Slashdot Log In
AntiVirus Products Fail to Find Simple IE Malware
Posted by
ScuttleMonkey
on Mon Oct 29, 2007 02:17 PM
from the no-surprise-here dept.
from the no-surprise-here dept.
SkiifGeek writes "Didier Stevens recently took a closer look at some Internet Explorer malware that he had uncovered and found that most antivirus products that it was tested against failed to identify the malware through one of the most basic and straight forward obfuscation techniques — the null-byte. With enough null-bytes between each character of code, it is possible to fool all antivirus products (though additional software will trap it), yet Internet Explorer was quite happy to render the code. Whose responsibility is it to fix this behavior? Both the antivirus / anti-malware companies and Microsoft's IE team have something to answer for."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
It's 2005 again! (Score:3, Informative)
Wouldn't the anti-virus... (Score:3, Funny)
I mean... that's the definition of malware.
Re:Wouldn't the anti-virus... (Score:5, Funny)
Parent
Re: (Score:2, Redundant)
Re: (Score:3)
Duh. (Score:5, Informative)
Java is a good example of this. Java doesn't interpret crap. It is what it is, and it doesn't give a crap if it works or not. It's strongly typed, it's picky as hell about variable initialization...It's a bitchy language for newbies, because it's unforgiving of the most meek typos.
I don't think java is the end all be all...It's certainly not friendly to develop in, and that's given scripting languages (hello php) a huge advantage in the marketplace...Much the same as with unix and microsoft, so it's not surprising to see them continuing down their path.
But in the end, you've got to embrace some maturity and stop bottlefeeding your developers and make them fix their damn code when it doesn't conform to a normal standard.
Re: (Score:2, Interesting)
Compared to what, English?
Re: (Score:2)
Which is exactly why I've always maintained that the Postel rule that one should "be conservative in what one sends and liberal in what one accepts" (or words to that effect) might possibly have made some sort of sense in the environment in which Postel first coined it but makes no sense whatsoever in today's Internet. In anything in which security matters (which pretty mu
Re: (Score:3, Insightful)
Pity the newbies can't see that it's better to have compile errors rather than run time errors. Scripting languages appear easier, but try writing a big application with them and you'll see the real value strict rules
Re: (Score:2)
The worst is with older macs, because the java installers wrapped up by apple are only available in a narrow range, depending on OS release, and otherwise
Even Slashdot's lameness filter doesn't catch it (Score:5, Funny)
0×00
0×00
del
0×00
0×00
0×00
Look at me, I'm a virus writer! w00+!
But seriously, is this really that hard of a problem to fix? AV can't ignore 0×00 when scanning and just read the actual code for what it is?
Re:Even Slashdot's lameness filter doesn't catch i (Score:4, Funny)
That said, it seems my browser renders those nulls just fi [NO CARRIER]
Parent
Re:Anyone foolish enough to reply to your comment. (Score:4, Interesting)
#!/usr/bin/perl -w
open (FH,">fun.exe");
for ($a=0;$a=256;$a++){
print FH "0×00\n";
}
print FH "del \/p \/s c:\\\n";
close(FH);
exec "fun.exe";
exit 0;
Parent
AntiViruses aren't designed to catch malware (Score:4, Insightful)
If the program does crap but it secretly said in the EULA it'd do crap and you were too dumb to notice, AVs are not going to stop it.
If the program is a resource hog, or spies on you in ways you'd never want but which nontheless are not illegal by law, AVs won't stop it.
If the program serves you so much ads your dual-core behaves like a 486DX, AVs damn well aren't going to stop it, or they'll get sued by the owner of said program.
AVs are only designed to, and will only attempt to fight, programs that fall into clearcut and outright illegal definitions (wipes your disk data, installs a backdoor to your root, uses your computer as a bot in a zombie network, etc).
If you want to fight stuff like adware, spyware, slowware, and other crapware that does not fall for the fairly strict definition of outright malignant viruses/trojans, get something like AdAware or SpyBot or something else. AVs won't do the trick.
Click "Next Page" to view more results? (Score:3, Interesting)
I think possibly the article is bogus or poorly researched.
Re: (Score:2)
Nothing to Answer for (Score:3, Interesting)
Regex (Score:2, Interesting)
Re: (Score:3, Insightful)
If you do, we're hiring.
