10 ms·

Bypassing Antivirus with Ten Lines of Code

184 points by svenfaw 11y ago

spydum 11y ago
Can do you one better.. bypass Sophos AV in a single byte.. https://www.youtube.com/watch?v=4xEzqISAmKI https://www.youtube.com/watch?v=4xEzqISAmKI
martinald 11y ago
Laughable. Ages ago I realised you could just take an exploit, base64 the contents of the binary code, save it in a string. You could then unbase64 it and execute the binary in memory. Nothing seemed to catch it.
- mschuster91 11y ago
  You'd still need a decoding stub which can be fingerprinted. An XOR "decoder" is far smaller in shellcode and can be custom written in asm to reduce time-to-first-signature.
  - chris_va 11y ago
    You could just pepper the b64 with jmp statements and randomly intersperse your decoder code.
mettamage 11y ago
Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.
- devit 11y ago
  No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.
  - catnaroek 11y ago
    > It's impossible to determine whether software is malicious or not (Rice's theorem). Which is why proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code https://en.wikipedia.org/wiki/Proof-carrying_code] is a good idea: the onus ought to be on the programmer to provide (machine-checkable) evidence that their program is safe to use, for whatever notion of “safe” might make sense in your system.
    - nickpsecurity 11y ago
      That's still in its infancy. Future results might counter what we figured out. The certified compilers are nice for subversion-resistant development but not running untrustworthy code. There's significant difference between their models and the software/hardware combo actually running. Better route was started in Burrough's where you pick a language good at correct programs and carefully design a safe machine around it. Same with System/38, SAFE (crash-safe.org) for functional, and Cambrige's CHERI for C language. The fundamentals work as advertised along with ability to enforce arbitrary security policies. Then design and security stuff are built on that. Only thing known to work consistently to any degree of success. On COTS hardware, separation kernels and compiler transforms on legacy code are about best that we can do.
  - V-2 11y ago
    That's not true - there's heurystic analysis techniques, generic signature detection etc. Of course they may not meet your definition of "reliably"
    - aleeds 11y ago
      I think that when it comes to this, each individual gets to define what reliably is, and nothing else matters.
- wolfgke 11y ago
  > Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.
  - hayao 11y ago
    In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.
    - dublinben 11y ago
      Don't run Windows, and don't run Javascript.
    - moonshinefe 11y ago
      Use an ad blocker (uBlock origin), keep your OS/Browser up to date. If you really want to get paranoid you can use NoScript or something like that (but you'll give up some convenience). The main thing is to make sure you trust the things you're clicking on. If you have to visit websites or try programs you don't trust, some people have virtual machines specifically for those situations. They'll visit the site/open the program inside the VM, and if something sketchy does happen, it'll be contained within the VM and not infect the host OS (unless it's incredibly sophisticated malware that can break out of VMs--but very unlikely you'd be targeted by something like that).
    - kbenson 11y ago
      Well, if you really want to sandbox some internet behavior (for example, porn, which I imagine has the highest percentage of sites delivering a malicious payload), use a virtual machine manager (VirtualBox) and set up a virtual machine (some Linux variant may serve best) for that specific type of access. You can do this multiple times, once for each type of access, such as a dedicated VM for accessing your bank website. If you're really paranoid, you can save the state of the virtual machine before use, and restore the prior state every time you use, it, preventing any changes to the VM. You would occasionally want to start it up, install all the recommended updates, and then save the state again though.
- ryao 11y ago
  Antivirus software is as useful for security as monster HDMI cables are useful for improving digital picture quality, so this is not surprising. The only thing that antivirus software does semi-decently is identify known software binaries. Antivirus software cannot reliably identify unknown binaries through heuristics because writing software to understand unknown software binaries is impossible in general. There are potentially an infinite number of ways of proving that, but the easiest way that occurs to me is that one of the many things necessary for understanding unknown software in general is solving the halting problem, which was proven to be impossible in general by Alan Turing. Furthermore, the utility for a database of known malicious binaries is practically non-existent. Malicious software is always designed to exploit some vulnerability and once the vulnerability is fixed by the vendor, there is nothing for the antivirus software to do. If you could apply the definition update that the antivirus software needed to catch malicious software, you could have applied the vendor patch that fixed the vulnerability the malicious software used in the first place. That not only makes the definition update unnecessary, but handles the unknown things that the definition update would never have caught. In the cases of a vendor being slow to patch, refusing to patch (e.g. the exploits used by the hot potato proof of concept code for all current Windows versions) or the user not applying the patch in time (e.g. lack of scheduled downtime), the inability of antivirus software to catch unknown software using those vulnerabilities provides a false sense of security. If a system is specifically targeted by a malicious hacker, the hacker would use something that antivirus software would not catch, such as a script kiddie tool against which there are no known definitions or custom code. Being unfortunate enough to be attacked by a virus, trojan, etcetera before they get definitions also means there is no protection. Real security requires doing things like minimizing attack area and configuring things competently (e.g. not using your username as your password). That is something that you cannot get from an antivirus vendor.
fao_ 11y ago
