3 ms·

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or as

by lqdc13 11y ago

A couple of things: - This wouldn't work for larger payloads. AVs flag binary looking data that is larger than a certain size and that is later processed or assigned to a variable. - Their veil project has some problems. Py2EXE gets marked as malware by some AVs in many cases just because it is Py2EXE. Same thing with non-commonly used obfuscators. Basically, they just pick up on the fact that something is obfuscated. If that obfuscator is not commonly used in goodware programs, it is marked as malware. This is kind of a dumb strategy on the part of AV engines, but it works okay. You're not going to catch new malware with static (or dynamic for that matter) analysis anyway. Thing is, the problem is ill-defined. What is malware? Is it a program that does something a user doesn't want? If users knew what regular programs do, they wouldn't be okay with most of it either. Is it a program that does some obfuscating tricks and exploits undocumented functionality in the system? Plenty of legit programs including a lot of AV engines do that as well. The only usable definition in my opinion is that it is a program that makes the user unhappy with no easily accessible way of removing it completely. This is why the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users).

Razengan 11y ago
> What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After that, automatic backups will let users revert any undesirable changes to their data, whether they were made by their own selves or by malware. I think operating systems should just do a better job of making the user more aware of all recently-modified files, especially if a process has been modifying a large number of them in a short time (the recent ransomware comes to mind) or if a third-party background process has been generating an uncanny amount of network traffic. Seeing something like "1,590 files modified" on log-on or in a notification, is way more alarming and would make users take immediate action, compared to all the usual OS or antivirus nags that we are all accustomed to subconsciously agreeing to.
- deleted 11y ago
  [deleted]
- seanp2k2 11y ago
  Re: OS nags...Windows is the worst IMO since UAC basically just asks ~it looks like you're trying to do a thing, are you sure you want to do that thing? The "open this program FROM THE INTERNET????" nag on OSX and Win are also pretty pointless. I've never not clicked yes, but there's not an easy way to disable this. It looks like it CAN be disabled with registry tweaks or GPEdit: http://www.sevenforums.com/tutorials/182353-open-file-security-warning-enable-disable.html http://www.sevenforums.com/tutorials/182353-open-file-securi... but kind of ridiculous that it's not just an option, given how little it increases security (how many people don't just blindly click "open"?)
  - lqdc13 11y ago
    What if it's a browser exploit that basically got the browser to "download and open"? Then this would be the second line of defense - something is about to run even though you didn't know expect it to run.
    - ryao 11y ago
      The "execute downloaded executable" protection predates UAC. It was introduced in Windows XP SP2 and UAC implemented its own version of it, which created double prompts: https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-control/ https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-... That being said, the "execute downloaded executable" protection only applies when the binaries are marked as being from the internet, which is easy to bypass. You just need to download the software in a way that the mark is not applied (e.g. not through a software mechanism designed to apply it). Furthermore, attacks need not rely on "execute downloaded executable". They just need to achieve code injection, which bypasses the need to run through the "execute downloaded executable" process. However, any injected code would be able to download and open without triggering UAC by not marking the file as having been downloaded from the internet. Such file marking is entirely voluntary and malicious code would likely never voluntarily do it. Protection against inadvertent execution of software downloaded from the internet is the only function in UAC that is useful. The other functions are designed to operate on already executing software. Since already executing software can gain system privileges (above administrator privileges) via vulnerabilities the that Microsoft refused to fix, it can do basically anything it wants. UAC is fairly useless against it because anything it wants includes turning off UAC. I know enough about Windows security that I stopped using Windows years ago, so I do not know whether UAC would require malicious software that has gained system privileges to turn it off. If it does, it should be a simple matter. Anyway, the hot potato proof of concept code demonstrates gaining system privileges by exploiting such vulnerabilities: http://foxglovesecurity.com/2016/01/16/hot-potato/ http://foxglovesecurity.com/2016/01/16/hot-potato/ https://youtu.be/Nd6f5P3LSNM https://youtu.be/Nd6f5P3LSNM The video of it running on Windows 7 uses the system privileges to give a regular user administrator privileges. There is a Windows firewall prompt that appears in the video, but it does not stop the exploit. The appearance of the prompt ought to be avoidable because whatever triggered the Windows firewall prompt was not necessary for the exploit and could be removed.
Someone 11y ago
"the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users)." Isn't that what Gatekeeper (https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491) is supposed to be? One weird thing w.r.t. Gatekeeper is that it seems to depend on everybody who downloads signed executables not via the App Store to blacklist them (by adding some extended attribute to the file) I think a whitelist would be more reliable.

