Avast: a Chromium fork with critical security checks removed

https://code.google.com/p/google-security-research/issues/detail?id=679

by andygambles • 10 years ago

232 118 10 years ago

code.google.com

willvarfar• 10 years ago

Why does anyone use any third-party anti-virus programs these days? Why not just use the Microsoft ones that are free?

lqdc13• 10 years ago

You mean security essentials?

temp• 10 years ago

Why not just use the Microsoft ones that are free? reply

For one thing, last time I checked benchmarks they showed that Microsoft's anti-virus not only has worse detection results but also worse performance than some of the free alternatives.

infogulch• 10 years ago

I am very interested in seeing these benchmarks, as my anecdotal experience is the complete opposite.

noja2• 10 years ago

I don't know why this comment is being downvoted. A quick google will show the results.

Page 9 of the latest report: http://www.av-comparatives.org/summary-reports/

ryanlol• 10 years ago

Yeah, but the detection rates suck for every single AV.

Slightly better snake oil is still snake oil.

Nutmog• 10 years ago

Why is "worse" not OK but "better" is? Neither can be perfect and both will be far better than nothing. Just making up some numbers, but if the Windows AV can detect 80% of viruses and Norton can detect 90%, then you're still vulnerable to that last 10% whatever you do. You're also still protected from the majority of viruses whatever you do too.

stephengillie• 10 years ago

Every antivirus has exploits. Having one installed just opens more doors for attackers to hit your PC.

ordinary• 10 years ago

It closes some too. Anti-virus software does not have to be perfectly secure (not to be confused with providing perfect detection!). To have a net positive impact on computer security, all anti-virus software has to be is quite literally better than nothing. That's by no means a given, but neither is the opposite: that using anti-virus is by definition worse than not using it.

untog3• 10 years ago

For one, because they come preinstalled. I bought a normal Windows laptop for a relative recently, it came with a 30 day trial of McAfee (I think) pre-installed. Once you install any anti-virus, the MS one is automatically disabled, so new users are given the impression that they need to fork out for a subscription once the 30 days is up, or lose virus protection.

It's an utter racket.

heywire• 10 years ago

Even more, Microsoft and the OEMs don't really go out of their way to explain this choice to customers. I work with a senior software engineer who recently came to me for help with his new PC after having purchased the full version of the included anti-virus software. He seemed surprised when I asked why he wouldn't just stick with the built in software from Microsoft. So I sent him a link from Microsoft's site explaining about Windows Firewall and Defender. He later told me he felt stupid for having been convinced that he had to purchase the full version of what came on the system or else he would be unprotected. I think it is Microsoft who is stupid for not pushing this message harder, especially in light of the recent developments such as this one. In some of these cases, we're seeing that by installing a third-party anti-virus suite, you're actually reducing the security of your system. I think Microsoft should be concerned that these companies are actually hurting their reputation further.

bitJericho2• 10 years ago

I would never buy a computer for/with someone without reinstalling a clean version of Windows onto the machine.

You have no idea where that computer's been before you.

aleem• 10 years ago

Microsoft has strategic reason not to suffocate the other AVs completely. It's better to have multiple companies attack viruses on multiple fronts. If McAfee and ilk went away completely the onus would lie entirely on Microsoft.

Laptop manufacturers are also to blame because product bundling and bloatware are nothing new.

Microsoft on their part could make it so that Defender worked alongside McAfee but that might encourage users to buy McAfee even more, arguably (double the protection or not knowing they are already protected).

anon4• 10 years ago

From what people I've talked to have told me - they don't trust Microsoft to secure the OS.

Plus, e.g. Comodo gives you a firewall. While I know that Windows has a perfectly good firewall, it doesn't come with a systray icon with a button labeled "protection from active network probes: active" or whatever.

Personally, I just have a router between me and the big bad internet and use Security Essentials plus Common Sense 2012.

jmnicolas• 10 years ago

Warning your Common Sense 2012 is outdated, you should buy the new 2016 version ;-)

douche• 10 years ago

They can't be bothered to do things that are actually effective, like reading installation dialogs fully, installing an ad-blocker, and avoiding the downloads from the sketchiest of porn and torrent sites.

untog3• 10 years ago

It isn't (just) laziness. A friend of mine downloaded Google Chrome because they knew it was a secure browser to use... except that the search result page provided them with a poisoned installed full of malware.

If you're not technically inclined there are minefields everywhere.

213• 10 years ago

I'll give you an interesting example. I was one day coding a keylogger for testing purposes. 100% original C++ code written by me based on Win32 API docs.

Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message.

Microsoft built in antivirus doesn't have this kind of behavioral detection protections.

throwaway2048• 10 years ago

the reason this is mostly useless is malware writers can do the same test with every AV and just evade the heuristics.