It's initially worrying, but it makes a certain amount of sense when you think that an antivirus is a blacklist (of known vulnerabilities), not a whitelist. Somewhat related: http://security.stackexchange.com/a/117312 http://security.stackexchange.com/a/117312
magoon 11y ago
It'll work until a virus scanner company distributes a virus definition file containing a signature of your offending code.
- Igglyboo 11y ago
  And then you change the code a tiny bit and the signature doesn't catch it anymore.
  - quotemstr 11y ago
    > change the code a tiny bit How? That's the principle that everyone's missing! Sure, you can change the code a bit, but the millions of copies of your worm out there already can't magically change themselves after AV vendors update their blacklist. Sure, you can make a polymorphic worm, but even after mutation, your worm still probably has common patterns that blacklist makers can catch. I'm a fan of proactive, not reactive security --- but let's not pretend that what AV vendors are doing is completely bogus. You also have to keep in mind that blacklists are behavior heuristics are more suited to a bygone age --- one of low-bandwidth, sporadic connections and floppy disks that could be infected with trojans. Nowadays, we're more worried about drive-by 0day flash exploits from ad networks than about infected, self-propagating executables. I've always found it fascinating that the human immune system has both proactive and reactive security, just like our computers should. The innate immune system [1] is analogous to mandatory access control, OS file permissions, buffer hardening, and other non-specific security mechanisms. The adaptive immune system, on the other hand, works like a blacklist updated throughout your life (and propagated from mother to child!). Both systems catch threats the other does not. There's still a lot to learn from biology. [1] https://en.wikipedia.org/wiki/Innate_immune_system https://en.wikipedia.org/wiki/Innate_immune_system [2] https://en.wikipedia.org/wiki/Adaptive_immune_system https://en.wikipedia.org/wiki/Adaptive_immune_system
  - Retr0spectrum 11y ago
    And then you make it metamorphic.
anc84 11y ago
Read https://www.virustotal.com/en/faq/#statistics https://www.virustotal.com/en/faq/#statistics
bitwize 11y ago
You're not secure until you whitelist. And even that's not a guarantee; it's a necessary but sufficient condition. But systems which do not run signed, whitelisted code from boot time forward are as good as pwnt.
- catnaroek 11y ago
  > You're not secure until you whitelist. No, a whitelist isn't good enough. You can't anticipate an exhaustive list of the programs the user will want to run. What you can do, however, is enforce a policy by which programs are required to provide machine-checkable evidence, also known as proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code https://en.wikipedia.org/wiki/Proof-carrying_code], that they respect the system's safety policy. > it's a necessary but sufficient condition Perhaps you mean “not sufficient”?
  - deleted 11y ago
    [deleted]
  - bitwize 11y ago
    Yes, that's what I meant -- not sufficient. Whitelisting seems to be working out well for Apple. It's a big part of why they're the most secure smartphone platform.
001spartan 11y ago
Yes, this shows that antivirus is trivial to bypass. However, antivirus is not the last word in endpoint protection. While this method can be used to get otherwise ordinary payloads past antivirus, behavior-based detection and application whitelisting can be used to prevent many of these attacks.
- ryao 11y ago
  Proper security hygiene can prevent most attacks, not better antivirus software. Proper security hygiene means: * applying security updates * enforcing least privilege * reducing attack surface (e.g. Does your desktop really need open ports?) * using decent passwords and two factor authentication when possible * not reusing passwords in case a place where you used a password is compromised * not executing code from untrusted sources * checking whether code from a trusted source is vulnerable to a MITM attack before executing it * saying no to prompts for elevated privileges unless you can prove to yourself that there is a good reason for them and finding out what caused a prompt for elevated privileges when you see no legitimate reason for it * wiping a system should you think it might have been compromised and maybe also discarding the hardware just in case firmware was altered, which is what the US government tells US CEOs to do with things that they bring to China * not providing confidential information (e.g. your password) just because someone claiming to be a trusted party such as IT called asking for it That last one is how the NSA red team hacked the Pentagon's Joint Staff intelligence directorate when doing penetration testing as part of a "war game" in 1997: http://www.slate.com/articles/technology/future_tense/2016/03/inside_the_nsa_s_shockingly_successful_simulated_hack_of_the_u_s_military.html http://www.slate.com/articles/technology/future_tense/2016/0... That said, there are likely more when thinking about confidentiality (the other half of security), but these are the ones that occur to me when I think about ensuring system integrity. Anyway, antivirus does not save you if you fail to do any of those things. Anything that could get by all of that would be a zero-day attack where antivirus software is likely to be similarly useless. Not all zero-day attacks can get past all of that (minimal attack surface is awesome). If you are the principle target (like the Pentagon was for the NSA red team), antivirus software has no chance of saving you against a zero-day attack.
feelix 11y ago
I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it. That was back at around OS X 10.4 now. I've been waiting for another company to come along with something similar - since it really does seem a comprehensive way of blocking viruses (albeit more suited to more advance uses). I'm still waiting for something like that.
- ams6110 11y ago
  Neat, but most people will just click "yes." See Windows Vista.
  - noinsight 11y ago
    That's what happens when the answer is "yes" 99.9999% of the time. Have you ever seen a case where "no" is appropriate?
  - eru 11y ago
    That's why we need reliable undo, not confirmation dialogues.
- gvb 11y ago
