection is when a breach is ongoing and you discover the egress, sometimes if you have really good monitoring across the board than your FIM(file integrity monitoring) or your user activity monitoring will start yelling very quickly. Now AV's still have their role they are quick and dirty an they usually work for most (home) users for stuff like thumb drives and simple mail attachment crap, and they are still one of the only tools that can provide real time on-excute/write binary detection most of the new heavy weights are based on detecting the malware post exploit. Some security solutions now claim to be "anti-exploit" the claim part is because their success rate varies they usually are much more focused for example will only protect browsers, office suits, and common PDF reader and what they do is a couple of things: 1 they know how an existing known exploit will look like when it's being triggered in the application and they will terminate it before the payload is executed (hopefully ;)), 2 they have the ability to detect various exploit oriented artifacts like ROP detection, 3 they do some behavior analysts as they usually only protect 10 or less applications they can application specific heuristics rather than attempt at creating general ones. Like AV's they usually excel at 1, 2 is tricky especially on 64bit applications because the virtual memory now is so large that it's hard (well impossible blindly) to look through it so ironically enough some "anti-exploits" apps actually require you to disable ASLR (a security feature randomized the memory address of an application across the entire/most of 64bit virtual address space to make it harder to exploit B/O's), and some of them are becoming quite good at 3. If you are an individual keeping basic opsec, using free AV for generic malware, and not running plugins like Java/Flash automatically should be good enough. If you are an organization then you need to have solutions in place across all tiers to actually detect malware, or at least it's activity since if you are infected you are most likely have been targeted so even if it's not a zero day it will be something unique for you.