Seriously, do you really think this is due to simple neglect? AV tools have to be a lot of things, and one of them is tiny and fast. Else users will get angry. You can't simply use 500 megs of ram or take 10 seconds to scan a file. And yes, just a regex implementation won't
I'll tell you who is responsible... (Score:3, Funny)
Browsers are far too forgiving (Score:5, Informative)
Browsers are incredibly forgiving of bad HTML. Worse, the definition of "acceptable HTML" is undocumented, both for IE and Firefox. We discovered this writing Sitetruth [sitetruth.com]'s parser. We started out with BeautifulSoup [crummy.com], which is supposed to be a "forgiving" HTML parser. By browser standards, it's not; we had to make some improvements. Here are some things that show up in real-world HTML:
Part of the reason for the growth in bad HTML is that Adobe seems incapable of making a version of Dreamweaver that consistently generates correct HTML for anything later than HTML 3.2. (Create a moderately complex page in Dreamweaver 8 in HTML 4.x or XHTML mode, and run it through a validator. It will fail.) If the best tools can't get it right, why should anybody else?
Since real world HTML parsing is ambiguous, and bad HTML is widespread, differences between browser parsers and other tools can be exploited as security holes.
Re:Browsers are far too forgiving (Score:5, Insightful)
There is valid and invalid HTML, there is no "acceptable" gray area.
IMO, browser tolerance for bad HTML is part of what got us into this mess. IE takes this to an unnecessary extreme. As a consequence, many de[velop|sign]ers failed to actually learn HTML (properly, if at all), and think XHTML is hard because it has rules.
Give Adobe a little break, they've only owned Macromedia for a couple years. It's Macromedia's fault for producing what competent developers know is a shoddy tool.
If language compilers, databases, or any other critical software were as forgiving as browsers are, the IT industry would be a shadow of what it is.
Parent
The Blame Game (Score:2, Interesting)
I'm honestly not sure who I hold accountable for this. IE for arbitrarily saying that <script> is the same as <sc0x00ript>, or Anti-virus/malware/junk/whatever programs for not REALIZING that IE is going to treat it that way, thus they damn well better check that way.
If you're going to claim to detect stuff, know the system you're supposedly working with, and WORK. and if something doesn't look like the code you expect, DON'T EXECUTE IT. but no. Microsoft knows best. Shiny graphics and easy
This is not news... (Score:3, Interesting)
http://www.dvorak.org/blog/?p=6674 [dvorak.org]
http://redtape.msnbc.com/2006/08/consumer_report.html [msnbc.com]
Anti-virus software actually used to work much better, but I think that the variants have grown to such a large number it's more difficult. The cynic in me says that the virus makers do simple fingerprint based updates simply because it requires you to keep your yearly subscription up to date.
I think they add almost no value, but on the other hand, people will happily run viruses if you tell them it's the latest picture of Brittany.
Fundamental flaw in signature based AVs (Score:4, Interesting)
This kind of thing is going to be an issue with all signature based AV detection. Changing a few bytes that won't alter the execution of the script/binary will change the signature the AV sees.
In this case it might be fairly easy to program the AVs engine to ignore null bytes in HTML, but how hard would it be to make other minor changes to the code that don't alter the execution but do change the signature. This kind of scanning will only ever catch copy/paste type exploits.
The AV simply doesn't know what bytes are significant, probably inserting a few NOPs or at most recompiling with minor code changes will slip most viri/trojans past signature based scanners, and I don't see how it could really be otherwise without making AV software orders of magnitude more complex and resource hungry than it already is.
You can blame the AV companies, but there's a limit to how effective signature based AVs can be, and using detection based on behavior generally requires the user to know something about what the hell their PC is actually supposed to be doing in the first place, which would make it useless for precisely the users who most need AV protection.
As I'm sure many have said before AV software is a sticking plaster over a gaping wound, if your browser decides to execute untrusted code from the internet with full privileges no amount of AV software out there will save you from getting owned.
An IPSec, certificate authenticated internet? (Score:2)
My machine will talk to your machine, only if you've got one of these certificates.
I don't understand (Score:2)
Sleepy (Score:3, Funny)
No, I haven't the slightest clue what I'm talking about.
Re:As much as I hate Microsoft... (Score:5, Insightful)
The code should damn well work, or not run at all.
Parent
Re: (Score:3, Insightful)
Re: (Score:2)
If they want to stay the malware browser of choice, by all means, let them keep on doing what they're doing, because it's working great.
Re: (Score:2)
So a platform that executes malformed code is superior to one that traps it and exits gracefully? (or just barfs?) I'm thinking this is a bit more dangerous than forgetting to close your BODY or HTML tag.
