MS Security Essentials reporting false positives in the Bitcoin blockchain

https://answers.microsoft.com/en-us/protect/forum/mse-protect_updating/microsoft-security-essentials-reporting-false/0240ed8e-5a27-4843-a939-0279c8110e1c

by zorked • 12 years ago

100 76 12 years ago

answers.microsoft.com

nwh3• 12 years ago

So a joker decided to embed some Anti Virus bait in the blockchain, just a few bytes is enough to make the software go nuts deleting a whole lot of files the Bitcoin client needs. The solution the Bitcoin developers suggest is pure old-school malware style, XOR the blocks to hide it from the Anti Virus suites. Classic.

https://github.com/bitcoin/bitcoin/issues/4069

voltagex_• 12 years ago

From a comment on that issue:

Just for fun, there's about 8000 reachable nodes on the network at the time of writing. Assuming that a large portion of the network is unreachable (NAT, filtering, intermittent, just not listening), it's probably safe to assume there's probably at least 50,000 nodes with the complete blockchain. If we XOR just the chainstate, we cause 50000 * 430 MB of disk writes, 50000 * 430 * 2 MB read and write combined, somewhere in the region of 43TB. If we XOR the entire blockchain on disk we cause 50000 * 21000 * 2 MB of IO, around 1.95PB of RW across the wider Bitcoin network. Incredible.

sliverstorm2• 12 years ago

Just 8000 bitcoin nodes? So much for the People's Distributed Currency.

windsurfer• 12 years ago

Isn't this just an arms race, though? What's to stop people from doing this again?

nullc2• 12 years ago

Every host would have a unique mask.

cjg• 12 years ago

In one of the comments in that article: "I can't wait until someone legally changes their name to one of these sequences and we find out that all sorts of government databases didn't have functioning backups..."

cnvogel• 12 years ago

I think you could put the "EICAR Test String" easily in a lot of databases, maybe as the answer to a security question, a special "delivery instruction"...

http://www.eicar.org/86-0-Intended-use.html

It's detected by almost any antivirus product, on my work computer the corporate antivirus immediately quarantines a file with this content.

X 5 O ! P % @ A P [ 4 \ P Z X 5 (...)

mahdavi• 12 years ago

it won't solve the problem, the joker can simply inject a string that becomes a virus signature after XOR.

mschuster912• 12 years ago

If every client uses his own keystream, then not.

drzaiusapelord• 12 years ago

This is an old trick. A little while ago someone was putting the EICAR test string in email subject lines, headers, inside PDF files, in mime headers, and in other random places. He managed to crash a lot of enterprise level AV solutions and email servers. If you want to be a dick, just copy and paste that string everywhere you can. The AV will treat it like a real threat.

userbinator2• 12 years ago

That somewhat reminds me of this: http://en.wikipedia.org/wiki/BLIT_(short_story)

afreak5• 12 years ago

The simple solution is to not allow your anti-virus software to scan anything that cannot malware. There are exceptions to the rule of course such as MP3s that had executable code, but why does it need to scan every single file on your system?

Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.

DerpDerpDerp• 12 years ago

Could you elaborate on why you think it's a dead technology?

afreak5• 12 years ago

There are many articles describing why but really it comes down to this: malware authors can pump out so many copies of their software at once that signature-based detections in which the AV industry relies on are no longer reliable or effective.

We're at a point now where what may have worked as a defence against stuff being found on floppy drives just isn't able to scale for today's modern infrastructure.

AV is really a last-line of defence against being forgetful, and nothing more.

NhanH• 12 years ago

The idea of having a program that is allowed to scan and check every single files/ memory blocks seems to be, at the very least inefficient and against the principle of isolation to me.

May be because I'm just biased because the damn thing used to start running every time my gaming session is heating up ...

reitanqild• 12 years ago

Because a kid can write a working trojan that escapes AV detection? (Two very young studends I know did, POC took less than 50 loc in AHK. That included a plausible "installer" as well as auto update feature).

jacobwcarlson• 12 years ago

Given your background it's surprising you don't realize how many file formats are Turing-complete and thus capable of mischief.

afreak5• 12 years ago

A lot of things can produce mischief, but it comes down to what level of problems you want to deal with.

Here's what typical AV scanners go looking for when running in their "optimal" settings:

http://community.landesk.com/support/docs/DOC-6651/diff?seco...

Not all Turing-complete languages are scanned. For example, CSS3 is Turing-complete but by default it is not looked at by AV scanners.

However, one can do some nasty things using CSS. An example would be when a troll was posted on a site that appeared to show some sort of Linux-based privilege escalation when in fact it had several <span> tags scattered about that would have not shown up in the browser but did so when text was copied.

