7 ms·

I'm leaning towards the browser vendors on this one, AV software has been sloppy and has been known to enlarge the attack surface area. Here's an example from e

I'm leaning towards the browser vendors on this one, AV software has been sloppy and has been known to enlarge the attack surface area. Here's an example from earlier this year. https://securityintelligence.com/news/bad-medicine-symantec-antivirus-comes-with-easy-exploit/ https://securityintelligence.com/news/bad-medicine-symantec-... @VessOnSecurity whines about a lack of hooks for AV to hang on in Google Chrome, but kind of laughs at the hooks that Microsoft Office offers (we didn't need them anyway, we read before Office opens the file, etc.) That cavalier attitude makes me uncomfortable.

Bartweiss 10y ago
It also seemed pretty dubious that Vess kept hammering the "insecure because we lack hooks" point, while skipping the repeatedly-raised issue that AV itself is usually full of shoddy, high-risk code. A couple of the most-used AV products are infamous for not just using dirty access, but being so poorly-executed that the AV is what enables escalation in the first place.
- mhurron 10y ago
  Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about something specific? The lack of hooks into the browser is brought up because without them AV has to do these weird things to scan the content browsers are happily loading from untrusted sources. If you use an AV product that scans network activities that is.
  - tcoppi 10y ago
    Most software you use doesn't inject shoddy, high-risk code into nearly every running process on your system and the kernel, though.
    - smcl 10y ago
      ... and on top of it, most software doesn't claim to make things safer while demonstrably making them worse
      - Bartweiss 10y ago
        Yes, this. Most software is crappy, and much if it is insecure, but most of it adds value somewhere. If my music player compromises my computer, at least it plays music the rest of the time. If my antivirus compromises my computer... well, adding security was its only job. I'm happy to criticize shoddy code when it causes the product to fail at its sole purpose.
  - staticassertion 10y ago
    > Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about something specific? Most software doesn't run with full system privileges, go out of its way to interact with malicious content, and inject itself all over the system. The difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The hooks into the browser are nothing. It isn't the hooking, though that's not great. Imagine Chrome provided an API. OK, so now the AV listens to the API. It sees you open some file in the browser that's XML - it parses the XML. It gets exploited, trivially, because many vendors explicitly disable security features like stack cookies. Now the attacker went from a sandboxed environment to a full system privileges process.
    - mhurron 10y ago
      So because of a future possibility of exploit, don't do anything which is one cause of the existing argument. I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > Most software doesn't run with full system privileges For most people, yes it does. > go out of its way to interact with malicious content Your browser also does. > difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The browser pretty much wins here too. But no, it's AV vendors fault your browser is such a risk.
      - witty_username 10y ago
        > For most people, yes it does. Examples? > I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > The browser pretty much wins here too. Chrome is tightly sandboxed; any exploit in Chrome is very unlikely to compromise your OS.
      - Bartweiss 10y ago
        So many responses here, but mostly: "Most software doesn't run with full system privileges", "For most people, yes it does." That's not even a little true. Even inexperienced Windows users have to click that little "permission to make changes" button, and sometimes "run as administrator". Winamp, Solitaire, and all your other random not-totally-secure programs don't offer kernel access to whoever compromises them. AV is a singularly good source of privilege escalation attacks for exactly that reason.
  - mfukar 10y ago
