18 ms·
AvastSvc.exe contains a full, unsandboxed JavaScript/DOM implementation
- bluesign 7y agoI don’t have access to windows machine, but what does ‘full’ mean in the title? Like can it open outgoing network connections? Can load remote code?
- tbrock 7y agoThe readme shows it runs as SYSTEM which means it can write to disk and make network calls, etc.
- pilif 7y agowell. the process that contains the JS engine can. The JS engine itself seems to be limited to what JS engines in browsers can normally do, so no intentional file system access. However as the README says, this is a custom built implementation, built by a company who believes running a JS engine with SYSTEM privileges is a good idea. This means that there are probably exploits available and those do get full access to the system as the highest privileged user.
- TeMPOraL 7y agoAnd, let me guess - this JS scan is a part of their "web protection" stuff that runs on the websites you browse? Because that would mean attackers can drive-by exploit a lot of people with a bit of malicious script attached to an ad.
- saagarjha 7y ago> That service loads the low level antivirus engine, and analyzes untrusted data received from sources like the filesystem minifilter or intercepted network traffic.
- makach 7y agothis can't be good for avast. I used them earlier but have stopped using them after seeing windows defender becoming better.
- makach 7y agoit's a valid question! From the github the author writes "Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage. Any vulnerabilities in this process are critical, and easily accessible to remote attackers."
- numpad0 7y agoI’d assume whether this runs escalated or not is considered not relevant
- saagarjha 7y agoI see strings for XMLHTTPRequest and this runs unsandboxed, so I'm not feeling too good about this.
- gallexme 7y agoThat it uses a Javascript runtime to check for malicious Javascript code, which could be used to write malicious files which expect avast to scan it, then the anti-virus scans and if it thinks it's worth to interpret the Javascript, runs it to check what it does, if u escape that interpreter u can run code as basically the windows equilavent of root
- Gravyness 7y agoBut... javascript never allowed computer files to be read? Or are you saying that also include NodeJS? What exactly can javascript do? Fetch data from the internet?
- saagarjha 7y agoThe JavaScript interpreter runs with SYSTEM privileges. A bug allowing for code execution would inherit those and thus be able to do a number of malicious things.
- Godel_unicode 7y agoHave a UAF in the DOM code which allows a shellcode payload to run with SYSTEM.
- saagarjha 7y agoUnrelated: https://github.com/taviso/loadlibrary https://github.com/taviso/loadlibrary It lets you call Windows DLL functions from Linux!
- joosters 7y agoMaybe post unrelated links as their own HN stories?
- saagarjha 7y agoWell, I don't really post Hacker News stories, and given that this was one of the first links on the page, I felt someone might find it interesting. (It also indirectly tells people that they can try the thing on Linux…)
- jfk13 7y agoWell, I hadn't seen that before and thought it's pretty cool, so I posted it in case others might also find it interesting: https://news.ycombinator.com/item?id=22544777 https://news.ycombinator.com/item?id=22544777
- jwilk 7y agoIt's not unrelated. It's part of the source (as a submodule), and linked from README.
- nly 7y agoThe other way to do this would be to compile a test harness using winelib, since winelib compiled applications call in to both native and Windows DLL code. https://wiki.winehq.org/Winelib_User%27s_Guide https://wiki.winehq.org/Winelib_User%27s_Guide I've done this myself to exercise a COM DLL from Linux. I had to use Microsofts "OLE/COM Object Viewer" to extract the IDL from the DLL and then compile everything with MIDL and wine-g++, but it worked.
- jbverschoor 7y agoFor as long as I can recall, visusscanners are malware itself.
- codegladiator 7y agoAnti-virus softwares are the Anti-vaxers of digital world. Falsely believing they are in the correct group and benefiting the society.
- TeMPOraL 7y agoAntivirus software today exists only so that tech support scammers can install something on their victims' computers, and then point to it to prove they were not scamming anyone.
- 411111111111111 7y agoHasn't always been like that however. I think it's only became like that after the built-in malware detection of Windows 10 became good enough so the antivirus ventors started adding "features" to make themselves stand out and look good on Enterprise comparison charts. Thinking back on the Windows XP days... You'd be in actual danger if you didn't use one.
- jeltz 7y agoSure, while they actually caught malware back in the XP days, they were also still malware and some probably spied on their customers even back then. So back then it was about picking your poison.
