5 ms·
Attackers spread backdoor via eScan antivirus software update process
- jerbear4328 2y agoI'm interested to know how eScan, a security company, never noticed that they were using http to distribute executables to customer devices for so long.
- deleted 2y ago[deleted]
- mistrial9 2y agoplenty of critical services use HTTP -- maybe exactly because they are critical.. think the scenarios through and that may make more sense..
- capitainenemo 2y agoCommon enough to use it.. linux distros frequently distribute updates over http (and ftp). But those are always signed. Something eScan did not do.
- febeling 2y agoCan’t you switch out the signatures inflight, too?
- beagle3 2y agoIf it’s based on asymmetric encryption, (e.g. RSA, DH etc) and the private key did not leak, then no.
- DaSHacka 2y agoAFAIK, the worst you could do is serve the victim stale (valid) packages, and prevent them from seeing that there are new updates available. I maintain a (somewhat) popular mirror server at a university, and we actually ran into this issue with one of our mirrors. The Tier 1 we were using as an upstream for a distro closed up shop suddenly, leaving our mirror with stale packages for some time before users told us they never got any updates.
- capitainenemo 2y agoI don't think that would work with most distros, since you're fetching an (also signed) update list and you'd get notified that the update failed due to a stale list, or that the expected updated package was missing on the mirror.
- jijijijij 2y agoYou could, but then the signature check would fail. Usually the public keys of developers or packagers are shipped with a linux distribution. However, you shouldn't blindly trust in this in "linux" either. The implementation varies between package managers. Eg. DNF in Fedora has signature checks not enabled for local package installations, by default. There is no warning, nothing. If you want to infect new Fedora users, you MITM RPMFusion repo (codecs etc) installation, because that's a package almost everyone installs locally and the official install instructions don't show how to import the relevant keys beforehand. Arch was also very late to the validation party.
- capitainenemo 2y agoHow is Arch vulnerable? While I don't have an Arch system handy, I do have a steam deck that I play around with (in an overlay), and I've certainly run into a lot of signature issues due to Valve making a hackish "pin" of the evergreen Arch with signatures in the Valve tree's snapshot being often out of date. Those signatures are also checked for local installs unless you explicitly disable them.
- jijijijij 2y agoPacman has signature checks by default, for over a decade now, I think, but they have been ridiculously late with universal usage of this feature, relatively speaking. They were still barebacking their machines, when everybody trivially knew the internet was serious business and expected signature checks, therefor.
- febeling 2y agoI realize now it was a stupid question, but the excellent refresher and ensueing discussion of edge cases was well worth the downvote someone felt compelled to leave, haha
- jamespo 2y agoI'd hope these other critical services at least sign their packages
- cryptonector 2y agoYes. But IIRC there have been attacks on Debian package fetching anyways.
- seiferteric 2y agoSomewhat ironically OCSP.
- cryptonector 2y agoThis has to do with circularity. If you are building a TLS library that needs to fetch OCSP Responses dynamically, you might not have an easy time using HTTPS to do it. Well, obviously you'd have to disable the use of OCSP for validating the OCSP Responder's TLS server certificate, but still you have a re-entrance requirement, and anyways the OCSP Responses are signed. (Or, well, you could use OCSP to validate an OCSP Responder's TLS certificate if you had code to detect a circular dependency, then stop and consider it validated. This would allow the use of OCSP for validating OCSP Responder TLS server certs where ultimately you could use HTTP for a non-privacy-sensitive certificate or where you could elide OCSP Responder TLS server cert validation but still use HTTPS to fetch OCSP Responses so as to provide confidentiality about the server names you're visiting.) The main reason to want to use HTTPS for fetching OCSP Responses has to do with privacy rather than security relative to active attacks. It's probably time to revisit this.
- lupusreal 2y agoSeems like criminal negligence to me.
- hermannj314 2y agoIf an Uber Eats driver poisons your food en route from McDonalds, then McDonalds is criminally negligent? I mean, I understand HTTPS is industry best practice but the criminals in this story are the actual criminals.
