Researchers Turn Antivirus Software Into Destructive Tools

guest · Apr 23, 2020

Researchers Turn Antivirus Software Into Destructive Tools
A vulnerability impacting nearly all antivirus products
April 23, 2020
https://www.securityweek.com/researchers-turn-antivirus-software-destructive-tools

Most antivirus software performs a “real time scan” of unknown files saved to disk and, if considered suspicious, these files are either moved to a secure location to be quarantined, or deleted from the system.

The issue, the researchers say, resides in the fact that there’s a small time window between the file scan and the cleanup operation, and that almost all antivirus software performs operations with the highest level of authority within the operating system.

“Therein lies a fundamental flaw as the file operations are (almost) always performed at the highest level which opens the door to a wide range of security vulnerabilities and various race conditions,” RACK911 Labs notes.
The attack, the researchers say, can be performed via a directory junction in Windows, or through a symlink in Linux and macOS.
Click to expand...

“In our testing across Windows, macOS & Linux, we were able to easily delete important files related to the antivirus software that rendered it ineffective and even delete key operating system files that would cause significant corruption requiring a full reinstall of the OS,” RACK911 Labs says.
The researchers also reveal that, in some cases, they identified file permission and ownership changes that could have allowed for privilege escalation.

RACK911 Labs, which published proof of concept for both attack scenarios, as well as a list of antivirus programs that were tested and found vulnerable, says that it started notifying vendors in the fall of 2018, and that most of them patched their products, with only a few exceptions.
Click to expand...

RACK911 Labs: Exploiting (Almost) Every Antivirus Software

JohnBurns · Apr 23, 2020

What are the exceptions? Per the article, "Most of the antivirus vendors have fixed their products with a few unfortunate exceptions."

guest · Apr 25, 2020

mood said: ↑

RACK911 Labs: Exploiting (Almost) Every Antivirus Software
Click to expand...

Updated (April 24, 2020):

April 24, 2020 Update:
Almost every antivirus vendor mentioned on this page is now patched with the exception of a few, who will likely have patches out shortly given the media attention. The goal of this disclosure was not to name and shame vendors, but to bring attention to how easy it was to leverage the antivirus software to become destructive tools.

We have received questions about lesser-known antivirus software not listed on this page and all were found to be vulnerable. It is our goal that not just antivirus vendors, but all software vendors check their code for potential directory junction and symlink style attacks; They are so easy to perform and as demonstrated on this page, can be incredibly dangerous!
Click to expand...

guest · Apr 25, 2020

Symlink race bugs discovered in 28 antivirus products
Most products have patched, researchers said, without naming the ones who skipped
April 24, 2020
https://www.zdnet.com/article/symlink-race-bugs-discovered-in-28-antivirus-products/

Security researchers from RACK911 Labs said in a report published this week that they found "symlink race" vulnerabilities in 28 of today's most popular antivirus products.

A symlink race vulnerability takes place when you link a malicious and a legitimate file together, and end up executing malicious actions on the legitimate file. Symlink race vulnerabilities are often used to link malicious files to higher-privilege items, resulting in Elevation-of-Privilege (EoP) attacks.

"It's a very real and old problem with operating systems that allow concurrent processes," Dr. Bontchev told ZDNet. "Many programs have been found to suffer from it in the past."
This means this type of bug can only be used as a second-stage payload in a malware infection, to elevate privileges, to disable security products, or to sabotage computers in a destructive attack.
Click to expand...

For now, the majority of the bugs that RACK911 found in antivirus products have been fixed. However, variations could be easily discovered. Symlink race condition bugs have been some of the oldest and hardest to mitigate bugs in applications in the past decades, across all operating systems[1, 2].
Click to expand...

Azure Phoenix · Apr 25, 2020

From what I understand, this seems to be case as to why antiviruses need to have good web protection.

Log in or Sign up

Researchers Turn Antivirus Software Into Destructive Tools

guest Guest

JohnBurns Registered Member

guest Guest

guest Guest

Azure Phoenix Registered Member

Log in or Sign up

Researchers Turn Antivirus Software Into Destructive Tools

guest Guest

JohnBurns Registered Member

guest Guest

guest Guest

Azure Phoenix Registered Member

Useful Searches