13 ms·
How to Compromise the Enterprise Endpoint
- electic 10y agoThe software you buy to keep you safe actually exposes you to more risk than if you didn't buy it. How ironic.
- quantumhobbit 10y agoIt was ironic fifteen years ago. Now it is just business as usual,
- wmt 10y agoHow much more? I always imagined that it's more likely for a standard user to open every email attachment and execute it than it is to get targeted by a malicious attacker who knows what software your users are running and writes exploits tailored for them, but I could be wrong.
- djrogers 10y agoNo tailoring required with something like this since it's worm-ready; blast out a ton of emails to seed the worm, then post exploit the worm emails itself to everyone in your address book. It won't take too long before a significant portion of the vulnerable systems win the world are infected. See Blaster, Slammer, CodeRed for historical examples....
- cypherpunks01 10y ago"Because Symantec uses a filter driver to intercept all system I/O, just emailing a file to a victim or sending them a link to an exploit is enough to trigger it - the victim does not need to open the file or interact with it in anyway." That seems big. Is there any precedent on AV software vulnerabilities of this scope?
- zabuni 10y agoWorse than that. Apparently,Tavis emailed the exploit to Symantec in a password protected zip file. He included the password in the body of the email. The email server, running Symantec, grabbed the password out of the email, decrypted the zip file, and upon reading the exploit code, crashed itself.
- ceejayoz 10y agoThat's a hell of a proof-of-concept.
- CiPHPerCoder 10y agoIt wasn't intentional. This was alluded to in Tavis's previous exploit. But that being said, it's hilarious.
- mdadm 10y agoSeriously? That's incredible. I'm not sure if I should be impressed that doing so worked, or saddened by the fact that it ACTUALLY WORKED...
- MawNicker 10y agoIt's hilariously ironic. They're in the business of scanning things which smart people want them not to. How does someone send them something they really shouldn't scan?
- cypherpunks01 10y agoI very much started reading your post as a comedic sci-fi ending to the story.. but now I am actually not sure. It would be quite creative to think of that scenario! Did this happen?
- pfg 10y agoI'm afraid this did actually happen[1]. [1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=820#c1 https://bugs.chromium.org/p/project-zero/issues/detail?id=82...
- e40 10y agoIt's hard for me to believe that anyone uses this crap software. A few years ago I spent hours uninstalling it for a friend. It has slowed his laptop to a crawl and he was about to buy a new one. After the uninstall, it was snappy enough to use for a few more years. Really, that software is some of the worst I've ever witnessed, and I've seen some shit.
- dvhh 10y agoBefore windows 10, windows antivirus were the best advertising for Apple computers
- nnx 10y agoWhat has Windows 10 changed on this front?
- FuturePromise 10y agoDang tells me that "joke" answers that don't add to the conversation aren't welcome.
- chipperyman573 10y agoComments that add to conversation and happen to be phrased in a witty way are.
- FuturePromise 10y ago
- Kenji 10y agoI am not surprised in the least. Norton Antivirus is one of the worst of its kind. I've used it for many years. Every single virus/trojan/adware infection I got went straight through Norton Antivirus without it doing anything. Back as a kid I opened a lot of downloaded executables, like games, and some of them were infected. Later, I got more cautious with executables but got rid of all antivirus software - best software decision ever. My computers have never been faster.
- yuhong 10y agoWin32k before Win10 used to do TrueType/Type 1 parsing in the kernel, with an entire bytecode virtual machine!
- fdsaaf 10y agoSo what? Linux, today, has a full bytecode interpreter
- Figs 10y ago> googleprojectzero.blogspot.my Why is this linked to on a .my domain? Is this an official mirror, or is there something sketchy going on here?
- yuhong 10y agoI think it is official but yes it should be changed.
- gus_massa 10y agoBlogspot changes the main tld acording to the location of the viewer. From my home, it's redirected to https://googleprojectzero.blogspot.com.ar/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com.ar/2016/06/how-to-com... HN has a special canonization case for Blogspot, so most of the times you don't see the tld in the HN link. I guess they missed blogspot.my
- wosos 10y agoI suppose it's only for certain countries, no redirection here in El Salvador.
- pfg 10y agoBlogspot, for reasons that defy logic, redirects visitors to "localized" domains (I assume via Geo-IP). OP is probably from Malaysia. Not only is it incredibly annoying and breaks things like URL deduplication, it also leaks your origin when you share links. What a great feature!
