10 ms·

Pool Memory Corruption CVE-2016-2208

209 points by reubenmorais 10y ago

CiPHPerCoder 10y ago
If you've been following Tavis Ormandy's work, you already know this: Anti-Virus software is a trash-fire. You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/ http://decentsecurity.com/#/introduction/ I've long argued that the only sustainable security strategy is education. If you're a developer/engineer/consultant/rockstar/ninja/etc. and never bothered to learn how to write secure software, start here: https://paragonie.com/blog/2015/08/gentle-introduction-application-security https://paragonie.com/blog/2015/08/gentle-introduction-appli...
- lqdc13 10y ago
  I don't personally use AVs but they're useful for people who cannot be taught security. There is a good amount of intuition that goes into it. Such vulns are relatively rare compared to the things they run into multiple times a day.
  - CiPHPerCoder 10y ago
    > I don't personally use AVs but they're useful for people who cannot be taught security. Attackers agree. Even outside of the context of remotely exploitable ring-0 vulnerabilities that require no user interaction, they provide people with a false sense of security. > Such vulns are relatively rare compared to the things they run into multiple times a day. That's because criminals are fat and happy with lower hanging fruit. Why bother exploiting AV software when you can just trick people and the AV software is already ineffective at stopping e.g. ransomware?
- hndl 10y ago
  >> "You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/" http://decentsecurity.com/#/introduction/" I think that's an incorrect standpoint to take when you factor in how technologically agnostic most folks are. I would better think of it as "security is default, but you can disable it if you really, really want it that way."
  - CiPHPerCoder 10y ago
    Security isn't the default, though. Specific example: SMTP.
- ghshephard 10y ago
  Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. And, even for those of us who are somewhat savvy, having refreshers to remind you things like never, ever, click on a link in an email, navigate through the website instead. Be hyper cautious about opening every attachment, period. Ensure that your system firewall is set to default deny, and think twice about opening up rules when an application demands them - and consider making them temporary rules. (Little snitch is great for that). Make sure the OS is updated routinely.... With that said, operating systems could help us out a little by reducing the almost infinite number of threat surfaces that exist so that we can more easily audit our system. The sheer number of places that an auto-launching/malware/kernel extension can hide in OS X makes it next to impossible for me to figure out whether my system has been compromised - particularly if something is able to hide itself from Little Snitch. And I won't even go into the insane number of network accesses that most applications want these days... But yes, the only sustainable security strategy is education.
- coredog64 10y ago
  decentsecurity.com is an effort of InfoSec Taylor Swift (@SwiftOnSecurity). If you can deal with the occasional Cortana fanfic & some Linux trolling it's definitely worth a follow.
saturncoleus 10y ago
Can't help but wonder if attackers already knew this. There seems to be quite a few bugs found by taviso in antivirus code in the past few months, which has got to either attract attackers to look more closely at it or possibly break their existing exploits. Either way, it's frightening! Increasingly, my non-computer savvy family members ask me what kind of anti virus they should use. I used to pick one to tell them since I know they aren't as cautious as I am, but I am not sure I have a good answer for them any more. Has AV software reached the point that a lay user is more vulnerable with it than without it?
- pfg 10y ago
  My current recommendation when I get asked that question is not to bother with any third-party AV and just use Windows 10 with Windows Defender (unless they're on OS X anyway). When I'm asked to set things up, I switch their default browser to Chrome (or Firefox for those who "don't like Google"), add uBlock Origin and use Click-To-Play for plugins (which, surprisingly, isn't much of an inconvenience once you block ads anyway). If someone asks for extra protection, I add OpenDNS Umbrella to the setup ($20/year for 3 devices), which is a nice additional layer of defense. Chromebooks are also a great option if someone's not doing much other than email, web browsing and such. My other recommendation is to use a tablet for things like online banking. (Yes, even an outdated Android tablet is probably less likely to catch malware that will steal your money than an average computer.)
  - progers7 10y ago
    This is the first time I have heard of OpenDNS Umbrella. I just gave it a try (they have a free trial) and it's really nice--after some simple configuration you pretty much just set your router's DNS to OpenDNS and then your DNS requests are both monitored and lightly protected. The product is geared towards medium-to-large networks so it's a little hard to find the prosumer $20/yr plan. Here's a link if anyone else is interested: https://www.opendns.com/enterprise-security/threat-enforcement/package-comparison/small-teams/ https://www.opendns.com/enterprise-security/threat-enforceme...
technion 10y ago
It's high time some of these compliance groups got together and had a good hard look at themselves. It's been years since desktop signature-based antivirus provided a significant improvement to security. Every time there's a cryptolocker outbreak, I see people scrambling to make decisions like "we need to replace McAfee with Kaspersky", as though they feel that's their answer. When you try telling an insurance auditor "we have a whitelisting application, nothing runs unless I've approved it, products like Symantec Endpoint are unnecessary in that environment", you first get a confused look, then you hear "ok, so you're DON'T meet the minimum basic security requirements, let me write that down". It's gotten to a point that it's actively part of Intel Security's advertising, with a recent partner promotion pushing to "help your clients meet their compliancy requirements". The brochure never even mentioned actually securing anything, just how it ticked various boxes.
