Antivirus Software Cloud Use Exposes Customers to Data Exfiltration

itman · Jul 30, 2017

Research presented at Black Hat conference contends that at least four antivirus companies’ products use cloud sandboxes that could be exploited by malware to send out data undetected across the internet.
Click to expand...

http://www.eweek.com/security/antivirus-software-cloud-use-exposes-customers-to-data-exfiltration

Blackhat presentation: https://www.blackhat.com/docs/us-17/thursday/us-17-Kotler-The-Adventures-Of-Av-And-The-Leaky-Sandbox-wp.pdf

itman · Jul 31, 2017

Also of note from the Blackhat presentation.

ON-PREMISE AV SANDBOXES

Some AV vendors offer an alternative to cloud AV sandbox in the form of an on-premise sandbox, in which the suspicious executable can be run safely. In this configuration, the attack may still be carried out, provided that:

• The sandbox allows outbound (Internet) traffic of some sort; and

• The enterprise network configuration allows outbound (Internet) traffic from the sandbox of at least one of the protocols/traffic types allowed by the sandbox

We did not experiment with on-premise AV sandboxes. Even if we could find AV on-premise sandboxes that allow outbound traffic, the impact would be determined on a customer-by-customer basis as it depends on the enterprise network configuration as it applies to the sandbox.

Nevertheless, enterprises should be aware of this attack variant.
Click to expand...

Plus any security solution accessing the below noted cloud based bulk scanning services are vulnerable. VoodooShield, Zemana AM, are a few I know Wilders folks use:

CLOUD-BASED ANALYSIS SERVICES

There are several online services that offer analysis of binaries – either by subjecting them to multiple AV products, or by running proprietary malware analysis logic.

Google VirusTotal (https://www.virustotal.com/)
Joe Security’s Joe Sandbox Cloud - File Analyzer (https://www.file-analyzer.net/)
Payload Security’s Hybrid Analysis (https://www.reverse.it/)

We conclude that when online scanning services VirusTotal, Hybrid Analysis and Joe Sandbox Cloud (and perhaps others) are used to evaluate a binary (either manually or via a 3rd party product using these services as part of its backend), exfiltration becomes possible.
Click to expand...

guest · Jul 31, 2017

itman said: ↑

Also of note from the Blackhat presentation.

Plus any security solution accessing the below noted cloud based bulk scanning services are vulnerable. VoodooShield, Zemana AM, are a few I know Wilders folks use:
Click to expand...

It's me or they are just saying something quite obvious? If someone hacks VT and you upload VT files "your data" might be stolen... Ok

itman · Jul 31, 2017

guest said: ↑

If someone hacks VT and you upload VT files "your data" might be stolen... Ok
Click to expand...

No.

Our technique requires the following:

• The attacker’s process (malware) is running on the endpoint.
Click to expand...

Cloud-based analysis services

• VirusTotal – informed us on June 16th that they WONTFIX, and provided the following statement: "We have our sandboxes on the internet on purpose to allow them communicate with C2 machines so we record the traffic".

• Joe Security – fixed on June 19th (3d11h!) and provided the following credit acknowledgement: "Improved ISIM max UDP request config (@credits to Amit & Itzik from Safebreach)".

• Payload Security - informed us on June 23rd that "Payload Security chooses not to comment".
Click to expand...

itman · Jul 31, 2017

Another point of security interest is Win 10 native SmartScreen which does cloud base analysis. Whereas Window Defender was not vulnerable, its cloud scanning feature is a newer development introduced in ver. 1607.

itman · Jul 31, 2017

A must read in the context of this thread topic pertaining to Zemana over at Malwaretips here: https://malwaretips.com/threads/insight-into-zemanas-strange-cloud-scanning.72797/

Log in or Sign up

Antivirus Software Cloud Use Exposes Customers to Data Exfiltration

itman Registered Member

itman Registered Member

guest Guest

itman Registered Member

itman Registered Member

itman Registered Member

Log in or Sign up

Antivirus Software Cloud Use Exposes Customers to Data Exfiltration

itman Registered Member

itman Registered Member

guest Guest

itman Registered Member

itman Registered Member

itman Registered Member

Useful Searches