  That is an example of a mandatory access control (MAC) framework[1]. SELinux[1] is a MAC for linux systems and is very effective if the user doesn't disable it due to frustrations over false positives or due to true positives that are viewed by the user as false. OSX has discretionary access control, which can be configured to be a full MAC[3]. Starting in OS X v10.5, the kernel includes an implementation of the TrustedBSD Mandatory Access Control (MAC) framework. A formal requirements language suitable for third-party developer use was added in OS X v10.7. Mandatory access control, also known as sandboxing, is discussed in Sandboxing and the Mandatory Access Control Framework.[4] [1] https://en.wikipedia.org/wiki/Mandatory_access_control https://en.wikipedia.org/wiki/Mandatory_access_control [2] https://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttps://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttps:/... [3] http://sysdev.me/trusted-bsd-in-osx/ http://sysdev.me/trusted-bsd-in-osx/ [4] https://developer.apple.com/library/mac/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Permissions/Permissions.html https://developer.apple.com/library/mac/documentation/Securi...
K0nserv 11y ago
This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0] 0: http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf
- eru 11y ago
  I guess you could only fix this with a whitelist instead of a blacklist approach.
  - AnthonyMouse 11y ago
    A whitelist might not even work. In practice whitelists end up with everything in the world on them. It might not be that hard to find a whitelisted program that would let you do the thing in the article just by passing it the right arguments. Certainly anything with a buffer overflow in it would work and there are probably a hundred other ways to do it too.
    - daemin 11y ago
      Yep, one place where I used to work, the owning company's policy had "Linux" on its whitelist, but not "Wireshark". Even though the company was developing software which communicated over the network in various protocols.
  - ryao 11y ago
    Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with certificate revocation for anything bad that managed to be signed by a trusted certificate. That means you have both a whitelist (that is append only) and a blacklist (to fix mistakes in the append only whitelist).
cdevs 11y ago
We just need a better sandboxing environment and individual permissions per excitable i.e. "Can this excitable connect to blah blah up?" , "can this program read outside of its sandbox folder?" When you don't root your android or iPhone they handle it a lot better than desktop operating systems.
- eru 11y ago
  Only in the newer Android releases.
Uptrenda 11y ago
So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?
- sz4kerto 11y ago
  Without reading the article: it looks like it casts exec to a function pointer with void return type and no arguments, and calls it. (Disclaimer: I'm paid for writing Java :( )
- reginaldo 11y ago
  Almost. It's casting exec to a pointer to a function that "returns" void and takes no arguments and then calling the function. Search for "C right-left rule" (without quotes) to see some hints on how to read complex declarations (mostly applies to casting too). I like http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html
- frede 11y ago
  It's actually a cast to a function pointer with signature: void exec(). The trailing brackets () then make the program call the function.
- kondbg 11y ago
  This is a common way of executing shellcode in a PoC. Exec (before the cast) points to memory containing the shellcode data. To actually start executing the shellcode, you just need to somehow cause the program counter to point to the address of the shellcode. An easy way to change the program counter is by calling a function ... which is what this line does. Read this as "cast exec to a pointer to a function that takes zero arguments and returns void and call the function with no arguments." This is the same as: typedef void (*some_func)(); some_func func = (some_func)exec; func(); To familiarize yourself with C syntax regarding pointers, read about the "right-left rule" [1] [1] http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html
  - 11y ago
elcct 11y ago
Most Antivirus software makes your system work like it has a virus. Most of them will eventually let intruder in. Waste of money in my opinion.
cryowaffle 11y ago
How many times do you plan on posting this?
- gus_massa 11y ago
  This has been postested 3 times. From the FAQ: > Are reposts ok? > If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok. > Please don't delete and repost the same story, though. Accounts that do that eventually lose submission privileges. Looking at the public available data of the 3 submitters, they look like real independent user (not sockpuppets or something).
- jacquesm 11y ago
  That looks to have been posted from 3 different accounts, do you have reason to believe they are the same person?
CyberDildonics 11y ago
I've said it before but as hard as it might be to believe, I think smalltalk was 30 years ahead of its time when every program was packaged inside its own OS image. Anti-virus bypasses and even exploits are extremely common. My current line of thinking is that the best way to take control of your computer is to use virtualization to run many separate OS images for different sets of uses.
- feintruled 11y ago
  Interesting, but would have obvious drawbacks when it comes to addressing any OS vulnerabilities or improvements - suddenly you have to reinstall ALL your applications! This reminds me of Nintendo's approach to emulation for their Virtual Console, actually. Rather than having a standalone emulator that you download images for, they package the emulator with the game. This way they never have to worry about inadvertantly breaking anything with a future release, but on the other hand any subsequent emulator improvements do not retroactively apply.
  - CyberDildonics 11y ago
    I think you could save and fork OS images. At the same time I would think vulnerabilities wouldn't matter as much, but you are right that it adds complexity to managing a system.
Uptrenda 11y ago