- godzillabrennus 10y ago
  Http://www.bromium.com is a new take on security providing full sandboxes for applications.
  - lstamour 10y ago
    Having heard of Sandboxie as well, this whitepaper was interesting, see link at https://labs.bromium.com/2013/07/23/application-sandboxes-a-pen-testers-perspective/ https://labs.bromium.com/2013/07/23/application-sandboxes-a-... See also: https://news.ycombinator.com/item?id=8257250 https://news.ycombinator.com/item?id=8257250 (DrawBridge & commentary) Oh and the follow-up in the comments: (Regarding Sandboxie reconfiguration mitigating some of the attacks) > I tested with SBIE4 and indeed it is quite different and has security improvements over what we tested in our report. Great job by the author! > However, our kernel exploits still work flawlessly – no issues there. You need to remember that SBIE3/4 (and other similar app sandboxes) are kernel mode drivers and they will always have some fundamental limitations. Blocking access to specific DLL’s is far from a practical use case as you have no idea where the next patch is going to come (BTW similar capability has been available in HIPS technology for several years and very few people use it) > Once time permits, we’ll probably update our analysis with the latest SBIE4. However, this is not our core focus, the idea of this research was to simply enumerate the fundamental limitations of application sandboxing tech. If you've read this far, you might also be interested in other Bromium research: https://labs.bromium.com/category/research/ https://labs.bromium.com/category/research/ Of course, folks might be first in line to point out that nothing's perfect, and user-error can get around a lot of security... Nobody would argue sandboxing is an excuse to not patch systems, except with antivirus you might increase your attack surface while trying to detect attacks with something that can't be easily circumvented. Trade-offs. Can you trust sandboxing to prevent damage from malware or do you need some kind of warning that something strange is going on?
epmatsw 10y ago
Oh my god mailing the report to them crashed their mail server. You can't make this stuff up.
- molyss 10y ago
  I didn't understand that part at first, but it is hilarious. They apparently use their own product on their email server, which unpacked the POC by guessing the password of the archive, scanned the uncompressed file and triggered the bug that was being reported. Love it !
rdtsc 10y ago
> On Linux, Mac and other UNIX platforms, this results in a remote heap overflow as root in the Symantec or Norton process. Is this a real thing? Hands up, who runs Norton on Linux? Is it because it is used as a central back-end / service to check attachments. But then why does it run as root?
- mcpherrinm 10y ago
  At least in the card processing space, one of the PCI requirements is "5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers)." The phrase "commonly affected" is the place to make an argument here, but I'm sure people take the easy option of just running an antivirus.
  - nihonde 10y ago
    Right, and that requirement loses all of its nuance when it lands on someone's checklist as "anti-virus software on PCs and servers". When my company gets asked why we answer "no" to that question, my canned response is "because anti-virus software would almost certainly be the most exploitable vector on our systems".
    - technion 10y ago
      Not all auditors will accept that answer. Mine sure don't.
      - nihonde 10y ago
        In that case, the answer is "yes" and the definition of "industry-standard virus scanning software" becomes flexible enough to include a firewall?
  - heywire 10y ago
    Many times a retailer will install a whitelisting solution as a "compensating control".
  - 10y ago
yread 10y ago
Well, at least they handled it fairly quickly - it was submitted on May 6th and according to https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160516_00 https://www.symantec.com/security_response/securityupdates/d... a patch was deployed and should be automatically downloaded. I'm running Symantec and LiveUpdate did download some stuff but nowhere it says whether version 20151.1.1.4 is already there or not. Ah well
deleted 10y ago
[deleted]
JustSomeNobody 10y ago
Operating systems need to offer better protection. I am tired of buying the OS then having to go buy the equivalent of anti-lock breaks, air bags and seat belts from a third party. This is just a stupid, lazy way of doing business.
- hwhatwhatwhat 10y ago
  What specific protections do you have in mind?
drewg123 10y ago
"scan engine is loaded into the kernel (wtf!!!)" That rings a bell -- I remember back in the early/mid 2000s, when the AV vendors started to port their products to Mac OS X. The darwin (OSX) kernel/driver mailing lists seemed to get a lot of questions from AV devs, asking how to do things in the kernel that really, really, really should not be in the kernel. It was at that point I resolve to never run any AV software.
hwhatwhatwhat 10y ago
> This is a remote code execution vulnerability. I understand how this vulnerability can be used to corrupt the heap, as it's writing more data than malloc was asked to reserve, so it can overwrite memory allocations from other parts of the program. I am curious as to how would one create a reliable remote code execution exploit out of this? I guess that one may be able to find a function pointer somewhere to overwrite, and use that to control program flow to your shellcode - but as this is dynamically allocated memory, could it not be adjacent to pretty much anything? How would an attacker approach making a remote code execution exploit, given these constraints? Is it possible in practice or more theoretical? (I'm not challenging this classification, just would really like to know how this works!)
beernutz 10y ago
Ok, this is some dark humor: It looks like the researcher sent a proof of concept zip file to symantec which was pw protected with a common password. Symantec's system then tried the common password, extracted the zip, scanned the POC code inside, which crashed their own system. From the report: Project Member Comment 1 by taviso@google.com, Yesterday (42 hours ago) I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent. They had missed the report, so I sent it again with a randomly generated password.

