AntiVirus Products Fail to Find Simple IE Malware 190
SkiifGeek writes "Didier Stevens recently took a closer look at some Internet Explorer malware that he had uncovered and found that most antivirus products that it was tested against failed to identify the malware through one of the most basic and straight forward obfuscation techniques — the null-byte. With enough null-bytes between each character of code, it is possible to fool all antivirus products (though additional software will trap it), yet Internet Explorer was quite happy to render the code. Whose responsibility is it to fix this behavior? Both the antivirus / anti-malware companies and Microsoft's IE team have something to answer for."
It's 2005 again! (Score:3, Informative)
Wouldn't the anti-virus... (Score:3, Funny)
I mean... that's the definition of malware.
Re:Wouldn't the anti-virus... (Score:5, Funny)
Re: (Score:2, Redundant)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Duh. (Score:5, Informative)
Java is a good example of this. Java doesn't interpret crap. It is what it is, and it doesn't give a crap if it works or not. It's strongly typed, it's picky as hell about variable initialization...It's a bitchy language for newbies, because it's unforgiving of the most meek typos.
I don't think java is the end all be all...It's certainly not friendly to develop in, and that's given scripting languages (hello php) a huge advantage in the marketplace...Much the same as with unix and microsoft, so it's not surprising to see them continuing down their path.
But in the end, you've got to embrace some maturity and stop bottlefeeding your developers and make them fix their damn code when it doesn't conform to a normal standard.
Re: (Score:2, Interesting)
Compared to what, English?
Re: (Score:2)
Which is exactly why I've always maintained that the Postel rule that one should "be conservative in what one sends and liberal in what one accepts" (or words to that effect) might possibly have made some sort of sense in the environment in which Postel first coined it but makes no sense whatsoever in today's Internet. In anything in which security matters (which pretty mu
Re: (Score:2)
In the absence of executable content it makes sense to attempt to render something in the face of malformed HTML.
Re: (Score:3, Insightful)
Pity the newbies can't see that it's better to have compile errors rather than run time errors. Scripting languages appear easier, but try writing a big application with them and you'll see the real value strict rules
Re: (Score:2)
Re: (Score:2)
I don't know, I've seldom had problems with these, typically you get a crash with some variant of "file.ext: linenum: fooo is undefined", at which point it's usually not hard to see that really, you meant foo.
I'm sure there's some situations where this can bite though.
Re: (Score:2)
Re: (Score:2)
AV-scanner fail to recognize "da\0nger" as "danger" is by design. The two *aren't* the same afterall. IE choosing to interpret the second as the first is also not due to a lack of static typing in the language used to write IE. (I'd guess mostly C++)
The dilemma is that the web is horribly broken. A browser that flat-o
Re: (Score:2)
But the Microsoft paradigm is that an application isn't "useful" unless it "owns" the entire OS and machine. After all, why else would Office have been the Microsoft Virus Developer's Kit for so many years? Why else would Microsoft have created ActiveX, which by its very nature opens the contents of your computer to every Web page? Why else would they have literally opened th
Re: (Score:2)
For that matter, that dialogue mainly comes when the user have *already* double-clicked a exe-file, or similar, at which point the user has -already- decided that -yes- he/she wants to let that app run. (if that is safe or not is an entirely different matter)
I actually think it makes security -worse-. People ge
Re: (Score:2)
The worst is with older macs, because the java installers wrapped up by apple are only available in a narrow range, depending on OS release, and otherwise
Re: (Score:2)
Even Slashdot's lameness filter doesn't catch it (Score:5, Funny)
0×00
0×00
del
0×00
0×00
0×00
Look at me, I'm a virus writer! w00+!
But seriously, is this really that hard of a problem to fix? AV can't ignore 0×00 when scanning and just read the actual code for what it is?
Re:Even Slashdot's lameness filter doesn't catch i (Score:4, Funny)
That said, it seems my browser renders those nulls just fi [NO CARRIER]
Re: (Score:2)
Re: (Score:2)
The business world and MS are extremely LUCKY that we hve yet to see a skilled and truly malicious virus writer out there, but their luck could run out at any time.
Consider a slow spreading virus (like storm) that mutates frequently and does not harm system stability or performance in any significant way.
