According to Koret, at the very least, the antivirus industry needs to adopt techniques like privilege separation and sandboxing, but more is needed to truly secure antivirus products.
Many such programs are vulnerable to man-in-the-middle attacks because they don’t use SSL/TLS for communication and the components they download are often not signed. They don’t implement any of the anti-exploitation measures that modern browsers have and they don’t use emulation to scan executable files or use memory-safe languages, he said via email.
Even worse, evidence suggests that many antivirus products are not even properly audited for security flaws, Koret said. “For example, looking at the vulnerabilities discovered by Tavis Ormandy, it’s absolutely clear that they never audited the software at all because such vulnerabilities would be detected by an auditor during the first assessment in, probably, one week.”
Privilege levels
To the extent possible, antivirus vendors should run their products with the least privilege, should sandbox sensitive functionality, and should ensure an overall solid secure code maturity, said Carsten Eiram, chief research officer at vulnerability intelligence firm Risk Based Security (RBS).
Since 1 January, 2010, some 1,773 vulnerabilities have been reported in security software and devices – 372 in 2015 – and the majority of them were exploitable through input manipulation, according to data from RBS.
“Security vendors should be held to higher secure coding standards,” Eiram said. “It’s embarrassing when basic fuzzing uncovers a slew of vulnerabilities in parsing functionality, which has been a known culprit for years. It’s even more embarrassing when said parsing functionality is done with SYSTEM privileges.”
For the most part antivirus vendors feel that process sandboxing is not applicable to antivirus products because it would hurt performance. Some claim that they are taking other steps, such as reducing privileges, performing routine security assessments, and developing other technologies that might have the same effect as sandboxing.
Symantec is working to reduce the attack surface of its products and services. Its approach, the company said, is to operate its security components at the lowest privilege level possible to reduce the likelihood of a successful attack.
Effectively addressing vulnerabilities is more complicated than using just one technology, according to Kaspersky Lab. The company implements the technologies it believes will provide the best level of protection to customers. For example, it’s using machine learning algorithms to leverage the large amount of security intelligence and knowledge that it acquires.
“Despite the perceived simplicity of the ‘sandbox’ approach, it has a number of serious drawbacks, affecting performance, efficiency and compatibility,” said Kaspersky’s Zakorzhevsky.
Intel Security/McAfee said that when it learns of a potential issue, it immediately investigates to determine its validity, nature and severity and to develop a fix.
Flaw fixing
No one is arguing that antivirus vendors are not fixing flaws fast enough when they are found. In fact, some of them have impressive response times and their products are configured to automatically update themselves by default. The problem is the number and type of flaws that exist in such products in the first place.
Symantec and Intel Security declined to address more specific questions about sandboxing, the likelihood of attacks against antivirus products, the effectiveness of such products in detecting targeted attacks, or other criticism raised by security researchers.
Antivirus vendor Bitdefender said that a sandbox similar to the one provided by Google wouldn’t be a viable engineering solution for a security product. “An antimalware solution would have to intercept and sandbox thousands of system events a second, which would bring a dramatic performance impact to the system and which might be greater than what the operating system vendor tolerates.”
The company claims that most of its products’ components such as the antimalware engine and the Active Threat Control subsystem already run with the privileges of the logged-in user, and that it’s using brokering processes to limit the number of components running with system privileges, even in the consumer products.
On the business side, the company developed a solution called Gravity Zone that allows administrators to run the scanning service on a different machine on the network instead of the endpoint and it also recently introduced Hypervisor-based Memory Introspection (HVMI) technology that completely isolates the antimalware solution by deploying it in a Type 1 hypervisor outside of the operating system.
“This kind of isolation separates the antimalware engines from rootkits or exploits running in the user environment,” the company said.
Avast did not respond to repeated requests for comment, while Malwarebytes, AVG and ESET declined to comment for this story or failed to send any responses before publication despite being given ample time.
Risk vs reward
The large and easy to exploit attack surface introduced by antivirus products combined with the likelihood of targeted attacks, raises the question of whether it’s even worth installing such programs in some enterprise environments.
Some researchers doubt the effectiveness of endpoint antivirus products when faced with sophisticated and carefully engineered malware programs like those used by cyberespionage groups. Their view is that there’s little reward compared to the risk, especially for organisations from industries that are commonly targeted by such attackers.
“Antivirus products can only be used, from my viewpoint, as protection tools for rather small companies and home users,” Koret said. Antivirus products cannot detect what is unknown, regardless of what they advertise, and evading antivirus detection is trivial and something that most malware developers test before releasing their malicious code, he said.
Ollmann, who has been a long-time critic of endpoint antivirus products, believes that the security protections increasingly built into operating systems will eventually render such programs obsolete.
Subscribers 0
Fans 0
Followers 0
Followers