Attackers spread backdoor via eScan antivirus software update process

https://decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/

by skilled • 2 years ago

57 56 2 years ago

decoded.avast.io

I'm interested to know how eScan, a security company, never noticed that they were using http to distribute executables to customer devices for so long.

mistrial9• 2 years ago

plenty of critical services use HTTP -- maybe exactly because they are critical.. think the scenarios through and that may make more sense..

capitainenemo3• 2 years ago

Common enough to use it.. linux distros frequently distribute updates over http (and ftp). But those are always signed. Something eScan did not do.

jamespo• 2 years ago

I'd hope these other critical services at least sign their packages

seiferteric• 2 years ago

Somewhat ironically OCSP.

lupusreal2• 2 years ago

Seems like criminal negligence to me.

hermannj314• 2 years ago

If an Uber Eats driver poisons your food en route from McDonalds, then McDonalds is criminally negligent?

I mean, I understand HTTPS is industry best practice but the criminals in this story are the actual criminals.

radicaldreamer2• 2 years ago

http or https doesn't matter (in fact, you shouldn't rely on it because the end user could be MITM'd already with a root certificate maliciously installed on their device).

You should sign binaries and verify and consider the network/distribution method compromised by default.

dixie_land• 2 years ago

If the user is MITM'd, what's preventing the attacker also replace the signature to verify against?

kuhsaft2• 2 years ago

the end user could be MITM'd already with a root certificate maliciously installed on their device

If a malicious root certificate is installed, then the user’s system is already compromised and signature validation won’t help.

andmarios• 2 years ago

Some customers actually ask for it. The correct behavior is to have https as the default and have the user explicitly switch to http.

nucleardog• 2 years ago

Or just validate the binary you download then none of this even matters—for this or any other sort of potential vulnerability, your updater will never end up running untrusted software with escalated privileges.

HTTPS is providing confidentiality, and authentication.

The confidentiality doesn’t really matter here. You’re distributing a software installer. There’s a good chance you’ll give a copy to anyone that visits your website and wants to use your software. And you’re not hiding what you’re downloading in any meaningful way.

The authentication is important. That prevents someone from, say, sending the user a completely different binary and having your software run it.

The authentication could just as easily be solved by signing the files you distribute and validating the signature of the downloaded update before running it.

(Hell, if you’re signing your installers (likely) it could be as simple as deferring to Windows’ WinVerifyTrust method and a check that the certificate used is actually your own.)

Debian still distributes packages primarily over HTTP (https://www.debian.org/mirror/list) without issue.

jms703• 2 years ago

Makes one wonder how poorly designed the software is. Like most antivirus software, it's probably not very good.

microtherion• 2 years ago

In my entire career, I've yet to encounter a virus as deleterious in its effect than some of the antivirus software I've seen (Though, having had minimal Windows experience may contribute to this experience).

I've spent literally hours explaining to my users that no, my software was not distributed with a virus; one popular anti virus program had a false positive flagging it as such.

teeray• 2 years ago

I really love when “endpoint security tools” feel the need to examine every object file and debugging symbol a compiler emits. It really improved the build times /s

radicaldreamer2• 2 years ago

security theater

eviks• 2 years ago

There are public cases of ransomware crippling the whole org for days. Do you have examples of the similar effect of antivirus?

wnevets3• 2 years ago

If you're gonna use an antivirus just use Windows Defender. There really isn't a reason to use anything else these days.

londons_explore• 2 years ago

Is Windows Defender really effective in 2024? You would think any virus designer would design their stuff in a way that the default antivirus built into the product they are attacking wouldn't be able to find it...

And before you say "well duh, but signature updates", I will respond with the fact that nearly malware is designed to auto-update... And will obviously make sure that the windows defender signatures fail to auto-update...

Rinzler89• 2 years ago

Is Windows Defender really effective in 2024?

Relative to what?

The question is: are the competitors more efective in 2024 for the money you pay VS the built-in solution, while also using less resources to boot that Defender?

That's the question people and bean-counters ask before pulling out their wallets.

wnevets3• 2 years ago

Is Windows Defender really effective in 2024?

relative to what?

You would think any virus designer would design their stuff in a way that the default antivirus built into the product they are attacking wouldn't be able to find it...