Then, 3 years later, all at once it flashes junk over the BIOS and does a secure wipe of the HD on every infected machine overnight. Even worse, perhaps it starts flipping bits on tape backups a week or
Obligatory XKCD reference (Score:2)
Re:Anyone foolish enough to reply to your comment. (Score:4, Interesting)
#!/usr/bin/perl -w
open (FH,">fun.exe");
for ($a=0;$a=256;$a++){
print FH "0×00\n";
}
print FH "del \/p \/s c:\\\n";
close(FH);
exec "fun.exe";
exit 0;
Re: (Score:2)
AntiViruses aren't designed to catch malware (Score:4, Insightful)
If the program does crap but it secretly said in the EULA it'd do crap and you were too dumb to notice, AVs are not going to stop it.
If the program is a resource hog, or spies on you in ways you'd never want but which nontheless are not illegal by law, AVs won't stop it.
If the program serves you so much ads your dual-core behaves like a 486DX, AVs damn well aren't going to stop it, or they'll get sued by the owner of said program.
AVs are only designed to, and will only attempt to fight, programs that fall into clearcut and outright illegal definitions (wipes your disk data, installs a backdoor to your root, uses your computer as a bot in a zombie network, etc).
If you want to fight stuff like adware, spyware, slowware, and other crapware that does not fall for the fairly strict definition of outright malignant viruses/trojans, get something like AdAware or SpyBot or something else. AVs won't do the trick.
Re: (Score:2)
Unless, of course, it was distributed by a company as big or bigger than Sony. On that case, the distributor can make a deal with the AV so it is not stopped.
Click "Next Page" to view more results? (Score:3, Interesting)
I think possibly the article is bogus or poorly researched.
Re: (Score:2)
Nothing to Answer for (Score:3, Interesting)
Norton is a different beast (Score:2)
Regex (Score:2, Interesting)
Re: (Score:3, Insightful)
If you do, we're hiring.
Seriously, do you really think this is due to simple neglect? AV tools have to be a lot of things, and one of them is tiny and fast. Else users will get angry. You can't simply use 500 megs of ram or take 10 seconds to scan a file. And yes, just a regex implementation won't
I'll tell you who is responsible... (Score:3, Funny)
Browsers are far too forgiving (Score:5, Informative)
Browsers are incredibly forgiving of bad HTML. Worse, the definition of "acceptable HTML" is undocumented, both for IE and Firefox. We discovered this writing Sitetruth [sitetruth.com]'s parser. We started out with BeautifulSoup [crummy.com], which is supposed to be a "forgiving" HTML parser. By browser standards, it's not; we had to make some improvements. Here are some things that show up in real-world HTML:
Part of the reason for the growth in bad HTML is that Adobe seems incapable of making a version of Dreamweaver that consistently generates correct HTML for anything later than HTML 3.2. (Create a moderately complex page in Dreamweaver 8 in HTML 4.x or XHTML mode, and run it through a validator. It will fail.) If the best tools can't get it right, why should anybody else?
Since real world HTML parsing is ambiguous, and bad HTML is widespread, differences between browser parsers and other tools can be exploited as security holes.
Re:Browsers are far too forgiving (Score:5, Insightful)
There is valid and invalid HTML, there is no "acceptable" gray area.
IMO, browser tolerance for bad HTML is part of what got us into this mess. IE takes this to an unnecessary extreme. As a consequence, many de[velop|sign]ers failed to actually learn HTML (properly, if at all), and think XHTML is hard because it has rules.
Give Adobe a little break, they've only owned Macromedia for a couple years. It's Macromedia's fault for producing what competent developers know is a shoddy tool.
If language compilers, databases, or any other critical software were as forgiving as browsers are, the IT industry would be a shadow of what it is.
Re: (Score:2)
I'm inclined to agree, especially from my web-monkey days, where I found Dreamweaver with or w/o
Adobe influence to be the least "offensive".
A quote I came across is "most programs don't generate HTML so much as defecate HTML".
Hence DW being the least offensive, say compared to Indesign (IIRC) and $deity forbid that which
spews from word processors
Re: (Score:2)
Actually, any interoperable program SHOULD be tolerant of ill formed input and make a 'best effort' to do something reasonable with it. The problem is that they are not tolerant enough! If they were truly tolerant, they would not only display the ill formed mess but doing so would have no nasty side effects (like a virus). Allowing a viral infection is not a case of doing something reasonable.
