12 ms·
Exploitable vulnerabilities found in Kaspersky Anti-Virus
- MisterWebz 11y agoThey've been gunning for Kaspersky ever since Kaspersky released information about state-sponsored malware.
- happyscrappy 11y agoHow exactly are they able to introduce exploits into his code?
- MisterWebz 11y agoInto whose code? He found several bugs and is now writing about it. I'm not sure if I understand your question?
- hellbanner 11y agoSuggesting that Google's allies want to keep the word on state-sponsored malware at a minimum?
- taviso 11y agoMaking their software safer, that'll learn 'em.
- drzaiusapelord 11y agoWho is "they?" Tavis Ormandy is a respected security researcher who often makes the news. Hell, not too long ago he found exploits in Sophos and Symantec products. He likes to target AV. Sophos, a UK product, was embarrassed internationally by the exploits he found. He is not playing any favors here. We need more people like him. AV has gotten a free pass for far too long. If you're attacking Ormandy's character, I'd appreciate some proof over the usual conspirtard stuff that often gets upvoted uncritically on sites like reddit and HN. As far as I can tell, he is certainly one of the good guys and we are lucky to have him in such a high profile position at Google. >Kaspersky released information about state-sponsored malware. Kaspersky acutally is the dirtiest of the bunch with ties to Russian KGB/FSB. I suggest you rethink who your heroes are. http://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies http://www.bloomberg.com/news/articles/2015-03-19/cybersecur... http://www.wired.com/2012/07/ff_kaspersky/ http://www.wired.com/2012/07/ff_kaspersky/
- strictnein 11y agoKaspersky is smart. He enjoys breathing and wants to avoid radioactive tea.
- btilly 11y agoI'm guessing most people will miss the reference to https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine... so I'll just add a link.
- drzaiusapelord 11y agoThis is my concern with any software from an obviously corrupt and autocratic state that attacks its citizens with impunity. How can I trust anyone there when they certainly, and rightfully, value their lives over my rights? No Russian is going to say no to the FSB torture machine. No one is going to become any sort of whistleblower. I would see any Russian software as being dangerous to run at this point and things only getting worse considering Putin's brazen anti-West attitude. Maybe Kaspersky was safe to run once, but that's just not true anymore.
- oblio 11y agoPlus, if I'm not confusing him, Tavis used to make some kick ass FVWM configurations. The kind of window manager stuff that you see in SF movie computers. A really cool dude.
- strictnein 11y agoYou're insinuating that Google is gunning for Kaspersky at the bidding of their NSA masters (or something)? How deep does the rabbit hole go?
- MisterWebz 11y agoI'm suggesting a higher-up or someone else suggested Tavis target Kaspersky. I'm not suggesting Google execs all sat together and decided to destroy Kaspersky. Is it that hard to believe that there are certain people that would like to dissuade Kaspersky from revealing further information about state-sponsored malware? I'm not even sure where this incredulity is coming from? Let's see you target an intelligence agency and see what happens.
- RyanZAG 11y agoAre you trying to imply Kaspersky are somehow a victim...? Installing their security product actively decreases your security in this case. That destroys their entire reason for even existing. Kaspersky is no victim here. They've been so negligent in their own product's security that it is actively harmful to have it installed. That's literally the end of their product being useful for me and it applies to any other security company as well. I hope the rest of them get 'suggested' too, and soon! I'll be clear - this vulnerability is the one thing Kaspersky should have been spending their engineering resources on and they have failed utterly. Pack it up and close shop.
- Drdrdrq 11y agoI would say Kaspersky should thank their lucky star Google has sponsored such research. This is priceless info.
- lawnchair_larry 11y agoClearly you could not be less familiar with Tavis :)
- kardos 11y agoIt's rabbits all the way down!
- alblue 11y agoBear in mind that they conclude the article with a complement to how quickly the issues were resolved and that the next one is due soon.
- tmd83 11y agoThat doesn't make sense given that they have already broken two other antivirus in a similar fashion and they commented Thanks to Kaspersky for record breaking response times when handling this report, they’ve set a high bar to beat for other vendors! I wonder how fast they were given the comment about 'high bar'.
- drzaiusapelord 11y agoKaspersky is aligned with Putin's FSB: http://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies http://www.bloomberg.com/news/articles/2015-03-19/cybersecur... http://www.wired.com/2012/07/ff_kaspersky/ http://www.wired.com/2012/07/ff_kaspersky/ You'd be a little crazy to run this outside of Russia. I suspect there are more backdoors disguised as "vulnerabilities we knew nothing about, totally, its news to us!" This reads like a trivial overflow which would have been found with some basic testing. This is a common ploy with untrustworthy software. Maybe Kaspersky was safe to run once, but with Russia's new brazen anti-West attitude, its a liability now.
- dubcanada 11y agoWell obviously anti-Russia type arguments make sense, as it is a Russian product. But most of these "popular anti-virus" programs are riddled with issues. This is not just a Kaspersky thing, Norton has it's own set of issues, and so does McAFee. And I'm sure the others are not bullet proof.
- eli 11y agoIndeed, most of all software is riddled with issues
- kbenson 11y agoYes, but we should hold programs purporting to increase security to a higher standard.
- jjuhl 11y agoNot most. All. All programs have bugs and most people can't write even a simple "hello world" program that doesn't contain bugs (in the program itself, the runtime or, underlying OS or even hardware firmware below it). Fact is: execute a program and there will be an exploitable bug somewhere. Fact of life. The system is fucked - royally!