- mothsonasloth 7y agoI am unable to replicate this on Windows 7 x64 (yes I know I should upgrade, but I am a crusty ol' XP user)
- Causality1 7y agoYesterday on W10 I had to create registry keys to run an installer because the normal ways of unblocking the executable were simply missing off the menus. I miss Windows 7 every goddamned day.
- Kipters 7y agoThere's a cmdlet for that https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7 https://docs.microsoft.com/en-us/powershell/module/microsoft...
- quietbritishjim 7y agoOr you can right click on the file in explorer, choose properties, uncheck the checkbox at the bottom (I forget the text in it, sorry) then click OK.
- Causality1 7y agoThat's the problem. The executable was missing the Unblock checkbox despite throwing an "app has been blocked for your protection" pop-up.
- dathinab 7y agoIf I remember correctly there is a version of Windows 10 which has server restrictions on what you can do, including it fully blocking "untrusted" installs. In turn it's a bit cheaper. But I'm not sure what they named it, maybe that was related to it. Also it's not uncommon for Windows to be able use features your version didn't had through the command line. Edit: sorry swipey keyboard messed up some words.
- joshumax 7y agoI don't expect much from anti-malware companies, but this is one of those moments that made me absolutely dumbfounded that someone actually thought embedding an entire un-sandboxed JS engine with SYSTEM privileges was in any way a good idea. I actually had to get out of bed, open IDA, and start a Windows VM just to check that this wasn't some sort of elaborate hoax! This isn't some MIDI parser logic, it's an entire JS interpreter that can parse DOM elements! How in Earth did this even get pushed out to a release? Did we learn nothing since the last time [1]? 1: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- saagarjha 7y agoPsst…there's a Linux harness to load the DLL.
- LeoNatan25 7y agoBecause low-effort JS developers are now everywhere. Just as JS should not be found in the server yet is now prevalent, JS is now finding its way into other places where it shouldn't be. You can't have an entire industry push this terrible ecosystem, then expect security companies to miss out on the fun. Locating and hiring C++ engineers at a scale is something that has become very, very difficult.
- jeltz 7y agoAs much as I am tired of the crappy code produced by some JS developers this time they are innocent. If you had read the article you would have known that the JS code executed here is JS found on the Interent, not any JS written by Avast. The bugs are in Avast's C++ code (or possibly C).
- saagarjha 7y ago> If you had read the article you would have known that the JS code executed here is JS found on the Interent, not any JS written by Avast. I think this makes it worse.
- JyB 7y agoIsn't Avast is the same software that auto-includes a signature inside all the mails you send? Without a browser extension.
- tjpnz 7y agoHas antivirus always been this sloppy? I recall a time in the 90s/early 2000s where the engineers working on these products were considered the best in the business.
- dathinab 7y agoActually yes, in the (old) past they where not only "sloppy" but some (view?) where even malicious in _creating_ a virus which only theire program could handle (but which also didn't do much damage besides annoying the user). Through instead of sloppy I would say it's often more on the line of misguided about what is secure and _overconfident_ about their own skill to write code without security vulnerabilities. And if the are no vulnerabilities no sandboxing is needed right (sarcasm). Through there where and hopefully still are exceptions to this. But don't ask me which ones because I haven't been on Windows for a long time.
- self_awareness 7y ago> Actually yes, in the (old) past they where not only "sloppy" but some (view?) where even malicious in _creating_ a virus which only theire program could handle (but which also didn't do much damage besides annoying the user). Do you have any proof for that or you just like bullshtting people so you appear knowledgable?
- heartbeats 7y ago> in the (old) past they where not only "sloppy" but some (view?) where even malicious in _creating_ a virus which only theire program could handle (but which also didn't do much damage besides annoying the user). You know what, I don't even care if this is made up, it's a great story anyway. It would be a great plot for a movie. Ivan Vladimirovich is a Soviet computer hacker who creates computer viruses on behalf of AntivirusCorp. One day, he gets a mission that will come to change his life forever...
- dtech 7y agoIt seems like quality lowered over time for several reason. 1) free products became popular, reducing revenue, 2) increased automatic updates and better Windows safety models reduced need and 3) Windows defender became decent around Windows 10 so other offerings became redundant.