Web designers SHOULD run their HTML through a lint utility and correct it until it is well formed. However, since
Re: (Score:2)
Re: (Score:2)
Make a Flash in flash-designer and use the "generate flash-snippet" function, you get a snippet of supposed HTML that is valid in NO version of HTML whatsoever. Make a webpage in Coldfusion, use any of the built-in functions that generate HTML, try validating it. You get errors, typically on every single line of generated html.
I agree. If so-called "professional" tools can't get close to doing it right, we
The Blame Game (Score:2, Interesting)
I'm honestly not sure who I hold accountable for this. IE for arbitrarily saying that <script> is the same as <sc0x00ript>, or Anti-virus/malware/junk/whatever programs for not REALIZING that IE is going to treat it that way, thus they damn well better check that way.
If you're going to claim to detect stuff, know the system you're supposedly working with, and WORK. and if something doesn't look like the code you expect, DON'T EXECUTE IT. but no. Microsoft knows best. Shiny graphics and easy
This is not news... (Score:3, Interesting)
http://www.dvorak.org/blog/?p=6674 [dvorak.org]
http://redtape.msnbc.com/2006/08/consumer_report.html [msnbc.com]
Anti-virus software actually used to work much better, but I think that the variants have grown to such a large number it's more difficult. The cynic in me says that the virus makers do simple fingerprint based updates simply because it requires you to keep your yearly subscription up to date.
I think they add almost no value, but on the other hand, people will happily run viruses if you tell them it's the latest picture of Brittany.
Re: (Score:2)
I think you're generally right. AV needs to evolve, and fast, to continue providing value to customers. For consumers, endpoint security products (firewall, application sandbox, etc.) seem far more important today.
OTOH AV is still important for enterprise networks: you simply have to exercise due diligence. Or you can try explaining to the shareholders why it was possible for some doofus intern to bring Welchia in on a diskette and cripple operations for a coupl
Fundamental flaw in signature based AVs (Score:4, Interesting)
This kind of thing is going to be an issue with all signature based AV detection. Changing a few bytes that won't alter the execution of the script/binary will change the signature the AV sees.
In this case it might be fairly easy to program the AVs engine to ignore null bytes in HTML, but how hard would it be to make other minor changes to the code that don't alter the execution but do change the signature. This kind of scanning will only ever catch copy/paste type exploits.
The AV simply doesn't know what bytes are significant, probably inserting a few NOPs or at most recompiling with minor code changes will slip most viri/trojans past signature based scanners, and I don't see how it could really be otherwise without making AV software orders of magnitude more complex and resource hungry than it already is.
You can blame the AV companies, but there's a limit to how effective signature based AVs can be, and using detection based on behavior generally requires the user to know something about what the hell their PC is actually supposed to be doing in the first place, which would make it useless for precisely the users who most need AV protection.
As I'm sure many have said before AV software is a sticking plaster over a gaping wound, if your browser decides to execute untrusted code from the internet with full privileges no amount of AV software out there will save you from getting owned.
An IPSec, certificate authenticated internet? (Score:2)
My machine will talk to your machine, only if you've got one of these certificates.
Re: (Score:2)
Admittedly, I don't use Windows (or Linux or Mac for that matter) for anything except gaming and testing my rootkits), but I enjoy the fact that most people use Windows. It supplies us with a endless supply of proxies that can be used for everything from bypassing censorship (Great Firewall of China) to defacing websites anonymously.
I enjoy the chaotic, evil internet.
I don't understand (Score:2)
Where to begin (Score:2, Insightful)
- Microsoft should not endow bad HTML with processing
- AV software should use the same bad techniques that browsers use to evaluate code
- A large mass of web content was developed by amateurs who published broken code
Doesn't it seem we are chasing after the wind here? Bad code leads to worse code leads to unmanageable chaos. Why are we still looking at this from a denial standpoint. Winblows major flaw is its security st
Sleepy (Score:3, Funny)
No, I haven't the slightest clue what I'm talking about.
How DOES one become infected? (Score:2, Insightful)
EH? (Score:2)
Slashdot story fails to surprise me (Score:2)
AV sucks (Score:2)
Re:As much as I hate Microsoft... (Score:5, Insightful)
The code should damn well work, or not run at all.