AnthonyMouse3• 10 years ago

Compiled and ran the code and immediately Bitdefender blocked the program and put up a "Keylogger detected" message.

Which is quite problematic because it was a false positive. You knew and wanted that program to log key presses.

That's the trouble with aggressive heuristics. Users are going to have a program that translates keyboard layouts by hooking the key presses. Or software that comes with some fancy input device.

Then the antivirus says it's a keylogger even though they know it isn't and the user is taught to expect good rather than bad things when they press "allow" against a something-is-wrong prompt.

drzaiusapelord2• 10 years ago

MS Security Essentials detection rates are pretty poor, historically. Considering excellent products like Avast are free for the home user, I don't see why we'd recommend the MS one.

To be fair, MS has recognized this and has been steadily improving detection rates. It has only recently been able to outdo Avast or AVG. Hopefully, this trend will continue. I imagine MS is under a lot of pressure to contain the Cryptolocker-type infections and the bad press of the past couple years is probably a motivator.

http://www.alphr.com/security/6745/best-free-antivirus-of-20...

ubercow13• 10 years ago

excellent products like Avast

Isn't this claim somewhat refuted by the very article you are posting against? There are other comments in this thread that explain why this doesn't make any sense eg pilif's above[1]

[1] https://news.ycombinator.com/item?id=11058688

AdmiralAsshat• 10 years ago

You ever noticed that these "secure" forks of browsers put out by antivirus companies are usually security trainwrecks?

cf: "Chromodo" and the vulnerabilities disclosed by this same researcher[0]

[0] https://code.google.com/p/google-security-research/issues/de...

EDIT: And let's not forget TrendMicro's recent blunder with the enabled-by-default HTTP server for "Password Manager" that is installed as part of their antivirus program.[1]

[1] https://code.google.com/p/google-security-research/issues/de...

mrweasel• 10 years ago

Which makes you wonder about the quality of the products they develop 100% in-house.

In the case of the browsers, it "only" the bits they tampered with that's more insecure. For their own stuff, anti-virus, firewall and what not, they've "tampered" with the entire code base.

jacquesm3• 10 years ago

Worse still, that stuff hooks into you OS at just about every level.

jpgvm2• 10 years ago

In my experience non-OSS security software is not worth having. There are some exceptions but they are exactly that, exceptions. More often then not by installing this garbage you are putting yourself in a worse position than not having it at all.

iancarroll• 10 years ago

To be fair, I doubt they know the Chromium code base as well as they know their own (also why they shouldn't fork it.)

click170• 10 years ago

Which makes you wonder about the quality of the products they develop 100% in-house.

You might be interested in reading up on tavis Ormandy and his adventures with Sophos antivirus. He was able to find several holes in sav with [allegedly] very little effort. Which was especially comical because they could be used to pwn Sophos' network firewall product which is used by enterprises.

Stratoscope• 10 years ago

I've lost weeks of my life to hacking around problems caused by antivirus software.

Oh, I got paid for the time, but which is more satisfying and looks better on my resume: "Hacked around antivirus bugs" or "Built a cool and awesome feature"? :-)

Here's my previous rant on the topic with specific details:

https://news.ycombinator.com/item?id=10248084

And a mention of one of the debugging techniques that was helpful here:

https://news.ycombinator.com/item?id=10250001

bengoodger• 10 years ago

I know most consumers don't really care about this stuff until it bites them, but products like this are supposedly (I guess) marketed to consumers who care about security. I think it's worth it to be skeptical of claims made by any vendor, and ask some key questions:

- what changes have been made in the fork? - can I (or people in the software development community) see the source code? - what peer review policies are applied to changes made in the fork? - when (not if) something goes wrong, what policies and mechanisms are in place to fix it?

... just to name a few. No software is perfect. No engineer is perfect. There will always be bugs. There should just be an expectation that people will take reasonable precautions.

sarciszewski8• 10 years ago

http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf

Anti-Virus is little more than snake oil. If you need to secure a Windows box, get EMET and read http://decentsecurity.com and you'll eliminate most of your attack surface.

    Everyone can be secure.
    
    It is with those four words this website is founded. Computer, smartphone, 
    and online security does not require a degree or years of experience. All 
    it requires is someone show you the way.
    
    You've been sold a lie. You can't buy computer security. It is something 
    obtained through configuration and knowledge. Tragically, these aren't even 
    hard to do or obscure to learn. But no one makes money telling you how to 
    use what you already have. What you need is someone who doesn't care about
    your money or looking smart by spouting off fancy words of no consequence -
    just that you not be a victim.
    