So after the program is actually compiled into binary code do the resulting instructions become so simple (and so fundamental to the operation of programs) that any attempt to write a heuristics rule to stop this technique would break thousands of programs or are heuristics just so inherently shitty that this technique works? Because I would still think that this line here: void *exec = VirtualAlloc(0, sizeof c, MEM_COMMIT, PAGE_EXECUTE_READWRITE); Would be a red flag. I don't know how many programs use that on the Windows side of things but I have almost never seen programs call this function that weren't "crypters." I am honestly impressed how simple this program is (it's the most elegant crypter I've probably ever seen) but I am still wondering whether heuristics could be made to detect this (without also falsely detecting thousands of other programs?) What do you think OP? Not really my field but curious all the same.
- vortico 11y ago
  I believe this is how JIT compilation works. So this would trigger a false positive on the Java VM, Javascript V8 interpreter, Spidermonkey, and C# runtime.
  - yoklov 11y ago
    Also, most emulators of reasonably modern systems. Although JITs in VMs are a few orders of magnitude more common.
- simoncion 11y ago
  Why would that be a red flag? From what I can glean from the documentation, both MEM_COMMIT and PAGE_EXECUTE_READWRITE are perfectly reasonable flags to pass to VirtualAlloc, and -again, according to the documentation- VirtualAlloc appears to be a way to (de|re)allocate memory within the region allocated to your process. What's more, every program that uses Boost on Windows calls VirtualAlloc, in several places.
- tbirdz 11y ago
  VirtualAlloc is roughly equivalent in intent to POSIX's mmap. So anywhere that you'd use mmap in a Linux program, you'd probably use VirtualAlloc in Windows.
x5a 11y ago
I used to work at a large, well known AV company. While much of what other commenters have said is true, I will note that VT is less authoritative than some realize; the version of our product that VirusTotal was given access to was substantively different than our normal product; features such as sandboxing were removed. I wouldn't be surprised if this was a common practice; we considered our product's detection capabilities to be proprietary.
lqdc13 11y ago
A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated. If that obfuscator is not commonly used in goodware programs, it is marked as malware. This is kind of a dumb strategy on the part of AV engines, but it works okay. You're not going to catch new malware with static (or dynamic for that matter) analysis anyway. Thing is, the problem is ill-defined. What is malware? Is it a program that does something a user doesn't want? If users knew what regular programs do, they wouldn't be okay with most of it either. Is it a program that does some obfuscating tricks and exploits undocumented functionality in the system? Plenty of legit programs including a lot of AV engines do that as well. The only usable definition in my opinion is that it is a program that makes the user unhappy with no easily accessible way of removing it completely. This is why the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users).
- Razengan 11y ago
  > What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After that, automatic backups will let users revert any undesirable changes to their data, whether they were made by their own selves or by malware. I think operating systems should just do a better job of making the user more aware of all recently-modified files, especially if a process has been modifying a large number of them in a short time (the recent ransomware comes to mind) or if a third-party background process has been generating an uncanny amount of network traffic. Seeing something like "1,590 files modified" on log-on or in a notification, is way more alarming and would make users take immediate action, compared to all the usual OS or antivirus nags that we are all accustomed to subconsciously agreeing to.
Kenji 11y ago
AV is a little and often useless supplement to security, nothing more. It has always been trivially easy for a script kiddie to write malicious software that passes all of VirusTotal. In the decade I've been using AV, I had less true positives than false positives (yes please auto-delete my patches, hacktools and software I've written myself, idiot AV program) and of course some false negatives that wrecked me because I executed them. Since I stopped using AV and became more careful (e.g. use VM for suspicious files) I was never infected again.
awqrre 11y ago
It appears that not much have changed in the last ~20 years, when looking at mainstream antivirus software... I used to be able to move around a few assembly instructions inside a virus to avoid detection while still maintaining 100% of the virus' features
rmdoss 11y ago
That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ: At VirusTotal we are tired of repeating that the service was not designed as a tool to perform antivirus comparative analyses, but as a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. Those who use VirusTotal to perform antivirus comparative analyses should know that they are making many implicit errors in their methodology, the most obvious being: -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. -In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups. -Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration. thanks,
- JoachimSchipper 11y ago
  I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.
  - Natsu 11y ago
    It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.
    - JoachimSchipper 11y ago
      Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.
flyinghorse 11y ago
Try running the binary instead of just scanning it for signatures. It will be detected by the heuristics engines of most AVs. I'm not saying that AVs are good but articles like this that only focus on defeating signatures while leaving away heuristics (emulation, behavior detection, and even white listing to some extent) don't do the subject justice.
wepple 11y ago
lets not forget that this isn't actually all that practical in practice. It's not executing any old binary: the 'shellcode' has to be position-independent and can't rely on any normal PE features; it has to do all it's library loading on it's own etc. yes, very possible to create. but if your malware/tool you want to run is large, it will take a fair amount of time to convert.
feintruled 11y ago
I suppose the value in AV is that you are like one of the proverbial guys being chased by the lion - you don't need to outrun the lion, only the other guy. In this case, you just hope any malware hits enough other poor suckers first that your AV of choice is updated in time to save you.