    No, you're wrong, and like Vess, you're deflecting the issue. Lack of hooks into anything in the system is completely orthogonal to: - increasing code that runs with elevated privileges in a system - running untested, buggy parsing code with elevated privileges in the system - inject ROP gadgets in every process in the system - isolating your code's components to contain the risk of vulnerabilities in your own code
    - mhurron 10y ago
      AV has to do what it does to inject itself between the internet and the browser because the browser provides no better way to work with it. If there was a better way and AV continued to do these things, complaining that AV is doing these things would be valid.
      - maxerickson 10y ago
        I think the premise is that broken AV doing nothing would be better than broken AV injecting itself into the browser. So to get past that premise, you have to remove the "broken" part before the method of injection matters.
        Bartweiss 10y ago
        Yep, this is it. AV is fundamentally a security product. If my music player is insecure, it's still playing music and I'll lose that feature by uninstalling it. If my AV is insecure, there's really no downside to uninstalling it.
      - acdha 10y ago
        Those are separate issues: security experts would worry less about AV software hooking things if the AV developers were demonstrably following secure coding practices. Instead, they're generally shipping 90s-style C code and not following good practice like using sandboxing or other defense in depth measures, which is how you get things like a single exploit in a format decoder granting kernel access: https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... Contrast with the kind of exploit chains usually required on securely-designed systems like iOS or modern apps like Chrome where they need to chain multiple exploits together to escape from the sandbox before being able to attack something else. The AV industry has earned that bad reputation by generally being unwilling to spend the money needed to apply modern practice.
wyldfire 10y ago
> @VessOnSecurity whines about a lack of hooks I think that "Antivirus" arrived as a bandaid during the decades when security was taken seriously by some consumers but not by the OS/app software vendors. It started out as "inspect the system for signatures of malicious executables" and evolved to include "clever active mechanisms to avoid infection." I think that there should be no need for the "active mechanisms to avoid infection" part and that is ultimately the responsibility of the OS/app vendors. Unfortunately, through their inaction, OS/app vendors have allowed an industry to arrive. This industry will be reluctant to forfeit their position. Clearly if they think they're entitled to some consideration in the browser design, they will not go away without a fight.
- m12k 10y ago
  'Bandaid' is going easy on them - what AV is selling is an antipattern. "Blacklist the bad executables" is so obviously ineffective and ultimately infeasible compared to "whitelist the good executables"
  - sambe 10y ago
    I'm no fan of AV (I think they've totally failed to improve quality for decades, and now live off of fear-mongering) and not an expert but that seems too harsh. At the time this arrangement was designed, getting any kind of automatic software update was unusual, let alone regular updates or communication back to the update system. It's hard to imagine an AV doing this successfully at the time. What if the user installs a new version of a program and you have no internet connection? Ask them? Do you trust their answer? At the same time, the number of unique new viruses was substantially smaller and slower-spreading so easier to "detect" (it was never clear to me how much "detection" really happened vs pure signature matching).
    - indolering 10y ago
      It's shameful that OS security updates still aren't applied automatically and AV was useful when viruses were simple. However, AV vendors started pushing heuristics that look for things like contacting IRC servers. Any application that moves large amounts of data around will run into hash collisions and developers have to run around asking to be added to a whitelist. These heuristics do not scale and mislead consumers into thinking that their computer is safe because it has antivirus. In reality, we need to re-architect operating systems to be safer.