    It pains me to see people who distrust and fear their computers, and who 
    feel powerless in that fear. Because that's not what I see when I look at 
    computers and phones and websites. I see tools I trust with the story of my
    life, and the secrets I leave out when I tell that story to others. Everyone
    should be able to feel like that.
    
    This site does not sell anything. This site does not take donations. This 
    site has no one's name on it.
    This site is to fix what is broken. Which is how we teach security.

If you were wondering because it looked familiar, it's run by the same person behind @SwiftOnSecurity.

sanderjd3• 10 years ago

You can't buy computer security. It is something obtained through configuration and knowledge.

Tragically, I believe this is true. But it isn't a great and noble thing that people must gain knowledge to overcome their powerless fear of computer technology, it is a failure of technology creators to provide people with simple tools that they can use without fear.

The problem isn't how we teach security, because hardly anybody should have to learn security in the first place. That the mainstream public is even aware of a concern called "security" having to do with their computing tools is already a failure. I can't think of any other mainstream products that people have to be so careful with, where they are told it is their fault that they just haven't gained the expertise necessary to use it without problems.

sarciszewski8• 10 years ago

I (and many others far more impressive than myself) am trying to solve this problem at a fundamental level: Give the developers tools that are secure-by-default (i.e. libsodium not mcrypt) and teach better development habits. Make it easier to do the secure thing than the insecure thing.

It might take years, but I believe these initiatives will trickle up and make the software everyone uses more secure at a base, so it will require less cognitive load from the end users to communicate safely with each other.

That's the idea, anyway. Time will tell if we can succeed.

throwaway7767• 10 years ago

I see your point, but it's at least partly a feedback loop. If software is going to protect users from themselves, it has to be opinionated and not allow the user to shoot themselves in the foot. This approach is not popular with users.

A good example is the backlash browser vendors get when they try to make TLS errors fatal (without a "continue anyway" button). Users will cry bloody murder until the option to bypass the warning screen is re-added, at which point everyone returns to clicking through all warnings and we're back at "you need to know what you're doing to have a secure machine".

takluyver2• 10 years ago

Sadly, the current popular 'solution' to this problem is for massive centralised gatekeepers (Google/Apple/Microsoft) to control software distribution, and to varying degrees prevent you from installing anything that didn't come from their store.

This undeniably makes security easier for non-technical users, but I hardly need to point on the downside on HN: these companies get to decide what programs people can install and distribute to others. They're not held to the standards of governments like due process and accountability - even though there are probably now more Android users than citizens of any one country [1].

Kudos to anyone working on alternative ways to make security easy without these gatekeepers.

[1] 1.4bn Android users in September 2015, according to Techcrunch, vs 1.38bn estimated population of China in 2015. Android is growing faster.

JoachimSchipper• 10 years ago

I can't think of any other mainstream product that people have to be so careful with...

Cars. Those also tend to kill people, not just wipe out some baby photos. It's not an accident that almost every country requires licensing before you're allowed to use a car.

greggman2• 10 years ago

I agree that as a computer literate? person I think I mostly know how to avoid viruses. I've never run any anti-virus software (could just be getting lucky).

My family on the other hand can't avoid click "Yes", "ok" to anything ever asked of them on their computers. They get massively gunked up and infected and nothing I tell them changes their behavior because at a base level they just don't have the awareness. They're very smart people but what the computer is doing or might do in response to their actions is just not something they think about.

sarciszewski8• 10 years ago

Your comment reminds me of this: http://swiftonsecurity.tumblr.com/post/98675308034/a-story-a...

It's a good read, and it was one of the pieces that motivated me to pursue making security easier for people.

digi_owl2• 10 years ago

Sadly most of that advice will only work for those that work in IT directly. For those that use IT as a tool in the box to get something else done, or as a internet appliance, most of the suggestions will not fly. They will just hit yes on every UAC, and approve every outgoing connection.

sarciszewski8• 10 years ago

Sure, but instead of throwing our arms up and accepting defeat, initiatives like Decent Security are trying to move the needle away from "insecure by default".

I'm trying to do the same thing with developers. :)

roddux• 10 years ago

I advise my techie and non-techie friends alike not to bother with antivirus, but rather to ensure that their files are backed up and their software is up to date.

Those are the most important parts, assuming the user is above the level of downloading and executing malware by themselves.

RIMR• 10 years ago

I would recommend using a business-class antivirus rather than the consumer editions. Also, don't use their browser plugins if offered.

At least that protects you from theft. I can keep all my files backed up, but that doesn't protect the data in them from being compromised.

If anything, you need to start recommending encryption to your friends if they aren't going to use an Antivirus.

ceejayoz• 10 years ago

It's highly likely that "business-class" antivirus is the same code sold at 100x the price.