184 points by svenfaw 11y ago

Can do you one better.. bypass Sophos AV in a single byte.. https://www.youtube.com/watch?v=4xEzqISAmKI https://www.youtube.com/watch?v=4xEzqISAmKI

martinald 11y ago

Laughable. Ages ago I realised you could just take an exploit, base64 the contents of the binary code, save it in a string. You could then unbase64 it and execute the binary in memory. Nothing seemed to catch it.

mschuster91 11y ago
You'd still need a decoding stub which can be fingerprinted. An XOR "decoder" is far smaller in shellcode and can be custom written in asm to reduce time-to-first-signature.
- chris_va 11y ago
  You could just pepper the b64 with jmp statements and randomly intersperse your decoder code.

mettamage 11y ago

Is this an oversight of the AV software companies? Did no one come up with this before? Could it be that if people did come up with this before that a lot of Windows computers have viruses without them knowing? Is their virus detection scheme fundamentally flawed? Should I be shocked? Shouldn't I be? I'm currently shocked but I don't know if it's justified, not an expert in the field.

devit 11y ago
No, this is not surprising at all. It's impossible to determine whether software is malicious or not (Rice's theorem). Antivirus software only reliably detects code that is identical to known malicious software.
- catnaroek 11y ago
  > It's impossible to determine whether software is malicious or not (Rice's theorem). Which is why proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code https://en.wikipedia.org/wiki/Proof-carrying_code] is a good idea: the onus ought to be on the programmer to provide (machine-checkable) evidence that their program is safe to use, for whatever notion of “safe” might make sense in your system.
  - nickpsecurity 11y ago
    That's still in its infancy. Future results might counter what we figured out. The certified compilers are nice for subversion-resistant development but not running untrustworthy code. There's significant difference between their models and the software/hardware combo actually running. Better route was started in Burrough's where you pick a language good at correct programs and carefully design a safe machine around it. Same with System/38, SAFE (crash-safe.org) for functional, and Cambrige's CHERI for C language. The fundamentals work as advertised along with ability to enforce arbitrary security policies. Then design and security stuff are built on that. Only thing known to work consistently to any degree of success. On COTS hardware, separation kernels and compiler transforms on legacy code are about best that we can do.
- V-2 11y ago
  That's not true - there's heurystic analysis techniques, generic signature detection etc. Of course they may not meet your definition of "reliably"
  - aleeds 11y ago
    I think that when it comes to this, each individual gets to define what reliably is, and nothing else matters.
wolfgke 11y ago
> Is this an oversight of the AV software companies? No, this is a principle limitation of any AV software that is based on blacklisting. > Did no one come up with this before? Of course other people came up with similar ideas before. > Should I be shocked? If and only if you had trust in your AV software before.
- hayao 11y ago
  In what ways can I protect my PC and my web browser? I sometimes access sensible things and I want proper security.
  - dublinben 11y ago
    Don't run Windows, and don't run Javascript.
  - moonshinefe 11y ago
    Use an ad blocker (uBlock origin), keep your OS/Browser up to date. If you really want to get paranoid you can use NoScript or something like that (but you'll give up some convenience). The main thing is to make sure you trust the things you're clicking on. If you have to visit websites or try programs you don't trust, some people have virtual machines specifically for those situations. They'll visit the site/open the program inside the VM, and if something sketchy does happen, it'll be contained within the VM and not infect the host OS (unless it's incredibly sophisticated malware that can break out of VMs--but very unlikely you'd be targeted by something like that).
  - kbenson 11y ago
    Well, if you really want to sandbox some internet behavior (for example, porn, which I imagine has the highest percentage of sites delivering a malicious payload), use a virtual machine manager (VirtualBox) and set up a virtual machine (some Linux variant may serve best) for that specific type of access. You can do this multiple times, once for each type of access, such as a dedicated VM for accessing your bank website. If you're really paranoid, you can save the state of the virtual machine before use, and restore the prior state every time you use, it, preventing any changes to the VM. You would occasionally want to start it up, install all the recommended updates, and then save the state again though.
ryao 11y ago
Antivirus software is as useful for security as monster HDMI cables are useful for improving digital picture quality, so this is not surprising. The only thing that antivirus software does semi-decently is identify known software binaries. Antivirus software cannot reliably identify unknown binaries through heuristics because writing software to understand unknown software binaries is impossible in general. There are potentially an infinite number of ways of proving that, but the easiest way that occurs to me is that one of the many things necessary for understanding unknown software in general is solving the halting problem, which was proven to be impossible in general by Alan Turing. Furthermore, the utility for a database of known malicious binaries is practically non-existent. Malicious software is always designed to exploit some vulnerability and once the vulnerability is fixed by the vendor, there is nothing for the antivirus software to do. If you could apply the definition update that the antivirus software needed to catch malicious software, you could have applied the vendor patch that fixed the vulnerability the malicious software used in the first place. That not only makes the definition update unnecessary, but handles the unknown things that the definition update would never have caught. In the cases of a vendor being slow to patch, refusing to patch (e.g. the exploits used by the hot potato proof of concept code for all current Windows versions) or the user not applying the patch in time (e.g. lack of scheduled downtime), the inability of antivirus software to catch unknown software using those vulnerabilities provides a false sense of security. If a system is specifically targeted by a malicious hacker, the hacker would use something that antivirus software would not catch, such as a script kiddie tool against which there are no known definitions or custom code. Being unfortunate enough to be attacked by a virus, trojan, etcetera before they get definitions also means there is no protection. Real security requires doing things like minimizing attack area and configuring things competently (e.g. not using your username as your password). That is something that you cannot get from an antivirus vendor.

fao_ 11y ago

It's initially worrying, but it makes a certain amount of sense when you think that an antivirus is a blacklist (of known vulnerabilities), not a whitelist. Somewhat related: http://security.stackexchange.com/a/117312 http://security.stackexchange.com/a/117312

magoon 11y ago

It'll work until a virus scanner company distributes a virus definition file containing a signature of your offending code.

Igglyboo 11y ago
And then you change the code a tiny bit and the signature doesn't catch it anymore.
- quotemstr 11y ago
  > change the code a tiny bit How? That's the principle that everyone's missing! Sure, you can change the code a bit, but the millions of copies of your worm out there already can't magically change themselves after AV vendors update their blacklist. Sure, you can make a polymorphic worm, but even after mutation, your worm still probably has common patterns that blacklist makers can catch. I'm a fan of proactive, not reactive security --- but let's not pretend that what AV vendors are doing is completely bogus. You also have to keep in mind that blacklists are behavior heuristics are more suited to a bygone age --- one of low-bandwidth, sporadic connections and floppy disks that could be infected with trojans. Nowadays, we're more worried about drive-by 0day flash exploits from ad networks than about infected, self-propagating executables. I've always found it fascinating that the human immune system has both proactive and reactive security, just like our computers should. The innate immune system [1] is analogous to mandatory access control, OS file permissions, buffer hardening, and other non-specific security mechanisms. The adaptive immune system, on the other hand, works like a blacklist updated throughout your life (and propagated from mother to child!). Both systems catch threats the other does not. There's still a lot to learn from biology. [1] https://en.wikipedia.org/wiki/Innate_immune_system https://en.wikipedia.org/wiki/Innate_immune_system [2] https://en.wikipedia.org/wiki/Adaptive_immune_system https://en.wikipedia.org/wiki/Adaptive_immune_system
- Retr0spectrum 11y ago
  And then you make it metamorphic.