209 points by reubenmorais 10y ago

If you've been following Tavis Ormandy's work, you already know this: Anti-Virus software is a trash-fire. You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/ http://decentsecurity.com/#/introduction/ I've long argued that the only sustainable security strategy is education. If you're a developer/engineer/consultant/rockstar/ninja/etc. and never bothered to learn how to write secure software, start here: https://paragonie.com/blog/2015/08/gentle-introduction-application-security https://paragonie.com/blog/2015/08/gentle-introduction-appli...

lqdc13 10y ago
I don't personally use AVs but they're useful for people who cannot be taught security. There is a good amount of intuition that goes into it. Such vulns are relatively rare compared to the things they run into multiple times a day.
- CiPHPerCoder 10y ago
  > I don't personally use AVs but they're useful for people who cannot be taught security. Attackers agree. Even outside of the context of remotely exploitable ring-0 vulnerabilities that require no user interaction, they provide people with a false sense of security. > Such vulns are relatively rare compared to the things they run into multiple times a day. That's because criminals are fat and happy with lower hanging fruit. Why bother exploiting AV software when you can just trick people and the AV software is already ineffective at stopping e.g. ransomware?
hndl 10y ago
>> "You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/" http://decentsecurity.com/#/introduction/" I think that's an incorrect standpoint to take when you factor in how technologically agnostic most folks are. I would better think of it as "security is default, but you can disable it if you really, really want it that way."
- CiPHPerCoder 10y ago
  Security isn't the default, though. Specific example: SMTP.
ghshephard 10y ago
Couldn't agree with you more. Every tool in the world won't help you defend against a user with privileges being phished into doing something inappropriate. And, even for those of us who are somewhat savvy, having refreshers to remind you things like never, ever, click on a link in an email, navigate through the website instead. Be hyper cautious about opening every attachment, period. Ensure that your system firewall is set to default deny, and think twice about opening up rules when an application demands them - and consider making them temporary rules. (Little snitch is great for that). Make sure the OS is updated routinely.... With that said, operating systems could help us out a little by reducing the almost infinite number of threat surfaces that exist so that we can more easily audit our system. The sheer number of places that an auto-launching/malware/kernel extension can hide in OS X makes it next to impossible for me to figure out whether my system has been compromised - particularly if something is able to hide itself from Little Snitch. And I won't even go into the insane number of network accesses that most applications want these days... But yes, the only sustainable security strategy is education.
coredog64 10y ago
decentsecurity.com is an effort of InfoSec Taylor Swift (@SwiftOnSecurity). If you can deal with the occasional Cortana fanfic & some Linux trolling it's definitely worth a follow.