It's also highly unlikely that the teams putting out shitty consumer-facing antivirus magically write awesome code for the enterprise versions.

Karunamon• 10 years ago

Antivirus nowadays only tells you that you're already screwed, rather than preventing it from happening.

The nastiest of the nasty stuff that's going to log keys, steal info, and so on, tends to be zero days. And after that article that showed how dismal the design of the popular antivirus apps is, there's an argument to be made that using them reduces your security.

busterarm2• 10 years ago

I used to work for an antivirus vendor and I would not recommend this.

The antivirus engine is the same and the only differences are how it's packaged. They're still shoveling obtrusive, crap software onto your system, just being less obvious about it.

The only reason to have Symantec Corporate Edition Antivirus installed on your system is because your company signed a deal to use Cisco VPN & Endpoint Protection and you're literally forced to use it.

What mostly everyone fails to understand is that antivirus software is not effective as a _preventative_ measure. What they are good at is detecting that you're already infected, but they all have terrible rates of false-positives. Nothing out there is much effective at protecting you from 0-day, despite industry claims to the contrary.

User training/habit modification is the only effective measure at preventing infection (besides being behind a default-deny firewall, but that's not something consumers will do). 99.9999% of infections require user interaction (and the ones that don't require it become instant international news). Adblockers get you most of the way there and do a better job at prevention than antivirus software.

Flaws in AV software have been exploited by rootkits before. AV software is just another point of failure.

sarciszewski8• 10 years ago

This is very close to the advice I give laypeople, but I hit a few other points (e.g. password security): https://paragonie.com/blog/2015/06/guide-securing-your-busin...

morinted• 10 years ago

And with Google planning on banning those fake download buttons, it might alleviate the need for an adblocker. I feel bad installing adblockers on others' computers, but it's helpful for the virus-prone.

jacquesm3• 10 years ago

I feel bad installing adblockers on others' computers, but it's helpful for the virus-prone.

You mean like security researchers?

http://www.networkworld.com/article/3021113/security/forbes-...

m3rc3• 10 years ago

Adblockers are a necessity to bring a computer up to the minimum level of security your friends and family need. There is so much malware being served through ads nowadays I wouldn't use any computer and try not to use a phone without adblockers in place

spyder• 10 years ago

Also use some adblock extension and make sure it's subscribed to malware domain filters.

helper• 10 years ago

Tavis is beast when comes to finding these exploits. Its always fun reading his write ups.

komaromy• 10 years ago

I get more excitement from seeing his avatar in my Twitter timeline than any other.

ep103• 10 years ago

Aw, I got all excited that someone had actually made a Chromium fork with basic things, like JS's script security context completely ripped out. No HTTPs validity checking, etc.

jhspaybar• 10 years ago

Aren't these sorts of zero days worth a LOT of money? He didn't go all the way to RCE, but he probably could have gotten there. It makes you wonder how many people are out there with Tavis' skills who just farm these things and sell them to the highest bidder instead of making us safer.

sarciszewski8• 10 years ago

Fortunately there aren't many with Tavis's skills, but you don't need to be that legendary to find these sort of vulnerabilities.

Assuming you can identify (skill) and safely sell (anonymity expertise and market savvy) a zero day, the demand for them is quite limited. (The only reason the price is so high is that the supply is just even lower.)

Additionally, if you have the market savvy to extract the maximum value for a 0day, you will quickly realize the feast-or-famine nature of unsavory income isn't great for a stable home life. You might eventually want a day job, and you can't exactly say "Oh, I helped that virus penetrate your network three years ago that you just detected last month."

So most people with Tavis's skill levels typically aren't in a hurry to go rogue.

And the ones that do are more interested in compromising bitcoin exchanges and drug marketplaces on Tor Hidden Services than they are in spreading malware to end users. (That's the advertising industry's shtick.)

TACIXAT• 10 years ago

Yea, I'd also have to say very few. A researcher of that skill level is pulling a very comfortable salary. A lot of the work that comes with that salary requires you to have an above board reputation. If a company is hiring you (or your parent company) to find vulnerabilities in their product, they need to be sure you don't have a conflict of interest.

ambrop7• 10 years ago

My machine is running CUPS on 127.0.0.1:631 (the local HTTP interface). Does this mean any web site can print with my printer?

mey• 10 years ago

Potentially depending on how it is secured (if it is), but it warrants further investigation.

smcnally• 10 years ago

Interesting posts from Avast explaining how they supply data to their marketing analytics product from their AntiVirus products:

https://forum.avast.com/index.php?topic=171725.0 https://blog.avast.com/2015/05/29/avast-data-drives-new-anal...

Avast: a Chromium fork with critical security checks removed

Related Stories