- tushar-r 10y ago>Blogspot, for reasons that defy logic, redirects visitors to "localized" domains (I assume via Geo-IP). OP is probably from Malaysia. Because a whole bunch of countries keep wanting to block stuff. So: https://support.google.com/blogger/answer/2402711?hl=en https://support.google.com/blogger/answer/2402711?hl=en If we receive a request to remove content that violates local law, that content may no longer be available to readers on local domains where those laws apply. Note: Country-specific domains is not a different blog address, but a domain redirect based on the country where you're currently located.
- a_c 10y agoWhat are the reasons one would want to use an antivirus? Can someone share some insight on how does antivirus actually work?
- quantumhobbit 10y agoTraditionally they scan files, either in a batch job or on the fly, to see if the file matches a signature, basically a hash, of known viruses. This worked when there were only a couple thousands viruses in the wild. Now this approach is pointless because there are so many viruses, odds of the antivirus having seen it before are effectively zero. Not to mention countermeasures virus writers take make this even harder.
- iancarroll 10y agoSignatures are definitely not hashes. They usually match families of malware or methods of obfuscation. Nor do any respectable AVs scan after something has started running... AVs usually upload suspicious files from user PCs for further analysis to help aid in discovering new variants/types. The odds your AV has seen it is proportional to the odds of you running into it. The industry is moving away from signatures regardless. Now AVs use runtime heuristics to spot bad behavior of executables and block them even if they've never been seen; Cylance literally only does this and it's pretty effective.
- newjersey 10y agoSounds like the same old snake oil to me. > if being “part of a community” means we need to share our algorithmic, unique conviction engine with Big AV so they can steal our convictions, then yes we will not be able to meet that criteria. I have no love for Symantec but this new breed of security software can go screw itself for all I'm concerned.
- planetix 10y agoYou might want to check one vendors explanation on their detection engines: https://labsblog.f-secure.com/2016/05/17/whats-the-deal-with-scanning-engines/ https://labsblog.f-secure.com/2016/05/17/whats-the-deal-with...
- sverige 10y agoIsn't Norton antivirus itself malware? And McAfee too, for that matter? I finally convinced my mom and my wife to stop downloading it everytime they update Adobe Flash. (Yes, they still do that. On Windows of course. Sigh. One thing at a time.)
- yuhong 10y agoAt least it is only McAfee Security Scan which don't seem to have the kernel stuff.
- rincebrain 10y agoI thought even Security Scan had the {network, FS} filter drivers?
- reitanqild 10y agoWas about to recommend using ninite to update flash only to find out Adobe demanded they remove it back in 2013.
- ryuuchin 10y agoYou don't even have to update Flash anymore. It's built-in to Chrome (and updates on its own) and (the other one) updates with Windows Update. I suppose you might have to if you're using Firefox but Firefox would be the last browser I would chose for someone like the people you described (Chrome being the first).
- walrus01 10y agoFrom the perspective of a person who thankfully no longer has to support any Windows based platforms: "Symantec considered harmful" full stop. Let's not forget this: http://arstechnica.com/security/2015/10/still-fuming-over-https-mishap-google-gives-symantec-an-offer-it-cant-refuse/ http://arstechnica.com/security/2015/10/still-fuming-over-ht... Symantec should have suffered the CA "death penalty" and had its trust removed from the browsers that hold most of the global market share.
- yuhong 10y agoI know about this incident. I don't think that would be a good idea in this case.
- aYsY4dDQ2NrcNzA 10y agoI would be interested to hear why.
- walrus01 10y agoIn my opinion the bar is set much too high for the "Root CA death penalty". There has really only ever been one case: https://en.wikipedia.org/wiki/DigiNotar https://en.wikipedia.org/wiki/DigiNotar
- yuhong 10y agoOnly one major case. There are other minor cases too, but mostly affecting less commonly used small CAs.
- Tepix 10y agoAgreed. Comodo has fucked up so badly, they really should be on the list: https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies
- DavidSJ 10y agoWhat if there were a middle ground between browsers trusting and rejecting a CA? What if there were a yellow "proceed with caution" warning on sites using certificates issued by CAs that have very occasionally behaved improperly?
- tmandry 10y agoA bug in their software would be forgivable. This article pointed out both an extremely poor design decision (lots of unnecessary code in the kernel) as well as a serious organizational problem (not doing vulnerability management). These are especially bad considering that they supposed to be a security company. In both cases, one bad example means it's likely there are many more still undiscovered.
- wallflower 10y agoMany years ago, installing Malwarebytes Anti-Malware dramatically reduced the amount of on-site technical support calls for my well-meaning but too trusting ("I just clicked on it") parents. This was before I was able, with the help of my brother-in-law, to convert them to Apple/Mac. Is Malwarebytes Anti-Malware still the gold standard for Windows Malware protection? What is the gold standard for Windows virus protection now?