saturncoleus 10y ago

Can't help but wonder if attackers already knew this. There seems to be quite a few bugs found by taviso in antivirus code in the past few months, which has got to either attract attackers to look more closely at it or possibly break their existing exploits. Either way, it's frightening! Increasingly, my non-computer savvy family members ask me what kind of anti virus they should use. I used to pick one to tell them since I know they aren't as cautious as I am, but I am not sure I have a good answer for them any more. Has AV software reached the point that a lay user is more vulnerable with it than without it?

pfg 10y ago
My current recommendation when I get asked that question is not to bother with any third-party AV and just use Windows 10 with Windows Defender (unless they're on OS X anyway). When I'm asked to set things up, I switch their default browser to Chrome (or Firefox for those who "don't like Google"), add uBlock Origin and use Click-To-Play for plugins (which, surprisingly, isn't much of an inconvenience once you block ads anyway). If someone asks for extra protection, I add OpenDNS Umbrella to the setup ($20/year for 3 devices), which is a nice additional layer of defense. Chromebooks are also a great option if someone's not doing much other than email, web browsing and such. My other recommendation is to use a tablet for things like online banking. (Yes, even an outdated Android tablet is probably less likely to catch malware that will steal your money than an average computer.)
- progers7 10y ago
  This is the first time I have heard of OpenDNS Umbrella. I just gave it a try (they have a free trial) and it's really nice--after some simple configuration you pretty much just set your router's DNS to OpenDNS and then your DNS requests are both monitored and lightly protected. The product is geared towards medium-to-large networks so it's a little hard to find the prosumer $20/yr plan. Here's a link if anyone else is interested: https://www.opendns.com/enterprise-security/threat-enforcement/package-comparison/small-teams/ https://www.opendns.com/enterprise-security/threat-enforceme...

technion 10y ago

It's high time some of these compliance groups got together and had a good hard look at themselves. It's been years since desktop signature-based antivirus provided a significant improvement to security. Every time there's a cryptolocker outbreak, I see people scrambling to make decisions like "we need to replace McAfee with Kaspersky", as though they feel that's their answer. When you try telling an insurance auditor "we have a whitelisting application, nothing runs unless I've approved it, products like Symantec Endpoint are unnecessary in that environment", you first get a confused look, then you hear "ok, so you're DON'T meet the minimum basic security requirements, let me write that down". It's gotten to a point that it's actively part of Intel Security's advertising, with a recent partner promotion pushing to "help your clients meet their compliancy requirements". The brochure never even mentioned actually securing anything, just how it ticked various boxes.

godzillabrennus 10y ago
Http://www.bromium.com is a new take on security providing full sandboxes for applications.
- lstamour 10y ago
  Having heard of Sandboxie as well, this whitepaper was interesting, see link at https://labs.bromium.com/2013/07/23/application-sandboxes-a-pen-testers-perspective/ https://labs.bromium.com/2013/07/23/application-sandboxes-a-... See also: https://news.ycombinator.com/item?id=8257250 https://news.ycombinator.com/item?id=8257250 (DrawBridge & commentary) Oh and the follow-up in the comments: (Regarding Sandboxie reconfiguration mitigating some of the attacks) > I tested with SBIE4 and indeed it is quite different and has security improvements over what we tested in our report. Great job by the author! > However, our kernel exploits still work flawlessly – no issues there. You need to remember that SBIE3/4 (and other similar app sandboxes) are kernel mode drivers and they will always have some fundamental limitations. Blocking access to specific DLL’s is far from a practical use case as you have no idea where the next patch is going to come (BTW similar capability has been available in HIPS technology for several years and very few people use it) > Once time permits, we’ll probably update our analysis with the latest SBIE4. However, this is not our core focus, the idea of this research was to simply enumerate the fundamental limitations of application sandboxing tech. If you've read this far, you might also be interested in other Bromium research: https://labs.bromium.com/category/research/ https://labs.bromium.com/category/research/ Of course, folks might be first in line to point out that nothing's perfect, and user-error can get around a lot of security... Nobody would argue sandboxing is an excuse to not patch systems, except with antivirus you might increase your attack surface while trying to detect attacks with something that can't be easily circumvented. Trade-offs. Can you trust sandboxing to prevent damage from malware or do you need some kind of warning that something strange is going on?