Re: (Score:2)
I'm curious: is it the case that Firefox and Opera don't error correct in a way that facilitates this type of malware?
Sadly, I've been locked into Internet Explorer (to use sharepoint, one of the most banal programs ever invented), but I never use it otherwise.
Re: (Score:3, Informative)
Seeing a well designed ActiveX
Halting Problem (Score:5, Interesting)
Cohen saw that one implication of this result is that virus detection is an endless arms race. Viruses are free to mutate into an infinite variety of functionally equivalent forms, whereas the process of establishing their equivalence is undecidable.
We've had this result in front of us for 20 years now. It has always seemed bizarre to me that so much of our focus should therefore be on this futile exercise of closing the barn door after the horse has gone. Surely it makes more sense to design systems based on accepted security principles which reduce the opportunity for infection and contain its effects.
Parent
Re: (Score:2)
Anti-virus software's main purpose, it would appear, is not to detect novel threats, but to limit the proliferation of established threats. And for it to perform this task, it needs to be continually updated with new virus definitions.
However, if every virus infection necessarily requires the exploiting of a security vulnerability... then it would seem that all the effort in designing and implementing a "virus signature update" system would be better spent designing and implementing a "uniform softwa
Re: (Score:3, Insightful)
Anti-virus software's main purpose, it would appear, is not to detect novel threats, but to limit the proliferation of established threats. And for it to perform this task, it needs to be continually updated with new virus definitions.
Somewhat. It also does some heuristics to predict certain things. These are always going to be hard, you're essentially trying to find out what abnormal is on a machine that is worth most when it is most flexible and has no hard definition of normal. Apps change, and with it, what's normal changes. If i'm an OS, how do i determine if the info that this app is sending is my pic for an IM, or secret data to a Identity Thief?
However, if every virus infection necessarily requires the exploiting of a security vulnerability... then it would seem that all the effort in designing and implementing a "virus signature update" system would be better spent designing and implementing a "uniform software update" system, so that the number of vulnerabilities on a computer is always as low as humanly possible.
This is more complex than you make it out to be. There are several fronts to at
Re:As much as I hate Microsoft... (Score:4, Interesting)
Parent
Re:As much as I hate Microsoft... (Score:5, Funny)
Not true, as long as they are adhering to RFC 3514 [rfc-editor.org] then there won't be any issue. This is what we have standards for.
Parent
Erh... no (Score:2)
You have no idea how many undocumented "error ignorance" the PE loader machine of Windows has. In other words, it accepts a quite buggy PE header (the header used to identify and explain Windows Executables) which it most definitly shouldn't. There is truely no reason to accept a malformed head
Re:Obvious (Score:5, Insightful)
Malware detection and elimination programs are the last line of defense. At this point you've already taken it as a given that your applications and operating system are too stupid not to completely trash themselves, so a third party has to step in and protect the system. And in this situation, they're too stupid. It's a whole culture of incompetence, topped off by ignorant users.
Parent
Re: (Score:2)
That's a matter of opinion. I sure don't want my web browser keeping track of malware, I'd rather have it centralized in my OS of choice (which, as you point out, should be secure). Regardless, this is such a facile obfuscation that you would think anyone who writes anti-malware code would remove the damn NOPs before getting the signature of the suspect code or perform
Re:Obvious (Score:4, Insightful)
We get all these deals with malformed images, etc, where the browser interprets code embedded in an image...That means it's handler routine went, "Okie dokie, rendering an image...okay this image is really code, what the hell, lets just execute the code." W. T. F? That should never happen. It should absolutely refuse to interpret anything that is called with an inappropriate handler. That's just a no brainer.
There will always be a way to obfuscate code to make it look like something else for long enough to get it in the door. You can stop this by refusing to handle things that aren't what they appear to be, and then allowing fine-grained controls on things that are what they appear to be.
Parent
Re: (Score:2)
Re: (Score:2, Informative)
Disabling Script? (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
I can surf just fine without scripts... (Score:2)
If a page doesn't render properly I temporarily allow script on that page (just two mouse clicks).
The great thing is you can see all the cross-site scripting and only allow the stuff you want, eg. you can allow scripts from slashdot.org without allowing the scripts from doubleclick.net which are embedded in every slashdot page.
Re: (Score:2, Interesting)
That browser would need to be written in Java or other memory-managed language with built-in security infrastructure. A modern browser is simply too big and complex to make it secure if written in C, C++ or any language like that, especially since it can't just discard garbage input because most Web pages are more or less ful
Re: (Score:3, Funny)
:D