by lqdc13 11y ago

Razengan 11y ago

> What is malware? Is it a program that does something a user doesn't want? OS X Sandboxing seems to have the right idea: Instead of worrying about what the user doesn't want, do only what the user WANTS. Basically, sandboxed apps don't have access to files and folders other than the ones that the user explicitly chooses in an Open/Save dialog. It's a surprisingly nag-free opt-in mechanism that "just works." After that, automatic backups will let users revert any undesirable changes to their data, whether they were made by their own selves or by malware. I think operating systems should just do a better job of making the user more aware of all recently-modified files, especially if a process has been modifying a large number of them in a short time (the recent ransomware comes to mind) or if a third-party background process has been generating an uncanny amount of network traffic. Seeing something like "1,590 files modified" on log-on or in a notification, is way more alarming and would make users take immediate action, compared to all the usual OS or antivirus nags that we are all accustomed to subconsciously agreeing to.

deleted 11y ago
[deleted]
seanp2k2 11y ago
Re: OS nags...Windows is the worst IMO since UAC basically just asks ~it looks like you're trying to do a thing, are you sure you want to do that thing? The "open this program FROM THE INTERNET????" nag on OSX and Win are also pretty pointless. I've never not clicked yes, but there's not an easy way to disable this. It looks like it CAN be disabled with registry tweaks or GPEdit: http://www.sevenforums.com/tutorials/182353-open-file-security-warning-enable-disable.html http://www.sevenforums.com/tutorials/182353-open-file-securi... but kind of ridiculous that it's not just an option, given how little it increases security (how many people don't just blindly click "open"?)
- lqdc13 11y ago
  What if it's a browser exploit that basically got the browser to "download and open"? Then this would be the second line of defense - something is about to run even though you didn't know expect it to run.
  - ryao 11y ago
    The "execute downloaded executable" protection predates UAC. It was introduced in Windows XP SP2 and UAC implemented its own version of it, which created double prompts: https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-control/ https://blogs.msdn.microsoft.com/e7/2008/10/08/user-account-... That being said, the "execute downloaded executable" protection only applies when the binaries are marked as being from the internet, which is easy to bypass. You just need to download the software in a way that the mark is not applied (e.g. not through a software mechanism designed to apply it). Furthermore, attacks need not rely on "execute downloaded executable". They just need to achieve code injection, which bypasses the need to run through the "execute downloaded executable" process. However, any injected code would be able to download and open without triggering UAC by not marking the file as having been downloaded from the internet. Such file marking is entirely voluntary and malicious code would likely never voluntarily do it. Protection against inadvertent execution of software downloaded from the internet is the only function in UAC that is useful. The other functions are designed to operate on already executing software. Since already executing software can gain system privileges (above administrator privileges) via vulnerabilities the that Microsoft refused to fix, it can do basically anything it wants. UAC is fairly useless against it because anything it wants includes turning off UAC. I know enough about Windows security that I stopped using Windows years ago, so I do not know whether UAC would require malicious software that has gained system privileges to turn it off. If it does, it should be a simple matter. Anyway, the hot potato proof of concept code demonstrates gaining system privileges by exploiting such vulnerabilities: http://foxglovesecurity.com/2016/01/16/hot-potato/ http://foxglovesecurity.com/2016/01/16/hot-potato/ https://youtu.be/Nd6f5P3LSNM https://youtu.be/Nd6f5P3LSNM The video of it running on Windows 7 uses the system privileges to give a regular user administrator privileges. There is a Windows firewall prompt that appears in the video, but it does not stop the exploit. The appearance of the prompt ought to be avoidable because whatever triggered the Windows firewall prompt was not necessary for the exploit and could be removed.

Someone 11y ago

"the only solution seems to be to only allow installation from a trusted repository. I am still not sure why Windows/Apple OSX haven't adopted such a strategy (with a developer mode override option for some advanced users)." Isn't that what Gatekeeper (https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491) is supposed to be? One weird thing w.r.t. Gatekeeper is that it seems to depend on everybody who downloads signed executables not via the App Store to blacklist them (by adding some extended attribute to the file) I think a whitelist would be more reliable.