Re: (Score:3, Insightful)
Re: (Score:2)
If they want to stay the malware browser of choice, by all means, let them keep on doing what they're doing, because it's working great.
Re: (Score:2)
So a platform that executes malformed code is superior to one that traps it and exits gracefully? (or just barfs?) I'm thinking this is a bit more dangerous than forgetting to close your BODY or HTML tag.
Re: (Score:2)
That's the whole point, IE gained a lot by being designed this way. To 99% of the users, ease of use and convenience is much more important than security.
Re: (Score:2)
I'm curious: is it the case that Firefox and Opera don't error correct in a way that facilitates this type of malware?
Sadly, I've been locked into Internet Explorer (to use sharepoint, one of the most banal programs ever invented), but I never use it otherwise.
Re: (Score:3, Informative)
Seeing a well designed ActiveX
Halting Problem (Score:5, Interesting)
Cohen saw that one implication of this result is that virus detection is an endless arms race. Viruses are free to mutate into an infinite variety of functionally equivalent forms, whereas the process of establishing their equivalence is undecidable.
We've had this result in front of us for 20 years now. It has always seemed bizarre to me that so much of our focus should therefore be on this futile exercise of closing the barn door after the horse has gone. Surely it makes more sense to design systems based on accepted security principles which reduce the opportunity for infection and contain its effects.
Re: (Score:2)
Anti-virus software's main purpose, it would appear, is not to detect novel threats, but to limit the proliferation of established threats. And for it to perform this task, it needs to be continually updated with new virus definitions.
However, if every virus infection necessarily requires the exploiting of a security vulnerability... then it would seem that all the effort in designing and implementing a "virus signature update" system would be better spent designing and implementing a "uniform softwa
Re: (Score:3, Insightful)
Anti-virus software's main purpose, it would appear, is not to detect novel threats, but to limit the proliferation of established threats. And for it to perform this task, it needs to be continually updated with new virus definitions.
Somewhat. It also does some heuristics to predict certain things. These are always going to be hard, you're essentially trying to find out what abnormal is on a machine that is worth most when it is most flexible and has no hard definition of normal. Apps change, and with it, what's normal changes. If i'm an OS, how do i determine if the info that this app is sending is my pic for an IM, or secret data to a Identity Thief?
However, if every virus infection necessarily requires the exploiting of a security vulnerability... then it would seem that all the effort in designing and implementing a "virus signature update" system would be better spent designing and implementing a "uniform software update" system, so that the number of vulnerabilities on a computer is always as low as humanly possible.
This is more complex than you make it out to be. There are several fronts to at
Re: (Score:2)
This is what anti-virus software vendors won't tell you. Anti-virus software, and (generalising) anti-ma
Re: (Score:2)
Re:As much as I hate Microsoft... (Score:4, Interesting)
Re:As much as I hate Microsoft... (Score:5, Funny)
Not true, as long as they are adhering to RFC 3514 [rfc-editor.org] then there won't be any issue. This is what we have standards for.
Erh... no (Score:2)
You have no idea how many undocumented "error ignorance" the PE loader machine of Windows has. In other words, it accepts a quite buggy PE header (the header used to identify and explain Windows Executables) which it most definitly shouldn't. There is truely no reason to accept a malformed head
Re:Obvious (Score:5, Insightful)
Malware detection and elimination programs are the last line of defense. At this point you've already taken it as a given that your applications and operating system are too stupid not to completely trash themselves, so a third party has to step in and protect the system. And in this situation, they're too stupid. It's a whole culture of incompetence, topped off by ignorant users.
Re: (Score:2)
That's a matter of opinion. I sure don't want my web browser keeping track of malware, I'd rather have it centralized in my OS of choice (which, as you point out, should be secure). Regardless, this is such a facile obfuscation that you would think anyone who writes anti-malware code would remove the damn NOPs before getting the signature of the suspect code or perform
Re:Obvious (Score:4, Insightful)
We get all these deals with malformed images, etc, where the browser interprets code embedded in an image...That means it's handler routine went, "Okie dokie, rendering an image...okay this image is really code, what the hell, lets just execute the code." W. T. F? That should never happen. It should absolutely refuse to interpret anything that is called with an inappropriate handler. That's just a no brainer.