anc84 11y ago

Read https://www.virustotal.com/en/faq/#statistics https://www.virustotal.com/en/faq/#statistics

bitwize 11y ago

You're not secure until you whitelist. And even that's not a guarantee; it's a necessary but sufficient condition. But systems which do not run signed, whitelisted code from boot time forward are as good as pwnt.

catnaroek 11y ago
> You're not secure until you whitelist. No, a whitelist isn't good enough. You can't anticipate an exhaustive list of the programs the user will want to run. What you can do, however, is enforce a policy by which programs are required to provide machine-checkable evidence, also known as proof-carrying code [https://en.wikipedia.org/wiki/Proof-carrying_code https://en.wikipedia.org/wiki/Proof-carrying_code], that they respect the system's safety policy. > it's a necessary but sufficient condition Perhaps you mean “not sufficient”?
- deleted 11y ago
  [deleted]
- bitwize 11y ago
  Yes, that's what I meant -- not sufficient. Whitelisting seems to be working out well for Apple. It's a big part of why they're the most secure smartphone platform.

001spartan 11y ago

Yes, this shows that antivirus is trivial to bypass. However, antivirus is not the last word in endpoint protection. While this method can be used to get otherwise ordinary payloads past antivirus, behavior-based detection and application whitelisting can be used to prevent many of these attacks.

ryao 11y ago
Proper security hygiene can prevent most attacks, not better antivirus software. Proper security hygiene means: * applying security updates * enforcing least privilege * reducing attack surface (e.g. Does your desktop really need open ports?) * using decent passwords and two factor authentication when possible * not reusing passwords in case a place where you used a password is compromised * not executing code from untrusted sources * checking whether code from a trusted source is vulnerable to a MITM attack before executing it * saying no to prompts for elevated privileges unless you can prove to yourself that there is a good reason for them and finding out what caused a prompt for elevated privileges when you see no legitimate reason for it * wiping a system should you think it might have been compromised and maybe also discarding the hardware just in case firmware was altered, which is what the US government tells US CEOs to do with things that they bring to China * not providing confidential information (e.g. your password) just because someone claiming to be a trusted party such as IT called asking for it That last one is how the NSA red team hacked the Pentagon's Joint Staff intelligence directorate when doing penetration testing as part of a "war game" in 1997: http://www.slate.com/articles/technology/future_tense/2016/03/inside_the_nsa_s_shockingly_successful_simulated_hack_of_the_u_s_military.html http://www.slate.com/articles/technology/future_tense/2016/0... That said, there are likely more when thinking about confidentiality (the other half of security), but these are the ones that occur to me when I think about ensuring system integrity. Anyway, antivirus does not save you if you fail to do any of those things. Anything that could get by all of that would be a zero-day attack where antivirus software is likely to be similarly useless. Not all zero-day attacks can get past all of that (minimal attack surface is awesome). If you are the principle target (like the Pentagon was for the NSA red team), antivirus software has no chance of saving you against a zero-day attack.

feelix 11y ago

I once wrote a kernel extension that intercepted any and all file open()'s on OS X. If the application in question was opening a file that it was not whitelisted to do so, it would bring up a modal dialog box asking whether or not this application should be allowed to open this file. It was basically a firewall on the kernel level. It worked splendidly, however, I was never able to gain any traction in marketing it. That was back at around OS X 10.4 now. I've been waiting for another company to come along with something similar - since it really does seem a comprehensive way of blocking viruses (albeit more suited to more advance uses). I'm still waiting for something like that.

ams6110 11y ago
Neat, but most people will just click "yes." See Windows Vista.
- noinsight 11y ago
  That's what happens when the answer is "yes" 99.9999% of the time. Have you ever seen a case where "no" is appropriate?
- eru 11y ago
  That's why we need reliable undo, not confirmation dialogues.
gvb 11y ago
That is an example of a mandatory access control (MAC) framework[1]. SELinux[1] is a MAC for linux systems and is very effective if the user doesn't disable it due to frustrations over false positives or due to true positives that are viewed by the user as false. OSX has discretionary access control, which can be configured to be a full MAC[3]. Starting in OS X v10.5, the kernel includes an implementation of the TrustedBSD Mandatory Access Control (MAC) framework. A formal requirements language suitable for third-party developer use was added in OS X v10.7. Mandatory access control, also known as sandboxing, is discussed in Sandboxing and the Mandatory Access Control Framework.[4] [1] https://en.wikipedia.org/wiki/Mandatory_access_control https://en.wikipedia.org/wiki/Mandatory_access_control [2] https://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttps://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linuxhttps:/... [3] http://sysdev.me/trusted-bsd-in-osx/ http://sysdev.me/trusted-bsd-in-osx/ [4] https://developer.apple.com/library/mac/documentation/Security/Conceptual/AuthenticationAndAuthorizationGuide/Permissions/Permissions.html https://developer.apple.com/library/mac/documentation/Securi...