- dd82 7y agoSecurity theater at work
- jpxw 7y agohttps://www.avast.com/bug-bounty https://www.avast.com/bug-bounty Have at it
- Gravyness 7y agoWhat can a unsandboxed javascript engine do? can you read files? read data from my computer's memory? Send my credit card info to the internet? Is this reading my chrome's profile data or running Node in any way? Access my camera/microphone/keyboard? I fail to see how this is a problema and I've been programming with javascript for 8 years...
- hibbelig 7y ago> What can a unsandboxed javascript engine do? It can do everything that the user could do, and the user in this case is SYSTEM. I understand SYSTEM can do everything. It could install a keylogger, for instance.
- giantDinosaur 7y agoThis runs as SYSTEM, which is the highest privilege set in Windows. Yes, a vulnerability will result in absolutely everything you asked about.
- jaclaz 7y agoTo be picky, not the highest privilege, System is prevented from doing things that TrestedInstaller can do. Hence the existence of a number of Windows tools to get TrustedInstaller privileges, some examples listed in this thread: https://msfn.org/board/topic/181190-how-to-overwrite-dll-file-in-system32/ https://msfn.org/board/topic/181190-how-to-overwrite-dll-fil...
- jeltz 7y agoIf the js engine has no bugs it cannot do anything harmful, but since this is Avast's own custom engine it likely has security bugs which allow malicious JS code to escape the engine, and if it does it can do virtually anything with your machine since the engine runs as SYSTEM. Writing your own JS engine and then running it as SYSTEM is terrible engineering and very dangerous. There is no reason for why they have to run it as SYSTEM.
- tgtweak 7y ago
- ComradeUlyanov 7y agoMost third-party AV software today is useless adware/bloatware. On my Windows machine I rely on Windows Defender + MBAM, never had any malware infection.
- Trellmor 7y agoSomeone [1] mentioned this hash d0e7e0e0287cd5a6ee36c74557ebf70f38235f90c8ce07c75d49721e379503aa [2] for Tavis to have a look at. Another AV company that ships a js interpreter? 1) https://mobile.twitter.com/buherator/status/1237115773409206272 https://mobile.twitter.com/buherator/status/1237115773409206... 2) https://www.virustotal.com/gui/file/d0e7e0e0287cd5a6ee36c74557ebf70f38235f90c8ce07c75d49721e379503aa/summary https://www.virustotal.com/gui/file/d0e7e0e0287cd5a6ee36c745...
- saagarjha 7y agoA search suggests it's Norton?
- pilif 7y agoThe real tragedy is that there are still "security" standards bodies mandating that AV software is installed on clients. If you want to be PCI-DSS compliant for example then you better install AV software. Even worse, sometimes the requirements go even farther and require the AV software to be third-party - OS built-in solutions don't count. At this point, the only safe solution is running proper whitelisting to make sure that only authorized binaries get to run and to keep those binaries up-to-date and, if possible, sanboxed. If you have such a setup and then you have to install AV like this because of security-theatre, you're making your security much, much worse (because in order to run AV, you have to whitelist it and because AV is apparently written to quality standards that allow running arbitrary user-supplied JS as SYSTEM)
- dTal 7y agoWho defines what "AV" is? Isn't your whitelisting solution also an "antivirus"?
- detaro 7y agoPretty much every definition defines antivirus as software that inspects files and attempts to decide if they are malware or not (and then blocks access etc).
- _jal 7y ago> (and then blocks access etc) Not so much. I'm required to run AV software on production Linux systems. All it does is write opinions to a log. Insofar as the only reason we run it is checkbox-compliance, I'm fine with it being useless - certainly not asking for some kernel module or something that could actually block access. But I do find it funny.
- SamuelAdams 7y agoNIST actually defines most of these standards and definitions. "Antivirus Software" has two: A program specifically designed to detect many forms of malware and prevent them from infecting computers, as well as cleaning computers that have already been infected. A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. [1]: https://csrc.nist.gov/glossary/term/Antivirus-Software https://csrc.nist.gov/glossary/term/Antivirus-Software
- bluesign 7y agoI managed to run sample app on linux box. Observations: - I am not sure this is 'full' javascript engine. I am thinking more inline with static-eval [0] Example 1: Date.now() returns 'Exception: undefined' Example 2: console.log([1, 2, 3].map(function(x) { return x; })) returns 'Exception: function(x) { return x; }' - I couldn't manage to access DOM document.write("<h1 id='x'>html</h1><script>console.log(document.getElementById('x'));</script>"); returns empty - After reversing DLL little bit, seems like it is used as unpacker ( also it has VBA support ) Still can be some vulnerabilities, but saying running full Javascript/DOM implementation is 100% wrong [0] https://github.com/browserify/static-eval https://github.com/browserify/static-eval
- saagarjha 7y agoIt doesn't have a bunch of standard functions (or they're not hooked up correctly?) but it is very much evaluating input.