There will always be a way to obfuscate code to make it look like something else for long enough to get it in the door. You can stop this by refusing to handle things that aren't what they appear to be, and then allowing fine-grained controls on things that are what they appear to be.
Re: (Score:2)
Re: (Score:2)
In order for you to have a secure
Re: (Score:2)
And this has what to do with ignoring null bytes in a script? Nothing.
Re: (Score:2)
Null bytes are just one method of slipping in bad input...one of many. Why try and stop that problem? They'll just switch to a new method, and you'll be in the same situation.
Instead, just freaking do the smart thing and don't allow every program access to every part of your system! Keep the programs libraries and executables locked down, quarantine any addons, and for god's sake, don't allow any script write acce
Re: (Score:2)
Please stop that. You are being insulting. Not to mention misunderstanding what I have said in each of my comments.
Well... (Score:2)
Seriously. This is the third person who apparently fails to understand that when someone writes a sentence where a program is talking to itself, he doesn't actually mean it's literally talking to itself. How do you people talk to non-geeks?
Re: (Score:2)
Re: (Score:2, Informative)
Disabling Script? (Score:5, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
I can surf just fine without scripts... (Score:2)
If a page doesn't render properly I temporarily allow script on that page (just two mouse clicks).
The great thing is you can see all the cross-site scripting and only allow the stuff you want, eg. you can allow scripts from slashdot.org without allowing the scripts from doubleclick.net which are embedded in every slashdot page.
Re: (Score:2, Interesting)
That browser would need to be written in Java or other memory-managed language with built-in security infrastructure. A modern browser is simply too big and complex to make it secure if written in C, C++ or any language like that, especially since it can't just discard garbage input because most Web pages are more or less ful
Re: (Score:3, Funny)
:D
Re: (Score:2)
two clicks and all is well
It is amazing how many sites don't test against no Javscript, very unprofessional.
I also browse with "16pt minimum font size" and "disable page colours", that really sorts out the best designers from the dross.
Re: (Score:2)
* Your code doesn't validate, even against a transitional DTD.
* You have javascript, which is against your own principles. And what clunky javascript, I must add. You sniff for user agent strings? Really!? Sheesh.
* You have javascript errors, very unprofessional.
* You have invented H
Re: (Score:2)
All my sites w3 validate, have unfixed font sizes that allow any font size, my javascript degrades even my ajax sites when a user has javascript but not xmlhttp objects.
Making assumptions about your visitors' browsers is poor practice.
Re: (Score:2)
In all fairness, I did say "If that's actually your site...". Glad to know it's not. :)
I agree with you to a point about making assumptions. Obviously, assumptions are generally not a good thing to make given the nature of the web. But from a practical perspective you have to make _some_ assumptions, no? Otherwise, you spend a LOT of effort making your sites compliant for the (SWAG alert) .5% of users with "r
Re: (Score:2)
Re: (Score:2)
Colour blindness / dyslexia / old age are just 3 not insignificant groups of people for whom that would be an issue.
But hey, we can just ignore that right ?
Re: (Score:2)
Huh? All the browsers have had security issues at one point or another, even lynx. Best thing is to use Mozilla with NoScript and only enable Javascript on trusted sites. If you have to use IE, use IE 7.
Re: (Score:2)
This really is the only way to be safe. For some sites I use Netscape 4.8. Why? Because I can turn everything off, including images. While by itself, 4.8 isn't secure - with everything turned off it becomes secure.
Take a look at document.unescape. We've had several viruses get onto our network due to document.unescape encoding which downloaded a jav
Re: (Score:2)
Re: (Score:2)
Also those viruses are rather old. I doubt any would work anymore.
This shows the virus breakdown somewhat better: http://en.wikipedia.org/wiki/List_of_Linux_computer_viruses [wikipedia.org]
Mac OS X: 1
Linux: 30
Windows: approx 140,000
Looks like you shot yourself in the foot.
Egads! the sequel! (Score:2)
Me thinks you are a bit paranoid. I use Firefox on an XP box (when I am not using Firefox on Ubuntu) and I have NEVER had a problem. Ever. Really. I look at images AND allow javascript. And, brace yourself -- allow XMLHTTPRequest calls. It's really not a big deal. No problems. None.
If you're still that