K0nserv 11y ago

This is interesting for signature based AVs. More interestingly bypassing dynamic AV engines that execute code in a sandbox seems to be fairly trivial as well. For example allocating 100mb or memory, running a few million iterations in a loop during startup will cause most av engines to stop executing the code due to resource constraints. This paper is a really interesting read on the topic[0] 0: http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf

eru 11y ago
I guess you could only fix this with a whitelist instead of a blacklist approach.
- AnthonyMouse 11y ago
  A whitelist might not even work. In practice whitelists end up with everything in the world on them. It might not be that hard to find a whitelisted program that would let you do the thing in the article just by passing it the right arguments. Certainly anything with a buffer overflow in it would work and there are probably a hundred other ways to do it too.
  - daemin 11y ago
    Yep, one place where I used to work, the owning company's policy had "Linux" on its whitelist, but not "Wireshark". Even though the company was developing software which communicated over the network in various protocols.
- ryao 11y ago
  Antivirus software is by definition a black list approach. A white list approach means code signing. iOS does that. It works fairly well in conjunction with certificate revocation for anything bad that managed to be signed by a trusted certificate. That means you have both a whitelist (that is append only) and a blacklist (to fix mistakes in the append only whitelist).

cdevs 11y ago

We just need a better sandboxing environment and individual permissions per excitable i.e. "Can this excitable connect to blah blah up?" , "can this program read outside of its sandbox folder?" When you don't root your android or iPhone they handle it a lot better than desktop operating systems.

eru 11y ago
Only in the newer Android releases.

Uptrenda 11y ago

So what's this line all about: ((void(*)())exec)(); Type cast a void pointer to a void pointer, execute the result, then execute the result of that? Or ... Can anyone explain what's going on here?

sz4kerto 11y ago
Without reading the article: it looks like it casts exec to a function pointer with void return type and no arguments, and calls it. (Disclaimer: I'm paid for writing Java :( )
reginaldo 11y ago
Almost. It's casting exec to a pointer to a function that "returns" void and takes no arguments and then calling the function. Search for "C right-left rule" (without quotes) to see some hints on how to read complex declarations (mostly applies to casting too). I like http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html
frede 11y ago
It's actually a cast to a function pointer with signature: void exec(). The trailing brackets () then make the program call the function.
kondbg 11y ago
This is a common way of executing shellcode in a PoC. Exec (before the cast) points to memory containing the shellcode data. To actually start executing the shellcode, you just need to somehow cause the program counter to point to the address of the shellcode. An easy way to change the program counter is by calling a function ... which is what this line does. Read this as "cast exec to a pointer to a function that takes zero arguments and returns void and call the function with no arguments." This is the same as: typedef void (*some_func)(); some_func func = (some_func)exec; func(); To familiarize yourself with C syntax regarding pointers, read about the "right-left rule" [1] [1] http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html http://ieng9.ucsd.edu/~cs30x/rt_lt.rule.html
- 11y ago

elcct 11y ago

Most Antivirus software makes your system work like it has a virus. Most of them will eventually let intruder in. Waste of money in my opinion.

cryowaffle 11y ago

How many times do you plan on posting this?

gus_massa 11y ago
This has been postested 3 times. From the FAQ: > Are reposts ok? > If a story has had significant attention in the last year or so, we kill reposts as duplicates. If not, a small number of reposts is ok. > Please don't delete and repost the same story, though. Accounts that do that eventually lose submission privileges. Looking at the public available data of the 3 submitters, they look like real independent user (not sockpuppets or something).
jacquesm 11y ago
That looks to have been posted from 3 different accounts, do you have reason to believe they are the same person?

CyberDildonics 11y ago

I've said it before but as hard as it might be to believe, I think smalltalk was 30 years ahead of its time when every program was packaged inside its own OS image. Anti-virus bypasses and even exploits are extremely common. My current line of thinking is that the best way to take control of your computer is to use virtualization to run many separate OS images for different sets of uses.

feintruled 11y ago
Interesting, but would have obvious drawbacks when it comes to addressing any OS vulnerabilities or improvements - suddenly you have to reinstall ALL your applications! This reminds me of Nintendo's approach to emulation for their Virtual Console, actually. Rather than having a standalone emulator that you download images for, they package the emulator with the game. This way they never have to worry about inadvertantly breaking anything with a future release, but on the other hand any subsequent emulator improvements do not retroactively apply.
- CyberDildonics 11y ago
  I think you could save and fork OS images. At the same time I would think vulnerabilities wouldn't matter as much, but you are right that it adds complexity to managing a system.