- maxerickson 10y agoIt never was. The stuff from Microsoft seems less fraught than the rest.
- FreeFull 10y agoThe stuff from Microsoft unfortunately misses a large amount of malware.
- Afforess 10y agoThe gold standard is now Apple MacOs or Linux. I've converted my parents over to Apple systems and no longer have to do any support for them, Apple products "just work". Worth the premium in saved support, in my book. I use Ubuntu as my main OS, personally.
- yuhong 10y agoTo be honest, Mac OS X do have things like Gatekeeper.
- shortstuffsushi 10y agoDo you mean MacKeeper? GateKeeper is Apple's software that prevents you from installing non-verifed apps, MacKeeper is (from what I can tell, haven't installed it or looked at the site) spamware.
- matt_wulfeck 10y agoI would argue that the gold standard is now a chromeOS laptop.
- FuturePromise 10y agoWindows 10 has a built-in antivirus that's very effective, safe, and doesn't impact system usability. There's little reason for anyone on Windows 10 to run Symantec/Norton.
- deleted 10y ago[deleted]
- snarfy 10y ago> and doesn't impact system usability. I have to disagree with this statement. It's kind of a resource pig, actually. When it got to the point it was affecting my day-to-day productivity, I deleted MsMpEng.exe from my hard drive, and now my machine is snappy and responsive again.
- nix0n 10y agoI used to have this problem, but then I configured it to run scans overnight.
- shortstuffsushi 10y agoHere's a question I have every time I see "RCE" type issues, and I'm completely serious when I ask: what is the use case for allowing remote execution in your software? Why would you want to allow arbitrary code to be executed? Or am I perhaps misunderstanding this, is it some sort of break out of the program bounds which allows execution?
- yuhong 10y agoThe latter.
- Buge 10y agoIt's a vulnerability. No one wants it (except attackers). Of course there are some situations that some people actually do want (controlled) remote code execution, such as ssh.
- Forge36 10y agoI've seen a few cases. (Not that they were justified, but that it was a very convenient way to program by someone at the time) The use case here being you fully trust another developer to use the API properly, not realizing a user could also use the API. Now, code review with a security perspective is usually enough to stop intentionally adding it.
- paradite 10y agoI always wonder why, despite all these flaws and vulnerabilities, big enterprises still use them. Is there some kind of "compliance" or "regulation" that mandates companies to install them on every workstation?
- honkhonkpants 10y agoYes. It is a checkbox on many compliance checklists, including PCI DSS (credit card industry standards that apply widely).
- arca_vorago 10y agoYou know you bring up a good point, in that I don't think the relevant regulations like pic, hippa, etc ever really require a certain tool, just certain checks and verifications. It's generally industry "best practice" to install antimalware anywhere that can handle it, with even the formerly forbidden embedded devices getting it sometimes. Honestly, hids like ossec seems more apropos for what businesses really want to know, eg, did files XYZ change and by what when?
- nol13 10y agoWell would you want to be the guy (or gal) responsible for explaining why all your computers don't have A/V installed after an infection?
- paradite 10y agoI would make that argument a few years back when 3rd party A/V is the only choice. But now you have the built-in Windows Defender, which is a valid A/V, why not upgrade your OS and get it for free?
- reitanqild 10y agoSome endpoint vpn solutions scans the pc to try to make sure it is secure. Some of these might not recognise or accept all antivirus solutions. (Source: doing remote support)
- NetTechM 10y agoQuite a few major enterprises use SEP/SEPM in combination with other IPS/IDS. Time to make sure everything is updated I suppose. Good work project zero.
- ngneer 10y agoIMHO, the security industry has been guilty of adding complexity to existing systems rather than doing its duty of stripping it away.
- kbenson 10y agoI'm not really sure I consider McAfee, Norton and the like the security industry. They're definitely a part of it, but in the same way car dealerships are part of the auto industry. They provide a service, but there's a real debate to be had about whether they are more beneficial or harmful.
- ngneer 10y agoFair point, though at times it seems that the markets and regulators in this space tend to favor turnkey products, appliances, et cetera. To ride on your car analogy (pun intended), one finds it is not easy buying directly from a manufacturer, the heavy bias is towards the dealerships.
- empath75 10y agosymmantec is a dumpster fire, according to people I know that work there.