- convivialdingo 7y agoThanks for bringing some facts to the discussion.
- minitech 7y agoMy first assumption on seeing Date.now() throw would be that it’s implementing an older standard. new Date().getTime() would be the ES3 equivalent.
- Leace 7y agoVery nice writeup! It contains a link to Avast's Coordinated Vuln Disclosure site: https://www.avast.com/coordinated-vulnerability-disclosure https://www.avast.com/coordinated-vulnerability-disclosure and this has a link to Avast PGP key that's served via unencrypted HTTP: http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt Not only that, the key is a weak 1024 bit DSA key :(
- MarioMan 7y agoI'm hoping this isn't a dumb question, but why does it matter that a public key is public-facing and unencrypted?
- jurgemaister 7y agoIf someone intercepted the communication, they could swap the Avast key for their own, allowing them to decrypt your message.
- Leace 7y agoWhat jurgemaister said. If you don't have another trust mechanism (like Web of Trust) to validate if this is a correct key then HTTPS gives at least some assurance that no intermediaries between you and avast changed the key material.
- ksec 7y agoJust wondering, Has it got anything to do with [1] Sciter, the UI Library many AV software are using? [1] https://sciter.com https://sciter.com
- cmiles74 7y agoI wouldn't be surprised if Sciter comes bundled with a VM for running JS, but it's not explicit on their website. They do position themselves an an alternative to Electron. And it looks like every anti-virus package uses this product. "In almost 10 years, Sciter UI engine has become the secret weapon of success for some of the most prominent antivirus products on the market: Norton Antivirus and Internet Security, Comodo Internet Security, ESET Antivirus, BitDefender Antivirus, and others. The use of HTML/CSS has allowed their UI to stay in touch with modern GUI trends throughout all these years, and will continue to well into the future. Sciter Engine is a single, compact DLL of 5+ Mb in size. Application using it are 10+ times smaller than the ones built with Electron or Qt. And size of the distribution matters, one of main Sciter’s customers discovered “golden 40 seconds” rule: for the user, to buy a product, it should not take more than 40 seconds from the click on “download” button to the UI to appear on screen." --- As mentioned by others, this would be separate from the JavaScript VM mentioned in the OP and would not run as a privileged account (it would just be the UI people interact with).
- detaro 7y agoAlthough one would not expect UI components in the privileged service component.
- alibert 7y agoWith my limited knowledge on the matter, NOD32 (ESET) has 3 processes : ekrn.exe (SYSTEM), eguiProxy.exe (User) and egui.exe (User). egui.exe is responsible of the UI interacting with the user and seems to not be running at all if the user never brings up the UI. Considering the memory usage of the UI (~25 MB), looks like they choose to run a very lightweight UI (tray icon only) with eguiProxy.exe (2 MB) then start egui.exe if the user brings up the UI. To be noted: the memory usage of the UI is almost the same as ekrn.exe which I suppose is the AV engine (1) [1] I don't run the full suite and some features have been disabled (SSL MITM, web inspection and email inspection)
- detaro 7y ago> Last week, 3/4 @taviso reported a vulnerability to us in one of our emulators, which in theory could have been abused for RCE. On 3/9 he released a tool to simplify vuln. analysis in the emulator. Today, to protect our hundreds of millions of users, we disabled the emulator. https://twitter.com/avast_antivirus/status/1237685343580753925 https://twitter.com/avast_antivirus/status/12376853435807539...
- trulyrandom 7y agoApparently Avast has now disabled the JavaScript interpreter for all of their users: https://twitter.com/taviso/status/1237745571009409029 https://twitter.com/taviso/status/1237745571009409029.
- 0xDEEPFAC 7y agoTypical modern application development. "Javascript all the the things" because "we can make good UIs!" with no regard for safety, speed, or reliability.
- wnevets 7y agoUsing a third party antivirus solution in 2020 just sounds like a bad idea.
- deleted 7y ago[deleted]