epmatsw 10y ago

Oh my god mailing the report to them crashed their mail server. You can't make this stuff up.

molyss 10y ago
I didn't understand that part at first, but it is hilarious. They apparently use their own product on their email server, which unpacked the POC by guessing the password of the archive, scanned the uncompressed file and triggered the bug that was being reported. Love it !

rdtsc 10y ago

> On Linux, Mac and other UNIX platforms, this results in a remote heap overflow as root in the Symantec or Norton process. Is this a real thing? Hands up, who runs Norton on Linux? Is it because it is used as a central back-end / service to check attachments. But then why does it run as root?

mcpherrinm 10y ago
At least in the card processing space, one of the PCI requirements is "5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers)." The phrase "commonly affected" is the place to make an argument here, but I'm sure people take the easy option of just running an antivirus.
- nihonde 10y ago
  Right, and that requirement loses all of its nuance when it lands on someone's checklist as "anti-virus software on PCs and servers". When my company gets asked why we answer "no" to that question, my canned response is "because anti-virus software would almost certainly be the most exploitable vector on our systems".
  - technion 10y ago
    Not all auditors will accept that answer. Mine sure don't.
    - nihonde 10y ago
      In that case, the answer is "yes" and the definition of "industry-standard virus scanning software" becomes flexible enough to include a firewall?
- heywire 10y ago
  Many times a retailer will install a whitelisting solution as a "compensating control".
- 10y ago

yread 10y ago

Well, at least they handled it fairly quickly - it was submitted on May 6th and according to https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160516_00 https://www.symantec.com/security_response/securityupdates/d... a patch was deployed and should be automatically downloaded. I'm running Symantec and LiveUpdate did download some stuff but nowhere it says whether version 20151.1.1.4 is already there or not. Ah well

deleted 10y ago

[deleted]

JustSomeNobody 10y ago

Operating systems need to offer better protection. I am tired of buying the OS then having to go buy the equivalent of anti-lock breaks, air bags and seat belts from a third party. This is just a stupid, lazy way of doing business.

hwhatwhatwhat 10y ago
What specific protections do you have in mind?

drewg123 10y ago

"scan engine is loaded into the kernel (wtf!!!)" That rings a bell -- I remember back in the early/mid 2000s, when the AV vendors started to port their products to Mac OS X. The darwin (OSX) kernel/driver mailing lists seemed to get a lot of questions from AV devs, asking how to do things in the kernel that really, really, really should not be in the kernel. It was at that point I resolve to never run any AV software.

hwhatwhatwhat 10y ago

> This is a remote code execution vulnerability. I understand how this vulnerability can be used to corrupt the heap, as it's writing more data than malloc was asked to reserve, so it can overwrite memory allocations from other parts of the program. I am curious as to how would one create a reliable remote code execution exploit out of this? I guess that one may be able to find a function pointer somewhere to overwrite, and use that to control program flow to your shellcode - but as this is dynamically allocated memory, could it not be adjacent to pretty much anything? How would an attacker approach making a remote code execution exploit, given these constraints? Is it possible in practice or more theoretical? (I'm not challenging this classification, just would really like to know how this works!)

beernutz 10y ago

Ok, this is some dark humor: It looks like the researcher sent a proof of concept zip file to symantec which was pw protected with a common password. Symantec's system then tried the common password, extracted the zip, scanned the POC code inside, which crashed their own system. From the report: Project Member Comment 1 by taviso@google.com, Yesterday (42 hours ago) I think Symantec's mail server guessed the password "infected" and crashed (this password is commonly used among antivirus vendors to exchange samples), because they asked if they had missed a report I sent. They had missed the report, so I sent it again with a randomly generated password.