- jgalt212 11y ago
- pakled_engineer 11y agoHow many other AV programs are extracting/manipulating files without a sandbox? I bet most of them, can probably directly port this method and get same results
- ploxiln 11y agoThe blog post links to previous analysis of vulnerabilities in Sophos and ESET products. "Many of the vulnerabilities described in this paper could have been severely limited by correct security design, employing modern isolation and exploit mitigation techniques. However, Sophos either disables or opts-out of most major mitigation technologies, even disabling them for other software on the host system." "Unfortunately, analysis of ESET emulation reveals that is not the case and it can be trivially compromised. This report discusses the development of a remote root exploit for an ESET vulnerability and demonstrates how attackers could compromise ESET users." So, yes, definitely.
- nerdy 11y agoI wonder if this is at all related to the targeted attack Kaspersky suffered a few months back? http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back http://www.kaspersky.com/about/news/virus/2015/Duqu-is-back Maybe someone was exploring the possibility that these vulnerabilities are features.
- MichaelGG 11y agoSo it's 2015 and they ship software with a trivial stack buffer overflow. They don't even bother to turn on the "mitigation" options in the compiler (not that it makes such mitigations less of a terrible set of hacks). Sounds fairly incompetent. Also further validates the intelligence in creating things like Rust.
- pjmlp 11y ago> Also further validates the intelligence in creating things like Rust. Yeah, but many of the Rust features are present in the branch of Algol derived languages, namely Mesa, Modula-2, Modula-3, Oberon derivatives, Ada, Pascal dialects.... Yet it was required decades of security exploits for developers start grasping the major flaw it was to adopt C.
- pcwalton 11y ago> Yeah, but many of the Rust features are present in the branch of Algol derived languages, namely Mesa, Modula-2, Modula-3, Oberon derivatives, Ada, Pascal dialects.... None of these have memory safety without GC (while supporting dynamic allocation and deallocation).
- pjmlp 11y agoYou are doing a great job with Rust, but I think you always jump to quickly to criticize Wirth languages and push for Rust. Mesa => RC with local GC for collecting cycles. Modula-2 => True, does manually memory management, but avoids all other C memory corruption errors. Modula-3 => Uses GC only for types allocated via NEW. Library contains generic RC pointers. Untraced pointers can only be used in unsafe code. Oberon derivates => Uses GC only for types allocated via NEW. Active Oberon added support for untraced pointers only in unsafe code. Ada => No GC. All memory allocation is controlled. Deallocation is only possible via regions or explicitly in unsafe code. There are generic RC libraries as well. Pascal dialects => No GC. Suffer from manual memory management, but none of the other typical exploits regarding out of bounds or pointer misuse. Yes, they may lack affine types, but had they succeed in the industry instead of C, the need of something like Rust would be greatly reduced. As such now we have to place our hopes in something like Rust, because the new generations never heard of those languages and think C was the very first systems programming language. However every time I look at Rust sample code I would like to see the same amount of _unsafe_ being used like in the those languages. Instead, many Rust users seem to sprinkle it everywhere.
- gtirloni 11y agoWhat's the incentive for Google in doing this?
- wolf550e 11y agoMaybe Google could only hire people of this caliber if they let them spend some of their time doing work they will be able to talk about, besides the work on securing Google's internals which must remain secret.
- mey 11y agohttp://googleprojectzero.blogspot.com/2014/07/announcing-project-zero.html http://googleprojectzero.blogspot.com/2014/07/announcing-pro... Google's goals are so grand they see things like securing software and getting faster broadband everywhere as things worth doing. I've been reading their blog since launch and the team is very skilled, professional and interested in proving theory with actual exploits.
- wmt 11y agoThey fight back exploit peddlers like Zerodium or criminals who sell their findings to the highest bidder. You know, PR. They're basically do a huge service to their users and software companies by allowing the best exploit finders to focus on some software and then responsibly disclose their findings to the vendors, free of charge. http://googleonlinesecurity.blogspot.de/2014/07/announcing-project-zero.html http://googleonlinesecurity.blogspot.de/2014/07/announcing-p... The headline is kinda silly in the sense that if Project Zero focuses on any software in the world, they'll most likely find exploitable vulnerabilities. With Kaspersky the ridiculous thing is that they have stuff compiled without /GS, which e.g. since VS2005 has required you to actively disable it, as it's on by default.
- fixermark 11y agoIt's slightly more than PR... Google sees the trustworthiness of people's interactions online as an existential necessity for the company. Things like tradeable zero-day exploits are a risk to the entire business model of having people search for things and conduct business on the Internet.
- deleted 11y ago[deleted]
- SNvD7vEJ 11y agoSo the Russian regime "infiltrated" (ordered) one of the most well known Russian software companies, a famous security company nonetheless, to craft a few back doors in one of the worlds most trusted security products. Just another conspiracy theory, of course...
- alvarosm 11y ago99% of conspiracy theories are false, unrealistic. Reality is worse then the average Joe's wildest dreams. The backdoors are probably there, they're just not the obvious exploits that exist out of incompetence and neglect and are being exposed first.
- plaguuuuuu 11y agoand 70% of statistics are made up...
- Roadgazer 11y agoThe issues which are observed are the logical subsequence of becoming the big company with talent of different qualification level : tons of code, junior engs, lack of control.Google writes report on that, but bunch of Google code itself is far from being ideal, despite of strict talent sort out and interview.
- tmd83 11y agoWhat I'm not hearing is that what that really means. It's not just the buffer overflow thing. It seems that most of these tools (he exploited 3 so far) are disabling protection feature in the OS and are just blind to the risk parsing generally presents and specially for a tool that runs with such privilege. I wonder if he has failed to exploit any of the antivirus that he tried or it was 3 for 3. What does it really mean, does using any antivirus at this point puts you at even more risk to targeted attack specially if you are a sensible user? What does that mean for corporate roll out of antivirus which I'm guessing would be the most likely candidate of such targeted attacks.