Bartweiss 10y ago

It also seemed pretty dubious that Vess kept hammering the "insecure because we lack hooks" point, while skipping the repeatedly-raised issue that AV itself is usually full of shoddy, high-risk code. A couple of the most-used AV products are infamous for not just using dirty access, but being so poorly-executed that the AV is what enables escalation in the first place.

mhurron 10y ago
Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about something specific? The lack of hooks into the browser is brought up because without them AV has to do these weird things to scan the content browsers are happily loading from untrusted sources. If you use an AV product that scans network activities that is.
- tcoppi 10y ago
  Most software you use doesn't inject shoddy, high-risk code into nearly every running process on your system and the kernel, though.
  - smcl 10y ago
    ... and on top of it, most software doesn't claim to make things safer while demonstrably making them worse
    - Bartweiss 10y ago
      Yes, this. Most software is crappy, and much if it is insecure, but most of it adds value somewhere. If my music player compromises my computer, at least it plays music the rest of the time. If my antivirus compromises my computer... well, adding security was its only job. I'm happy to criticize shoddy code when it causes the product to fail at its sole purpose.
- staticassertion 10y ago
  > Most of the software you use is complete and utter shit full of shoddy, high-risk code. Do we need to bring that up every time when we are talking about something specific? Most software doesn't run with full system privileges, go out of its way to interact with malicious content, and inject itself all over the system. The difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The hooks into the browser are nothing. It isn't the hooking, though that's not great. Imagine Chrome provided an API. OK, so now the AV listens to the API. It sees you open some file in the browser that's XML - it parses the XML. It gets exploited, trivially, because many vendors explicitly disable security features like stack cookies. Now the attacker went from a sandboxed environment to a full system privileges process.
  - mhurron 10y ago
    So because of a future possibility of exploit, don't do anything which is one cause of the existing argument. I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > Most software doesn't run with full system privileges For most people, yes it does. > go out of its way to interact with malicious content Your browser also does. > difference between AV and any other shitty software is that AV is massively more useful and abundant as attack surface. The browser pretty much wins here too. But no, it's AV vendors fault your browser is such a risk.
    - witty_username 10y ago
      > For most people, yes it does. Examples? > I suggest you uninstall Chrome if that is your view, it too will lead to a full system compromise in the future, I mean it will in the future yet again. > The browser pretty much wins here too. Chrome is tightly sandboxed; any exploit in Chrome is very unlikely to compromise your OS.
    - Bartweiss 10y ago
      So many responses here, but mostly: "Most software doesn't run with full system privileges", "For most people, yes it does." That's not even a little true. Even inexperienced Windows users have to click that little "permission to make changes" button, and sometimes "run as administrator". Winamp, Solitaire, and all your other random not-totally-secure programs don't offer kernel access to whoever compromises them. AV is a singularly good source of privilege escalation attacks for exactly that reason.
- mfukar 10y ago
  No, you're wrong, and like Vess, you're deflecting the issue. Lack of hooks into anything in the system is completely orthogonal to: - increasing code that runs with elevated privileges in a system - running untested, buggy parsing code with elevated privileges in the system - inject ROP gadgets in every process in the system - isolating your code's components to contain the risk of vulnerabilities in your own code
  - mhurron 10y ago
    AV has to do what it does to inject itself between the internet and the browser because the browser provides no better way to work with it. If there was a better way and AV continued to do these things, complaining that AV is doing these things would be valid.
    - maxerickson 10y ago
      I think the premise is that broken AV doing nothing would be better than broken AV injecting itself into the browser. So to get past that premise, you have to remove the "broken" part before the method of injection matters.
      - Bartweiss 10y ago
        Yep, this is it. AV is fundamentally a security product. If my music player is insecure, it's still playing music and I'll lose that feature by uninstalling it. If my AV is insecure, there's really no downside to uninstalling it.
    - acdha 10y ago
      Those are separate issues: security experts would worry less about AV software hooking things if the AV developers were demonstrably following secure coding practices. Instead, they're generally shipping 90s-style C code and not following good practice like using sandboxing or other defense in depth measures, which is how you get things like a single exploit in a format decoder granting kernel access: https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... Contrast with the kind of exploit chains usually required on securely-designed systems like iOS or modern apps like Chrome where they need to chain multiple exploits together to escape from the sandbox before being able to attack something else. The AV industry has earned that bad reputation by generally being unwilling to spend the money needed to apply modern practice.

wyldfire 10y ago

> @VessOnSecurity whines about a lack of hooks I think that "Antivirus" arrived as a bandaid during the decades when security was taken seriously by some consumers but not by the OS/app software vendors. It started out as "inspect the system for signatures of malicious executables" and evolved to include "clever active mechanisms to avoid infection." I think that there should be no need for the "active mechanisms to avoid infection" part and that is ultimately the responsibility of the OS/app vendors. Unfortunately, through their inaction, OS/app vendors have allowed an industry to arrive. This industry will be reluctant to forfeit their position. Clearly if they think they're entitled to some consideration in the browser design, they will not go away without a fight.

m12k 10y ago
'Bandaid' is going easy on them - what AV is selling is an antipattern. "Blacklist the bad executables" is so obviously ineffective and ultimately infeasible compared to "whitelist the good executables"
- sambe 10y ago
  I'm no fan of AV (I think they've totally failed to improve quality for decades, and now live off of fear-mongering) and not an expert but that seems too harsh. At the time this arrangement was designed, getting any kind of automatic software update was unusual, let alone regular updates or communication back to the update system. It's hard to imagine an AV doing this successfully at the time. What if the user installs a new version of a program and you have no internet connection? Ask them? Do you trust their answer? At the same time, the number of unique new viruses was substantially smaller and slower-spreading so easier to "detect" (it was never clear to me how much "detection" really happened vs pure signature matching).
  - indolering 10y ago
    It's shameful that OS security updates still aren't applied automatically and AV was useful when viruses were simple. However, AV vendors started pushing heuristics that look for things like contacting IRC servers. Any application that moves large amounts of data around will run into hash collisions and developers have to run around asking to be added to a whitelist. These heuristics do not scale and mislead consumers into thinking that their computer is safe because it has antivirus. In reality, we need to re-architect operating systems to be safer.