- NegativeLatency 2y agoAll analogies are flawed but this feels a bit more like the tamper proof labels on products, the antivirus company threw some chicken in a produce bag, and called it good. At this point a lot of antivirus software is just useless or actively harmful.
- yborg 2y agoAvast actually had a trojan horse product whose main purpose was collecting browsing history for sale to data brokers ... that you paid a subscription fee for. https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-ban-avast-selling-browsing-data-advertising-purposes-require-it-pay-165-million-over https://www.ftc.gov/news-events/news/press-releases/2024/02/...
- lupusreal 2y ago> I understand HTTPS is industry best practice Right. Unlike your McDonalds example, there is already an industry standard solution to this problem. The software ""engineers"" who neglected to implement it should be found criminally negligent for the harm they caused to their users. I know this is an unpopular suggestion on HN because code monkeys want all the glory of the "engineer" job title without any of the responsibility.
- robocat 2y ago> The software ""engineers"" should be found criminally negligent Software goes across borders. Perhaps you also think negligent software "engineers" should be extradited or rendered across jurisdictions? Apart from the fact that Engineer does not have to imply either certified or licenced (the words you should be using if you know anything).
- andmarios 2y agoSome customers actually ask for it. The correct behavior is to have https as the default and have the user explicitly switch to http.
- nucleardog 2y agoOr just validate the binary you download then none of this even matters—for this or any other sort of potential vulnerability, your updater will never end up running untrusted software with escalated privileges. HTTPS is providing confidentiality, and authentication. The confidentiality doesn’t really matter here. You’re distributing a software installer. There’s a good chance you’ll give a copy to anyone that visits your website and wants to use your software. And you’re not hiding what you’re downloading in any meaningful way. The authentication is important. That prevents someone from, say, sending the user a completely different binary and having your software run it. The authentication could just as easily be solved by signing the files you distribute and validating the signature of the downloaded update before running it. (Hell, if you’re signing your installers (likely) it could be as simple as deferring to Windows’ WinVerifyTrust method and a check that the certificate used is actually your own.) Debian still distributes packages primarily over HTTP (https://www.debian.org/mirror/list https://www.debian.org/mirror/list) without issue.
- radicaldreamer 2y agohttp or https doesn't matter (in fact, you shouldn't rely on it because the end user could be MITM'd already with a root certificate maliciously installed on their device). You should sign binaries and verify and consider the network/distribution method compromised by default.
- dixie_land 2y agoIf the user is MITM'd, what's preventing the attacker also replace the signature to verify against?
- kuhsaft 2y agoThe signature would use asymmetric encryption, so unless the attacker had access to the signing key, it would be impossible for the attacker to sign a modified version of the payload. EDIT: I see what you mean. radicaldreamer stated that a malicious root certificate is installed, but signature validation wont help there. But, it will help when downloading from mirrors or HTTP.
- pixl97 2y agoYou verify against the signature that's in the current version. Now this may mean that you need to do stepped upgrades to versions that are cross signed to get new certificates. That or you have at least one https update method that gets a signing cert for the application.
- littlestymaar 2y agoAnd how do you ensure the integrity of “the signature that's in the current version”? Because live patching the signature in a program to force verification of an invalid payload is exactly how many software/game cracks work.
- pixl97 2y agoI mean, if you can't verify the integrity of the application you're already running then it's already game over. You're talking about downloading another executable and running it to life patch which is the exact opposite of what I'd suggest. The currently running (trusted) executable downloads and verifies the signature of the binary. Then after verification you execute it. If your trusted binary is validating invalid data then you've already messed up somewhere.
- wannacboatmovie 2y ago[flagged]
- deleted 2y ago[deleted]
- jms703 2y agoMakes one wonder how poorly designed the software is. Like most antivirus software, it's probably not very good.