- coderdude 10y agoI think this every time AVG busts out a popup in the middle of a Counter-Strike match. Edit: 5 minutes later, AVG "detected" csgo.exe and asked me if I want to quarantine. Uninstalled.
- toopok4k3 10y agoMaybe csgo.exe does tricks that look like a virus when it's doing its anticheat probing?
- coderdude 10y agoI'll bet you're right about that. To AVG's credit, it may be overly protective and annoying at times but I don't think it has ever let me down outside of being annoying popupware. Maybe I should just finally pay for it like I should have since I've been enjoying their free edition for longer than my memory serves me. Note to self: do the same for Sublime Text.
- verelo 10y agoSo, what do people run on their servers / macbooks for AV? Anything? I was in a meeting just last week with our new "head of Security" who exclaimed when i stated our Macbooks nor or Ubuntu severs run any AV software (We run firewalls and things like fail-2-ban, but no traditional AV). I know i'm going to get into a debate with them over this, so, what would be a good 'win-win' type position for me to fall back on to satisfy this point and not clutter my machines up with junk, if there is such a thing?
- ams6110 10y agoOn Windows PCs, I use Microsoft Security Essentials/Defender/Whatever-it's-called-this-release. It's already there, and basically can't be turned off, so why not? I do not use AV on any other platforms.
- lqdc13 10y agoWindows MSE can be way more resource hungry than many AVs while providing a worse protection. Symantec might actually be worse than MSE depending on your data etc. Avira is the best free one right now IMO. No spam you can't opt out of and no pop ups.
- magicalist 10y ago> No spam you can't opt out of nope
- lqdc13 10y agoWhat specifically is the pop-up? I don't see any you can't disable.
- th0br0 10y agoAny proof for this claim?
- lqdc13 10y ago
- beedogs 10y agoI've been saying this for years, but when are people going to realize that running Norton on your PC is actually worse than not running AV software at all?
- Jedd 10y agoIn the fast-moving world of IT security it's refreshing to see that Symantec's web site makes no mention of these profoundly important vulnerabilities on their landing page They don't seem to have any Status / Current Alerts style pages -- but on their somewhat hard to find blog page we find the most recent update from the guys is from two days ago: "Malicious app found on Google Play, steals Viber photos and videos" http://www.symantec.com/connect/symantec-blogs/symantec-security-response http://www.symantec.com/connect/symantec-blogs/symantec-secu... EDIT: Oh, they have a Vulnerabilities page - https://www.symantec.com/security_response/landing/vulnerabilities.jsp https://www.symantec.com/security_response/landing/vulnerabi... - with the most recent entries listed as 13 days ago (blimey that US mm/dd/yyyy date format is uncomfortable).
- kevcampb 10y agoIt's in the top menu bar on their technical support page. This is visible on browsers, but closed my default on mobile. I spoke to their technical support this morning (sadly my company still runs Symantec, although we are moving from it). None of them appeared to be aware of the issue.
- Jedd 10y agoSymantec have described some vulnerabilities that sound like these ones, dated 2016-06-28 (no time) here: https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 https://www.symantec.com/security_response/securityupdates/d... Detailed description and credits sections don't seem to be in complete alignment with details of OP, but I may be misreading.
- RachelF 10y agoI don't think that they have much to do with the OP. The OP's post is easy to understand, Symantec's seems to be corporate double-speak. The more important question is what should Symantec/Norton users do to prevent being exploited right now?
- paradite 10y agoThey have a separate page for "Security Advisories Relating to Symantec Products" here: https://www.symantec.com/security_response/securityupdates/list.jsp?fid=security_advisory https://www.symantec.com/security_response/securityupdates/l... The link can be found in a small line of text here: https://www.symantec.com/security_response/landing/vulnerabilities.jsp https://www.symantec.com/security_response/landing/vulnerabi...
- jacquesm 10y agoAnti virus is like a compromised immune system: it joins the other side and will help to kill the host in short order. It's a miracle these companies are still in business and it is very sad to see Peter Norton's name dragged through the mud like this over and over again.
- jezfromfuture 10y agoTime to look at preventative anti virus solutions not reactive ones Take a look at Palo traps endpoint and find an exploit
- tdullien 10y agoA note for everybody asking "why on earth does anybody run this software": When my company had to get corporate liability insurance in 2007/2008, the actual insurance contract stipulated "having AV installed on all machines". We did solve it by having an unused folder with ClamAV on every box, but I was impressed by the fact that AV is pretty much legally mandated for enterprises.
- Mango_Diesel 10y agoThis is very common in boilerplate enterprise contracts. They will often have provisions about compliance with certain security and disaster recovery standards.