Uptrenda 11y ago

So after the program is actually compiled into binary code do the resulting instructions become so simple (and so fundamental to the operation of programs) that any attempt to write a heuristics rule to stop this technique would break thousands of programs or are heuristics just so inherently shitty that this technique works? Because I would still think that this line here: void *exec = VirtualAlloc(0, sizeof c, MEM_COMMIT, PAGE_EXECUTE_READWRITE); Would be a red flag. I don't know how many programs use that on the Windows side of things but I have almost never seen programs call this function that weren't "crypters." I am honestly impressed how simple this program is (it's the most elegant crypter I've probably ever seen) but I am still wondering whether heuristics could be made to detect this (without also falsely detecting thousands of other programs?) What do you think OP? Not really my field but curious all the same.

vortico 11y ago
I believe this is how JIT compilation works. So this would trigger a false positive on the Java VM, Javascript V8 interpreter, Spidermonkey, and C# runtime.
- yoklov 11y ago
  Also, most emulators of reasonably modern systems. Although JITs in VMs are a few orders of magnitude more common.
simoncion 11y ago
Why would that be a red flag? From what I can glean from the documentation, both MEM_COMMIT and PAGE_EXECUTE_READWRITE are perfectly reasonable flags to pass to VirtualAlloc, and -again, according to the documentation- VirtualAlloc appears to be a way to (de|re)allocate memory within the region allocated to your process. What's more, every program that uses Boost on Windows calls VirtualAlloc, in several places.
tbirdz 11y ago
VirtualAlloc is roughly equivalent in intent to POSIX's mmap. So anywhere that you'd use mmap in a Linux program, you'd probably use VirtualAlloc in Windows.

x5a 11y ago

I used to work at a large, well known AV company. While much of what other commenters have said is true, I will note that VT is less authoritative than some realize; the version of our product that VirusTotal was given access to was substantively different than our normal product; features such as sandboxing were removed. I wouldn't be surprised if this was a common practice; we considered our product's detection capabilities to be proprietary.

lqdc13 11y ago

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated. If that obfuscator is not commonly used in goodware programs, it is marked as malware. This is kind of a dumb strategy on the part of AV engines, but it works okay. You're not going to catch new malware with static (or dynamic for that matter) analysis anyway. Thing is, the problem is ill-defined. What is malware? Is it a program that does something a user doesn't want? If users knew what regular programs do, they wouldn't be okay with most of it either. Is it a program that does some obfuscating tricks and exploits undocumented functionality in the system? Plenty of legit programs including a lot of AV engines do that as well. The only usable definition in my opinion is that it is a program that makes the user unhappy with no easily accessible way of removing it completely. This is why the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users).

Razengan 11y ago
> What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After that, automatic backups will let users revert any undesirable changes to their data, whether they were made by their own selves or by malware. I think operating systems should just do a better job of making the user more aware of all recently-modified files, especially if a process has been modifying a large number of them in a short time (the recent ransomware comes to mind) or if a third-party background process has been generating an uncanny amount of network traffic. Seeing something like "1,590 files modified" on log-on or in a notification, is way more alarming and would make users take immediate action, compared to all the usual OS or antivirus nags that we are all accustomed to subconsciously agreeing to.

Kenji 11y ago

AV is a little and often useless supplement to security, nothing more. It has always been trivially easy for a script kiddie to write malicious software that passes all of VirusTotal. In the decade I've been using AV, I had less true positives than false positives (yes please auto-delete my patches, hacktools and software I've written myself, idiot AV program) and of course some false negatives that wrecked me because I executed them. Since I stopped using AV and became more careful (e.g. use VM for suspicious files) I was never infected again.

awqrre 11y ago

It appears that not much have changed in the last ~20 years, when looking at mainstream antivirus software... I used to be able to move around a few assembly instructions inside a virus to avoid detection while still maintaining 100% of the virus' features

rmdoss 11y ago

That's a common mistake of people that do not understand how AV's work and how virustotal work. From their own FAQ: At VirusTotal we are tired of repeating that the service was not designed as a tool to perform antivirus comparative analyses, but as a tool that checks suspicious samples with several antivirus solutions and helps antivirus labs by forwarding them the malware they fail to detect. Those who use VirusTotal to perform antivirus comparative analyses should know that they are making many implicit errors in their methodology, the most obvious being: -VirusTotal's antivirus engines are commandline versions, so depending on the product, they will not behave exactly the same as the desktop versions: for instance, desktop solutions may use techniques based on behavioural analysis and count with personal firewalls that may decrease entry points and mitigate propagation, etc. -In VirusTotal desktop-oriented solutions coexist with perimeter-oriented solutions; heuristics in this latter group may be more aggressive and paranoid, since the impact of false positives is less visible in the perimeter. It is simply not fair to compare both groups. -Some of the solutions included in VirusTotal are parametrized (in coherence with the developer company's desire) with a different heuristic/agressiveness level than the official end-user default configuration. thanks,

JoachimSchipper 11y ago
I do not understand how this is a response to the article, which doesn't make a comparison so much as claim that all AV suck.
- Natsu 11y ago
  It seems to say that just because something passes virustotal with 0/56 doesn't necessarily mean it would pass every AV in a real attack.
  - JoachimSchipper 11y ago
    Does the comment actually say that, though? It would make sense if the comment said that, but e.g. > perform antivirus comparative analyses is not what is happening here.

flyinghorse 11y ago

Try running the binary instead of just scanning it for signatures. It will be detected by the heuristics engines of most AVs. I'm not saying that AVs are good but articles like this that only focus on defeating signatures while leaving away heuristics (emulation, behavior detection, and even white listing to some extent) don't do the subject justice.

wepple 11y ago

lets not forget that this isn't actually all that practical in practice. It's not executing any old binary: the 'shellcode' has to be position-independent and can't rely on any normal PE features; it has to do all it's library loading on it's own etc. yes, very possible to create. but if your malware/tool you want to run is large, it will take a fair amount of time to convert.

feintruled 11y ago

I suppose the value in AV is that you are like one of the proverbial guys being chased by the lion - you don't need to outrun the lion, only the other guy. In this case, you just hope any malware hits enough other poor suckers first that your AV of choice is updated in time to save you.