- deleted 2y ago[deleted]
- microtherion 2y agoIn my entire career, I've yet to encounter a virus as deleterious in its effect than some of the antivirus software I've seen (Though, having had minimal Windows experience may contribute to this experience). I've spent literally hours explaining to my users that no, my software was not distributed with a virus; one popular anti virus program had a false positive flagging it as such.
- teeray 2y agoI really love when “endpoint security tools” feel the need to examine every object file and debugging symbol a compiler emits. It really improved the build times /s
- radicaldreamer 2y agosecurity theater
- deleted 2y ago[deleted]
- eviks 2y agoThere are public cases of ransomware crippling the whole org for days. Do you have examples of the similar effect of antivirus?
- wnevets 2y agoIf you're gonna use an antivirus just use Windows Defender. There really isn't a reason to use anything else these days.
- londons_explore 2y agoIs Windows Defender really effective in 2024? You would think any virus designer would design their stuff in a way that the default antivirus built into the product they are attacking wouldn't be able to find it... And before you say "well duh, but signature updates", I will respond with the fact that nearly malware is designed to auto-update... And will obviously make sure that the windows defender signatures fail to auto-update...
- Rinzler89 2y ago>Is Windows Defender really effective in 2024? Relative to what? The question is: are the competitors more efective in 2024 for the money you pay VS the built-in solution, while also using less resources to boot that Defender? That's the question people and bean-counters ask before pulling out their wallets.
- Voultapher 2y agoIt certainly ain't the question the IT department is asking in my experience.
- mleo 2y agoDo you know what’s better than one antivirus software? Two antivirus softwares. I would not want to calculate the extra cost of additional servers to handle loads from each server just wasting cpu running AV software.
- aetch 2y agoYou forgot the /s
- wnevets 2y ago
- johncessna 2y agoDid the editor reign in the original headline?
- fullspectrumdev 2y agoThis whole vector (serving malicious updates via MiTM) has been well known for the longest time, with even frameworks such as Evilgrade for exploiting them. Such an oversight from a “security” company is frankly unforgivable.
- soraminazuki 2y agoAntivirus being not only inherently ineffective, but actively undermining the security of the system through negligence and poor practices. Often tampering with other software and negating actual security hardening measures along the way. Has anything changed this past decade or two? https://ia801200.us.archive.org/1/items/SyScanArchiveInfocon/SyScan%202014%20Singapore/SyScan%202014%20presentations/SyScan2014_JoxeanKoret_BreakingAntivirusSoftware.pdf https://ia801200.us.archive.org/1/items/SyScanArchiveInfocon... https://robert.ocallahan.org/2017/01/disable-your-antivirus-software-except.html https://robert.ocallahan.org/2017/01/disable-your-antivirus-...
- parl_match 2y agoAnti Virus is a net good, although the entire OS industry understands that it is an outdated way of thinking about endpoint protection. You could say what you said about lots of software, including almost anything with a built in updating feature. That in mind, there's no reason to use anything but Windows defender on Windows (unless youre a high value target)
- soraminazuki 2y agoNo, the same can't be said about other software. No other kind of software runs with kernel privileges and goes out of its way to touch everything within sight, be it files, sockets, devices, or processes. No other kind of software disables or gets in the way of implementing hardening measures of other security critical software. No other kind of software messes with browsers and OSes, and at the same time, invest so less in making its architecture and implementation at least as secure as the thing they're messing with. Well, maybe except other user hostile software like malware and DRM. Antiviruses dramatically increase the attack surface of the system, both in theory and practice. Even an antivirus without the flaws isn't much useful. It's in essence solving the halting problem. Only worse because instead of determining whether a program halts, antiviruses seek to determine whether a program is "bad." A vague criteria that even human beings have trouble defining let alone come up with an algorithm for it. Many of these issues are inherent to antiviruses. Windows Defender, coming from an OS vendor, may perhaps be better in terms of implementation. However, even good implementations can’t overcome fundamental problems that stem from the very idea of the software itself.