Why can't that also be true for any antivirus? I would be shocked if that anyone who still makes viruses wouldn't check virus total first

parl_match2• 2 years ago

Is Windows Defender really effective in 2024?

Yes.

You would think any virus designer would design their stuff in a way that the default antivirus built into the product they are attacking wouldn't be able to find it...

You would think that Microsoft would build mechanisms to prevent this. And they do. Avoiding detection is a key goal, to be fair.

And before you say "well duh, but signature updates", I will respond with the fact that nearly malware is designed to auto-update...

That's actually very noisy, and an important part of modern malware is avoiding detection - internal and external. Auto-updaters are pretty easy to detect. Even large ISPs will look for auto-update traffic and alert their customers (or in some cases, disable their accounts temporarily!). And once detected, these companies are very well practiced in taking down the hosts of the updates.

So that is a "fact" but it's not so black and white :)

And will obviously make sure that the windows defender signatures fail to auto-update...

Sounds easy in theory, very hard in practice.

On modern systems, requires kernel mode/system/specific elevated privileges. Using a kernel exploit is rare because they're hard to come by and very valuable - limits scope of who an attacker will bother wasting one on. UAC will complain that an unsigned binary is trying to elevate, and such functionality may even be disabled. In fleet machines, the user often cannot escalate their privileges in such a way that allows defender to be disabled.

Anti-virus is still relevant and useful, although slowly fading into irrelevance - although there will always be a need by vendors to remove malicious software.

MattPalmer1086• 2 years ago

All sane virus designers test their creations against all the leading anti virus software.

AV software will only detect known viruses for which a signature exists, or poorly coded/tested ones that are caught by AV heuristics.

hulitu3• 2 years ago

No. Malware can easily run. It only prevents cracks from running.

Yasuraka• 2 years ago

Windows Defender still flags every other non-trivial Go binary

Even if it's just 50 lines that were compiled 2 seconds ago by you in the same folder.

Then again, developing anything on Windows seems to be an up-hill battle from the get go

wnevets3• 2 years ago

Windows Defender still flags every other non-trivial Go binary

I believe that is an issue with using reputation based protection rather than an issue with antivirus heuristics, unsigned/unknown binaries get flagged.

johncessna• 2 years ago

Did the editor reign in the original headline?

fullspectrumdev• 2 years ago

This whole vector (serving malicious updates via MiTM) has been well known for the longest time, with even frameworks such as Evilgrade for exploiting them.

Such an oversight from a “security” company is frankly unforgivable.

soraminazuki2• 2 years ago

Antivirus being not only inherently ineffective, but actively undermining the security of the system through negligence and poor practices. Often tampering with other software and negating actual security hardening measures along the way. Has anything changed this past decade or two?

https://ia801200.us.archive.org/1/items/SyScanArchiveInfocon...

https://robert.ocallahan.org/2017/01/disable-your-antivirus-...

parl_match2• 2 years ago

Anti Virus is a net good, although the entire OS industry understands that it is an outdated way of thinking about endpoint protection. You could say what you said about lots of software, including almost anything with a built in updating feature.

That in mind, there's no reason to use anything but Windows defender on Windows (unless youre a high value target)

soraminazuki2• 2 years ago

No, the same can't be said about other software. No other kind of software runs with kernel privileges and goes out of its way to touch everything within sight, be it files, sockets, devices, or processes. No other kind of software disables or gets in the way of implementing hardening measures of other security critical software. No other kind of software messes with browsers and OSes, and at the same time, invest so less in making its architecture and implementation at least as secure as the thing they're messing with. Well, maybe except other user hostile software like malware and DRM. Antiviruses dramatically increase the attack surface of the system, both in theory and practice.

Even an antivirus without the flaws isn't much useful. It's in essence solving the halting problem. Only worse because instead of determining whether a program halts, antiviruses seek to determine whether a program is "bad." A vague criteria that even human beings have trouble defining let alone come up with an algorithm for it.

Many of these issues are inherent to antiviruses. Windows Defender, coming from an OS vendor, may perhaps be better in terms of implementation. However, even good implementations can’t overcome fundamental problems that stem from the very idea of the software itself.

hulitu3• 2 years ago

No. The only thing that the antivirus is doing is actively preventing the user from doing work.

Attackers spread backdoor via eScan antivirus software update process

Related Stories