This sort of thing can however be defeated by just scanning the web content coming through (and most modern AV software has this already), but even then an attack like that isn't simply going to be just picked up so easily.

I am well aware of where files can create havoc Turing-complete or not (such as my MP3 example), but at the very same time you're going to have headaches if you decide to scan every single file.

This again goes back to my whole point of saying that AV is a dead technology because you really shouldn't trust any file but it is not effective to scan everything either.

munin• 12 years ago

Turing-complete and thus capable of mischief.

because something is "Turing-complete", does not imply it is capable of mischief.

something can be capable of mischief, yet not "Turing-complete."

tom-• 12 years ago

It's visibles that you used to work for an AV company and haven't followed the advances of the industry. As you don't mention any of the modern day technologies like heuristics and file reputation in cloud.

It's true that the world is full of auto morphing malwares, but you can still detect them new variants through heuristics. Which in turn delivers the results to what is generally known as some sort of Antivirus Cloud Lookup or File Reputation Lookup.

Also the AV industry shares information between them. So in the background you don't have anymore analysts looking at every sample file. Instead there's automation that analyses each incoming sample.

The old scan databases you prefer to are usually last line of defense now days if all the other technologies before haven't been able to show the file to be known good file or bad file.

Full disclosure: I currently work for computer security company.

afreak5• 12 years ago

I have most definitely followed the advances in the industry because I worked in it in the past few years.

Heuristics are not a new thing in the AV industry and have been in the works even before the dotcom boom. Even with advances in it, it has been proven to either not scale or be absolutely worthless.

Anti-virus "cloud lookup" is just a stop-gap between signature updates. It's not a new idea and all you're doing with that is cataloging MD5s and making them available via whatever network server you choose to use. It's still a signature.

Here's a perfect example of why AV is useless: until 64-bit Windows was commonplace and before XP support was dropped, it was ineffective in stopping the likes of Aleurion (also known as "TDSS" or "TDL").

How did this malware work? Well, in its many, many different permutations, it would get dropped on a machine, become executed, and if the machine was running XP Service Pack 2 or less, it would make use of a vulnerability in the print spooler, get system-level control over the computer, and then it would infect the master boot record with its own bootloader.

How does AV remove it? Well since every time you reboot, it restores its copy of the malware, all it can do is scream that the world is falling because it can do absolutely squat about it. You have to remove it from the bootloader and then do a scan afterward while having taken the system offline.

What fixed the problem? Well applying a patch in the OS is what fixes the issue once and for all--SP3 was the easy way.

If heuristics really worked as you suggest it does, we wouldn't see Cryptolocker and the likes getting around AV. AV evasion is better than ever and heuristics have done absolutely nothing to solve the problem.

aw3c2• 12 years ago

Errrrr, anything can contain malware. For exampe if software that uses the blockchain file has a vulnerability that can be exploited by writing stuff into the blockchain.

kijin2• 12 years ago

MSE was top-notch when it was first released. It aced all the malware detection benchmarks, not to mention it was completely ad-free and extremely lightweight, which was unheard of in the free antivirus market. The high detection rate and low performance impact made lots of Windows users flock to MSE, myself included.

Nowadays, MSE is still lightweight, but it sits at the bottom of every malware detection benchmark. I've been recommending MSE to everyone around me, but recently they started getting all sorts of malware despite keeping MSE up to date. All of these were easily detected and removed by avast!, BitDefender, and Malwarebytes, but MSE just sat there like a cow, oblivious to the malware's presence.

Why has Microsoft let MSE rot like this? Now that MSE is built into Windows 8, are they afraid of getting slapped with antitrust fines if they shipped an antivirus that can actually compete with third-party offerings?

This year, I'm moving my family off of MSE. So long, it was good while it lasted. But third-party antiviruses have caught up in the meantime, and now they're just as lightweight as MSE.

nivla3• 12 years ago

Nah I will stick with MSE because the alternative for me is not to use an antivirus. If you ever want to know how to bring a 8-core i7 to its knees, install Norton. MSE is the only antivirus that is lightweight, stays out of your way and the least annoying of everything out there and not to mention its free with no ads. Sure, it doesn't have an heuristic scanning but it did once do a good job of detecting a malware that both Avast and Norton missed, which is good enough trust for me. The best feature is that it doesn't have a girl screaming "Avast, Your database have been updated." or "Your license is about to expire in 90days unless you pay $$$" every 4 hours.

Don't download anything sketchy, keep an updated version of your browser, don't run yourself as root and your should be fine for 99.9% infections out there. For the rest just keep MSE around.

ghshephard• 12 years ago

You forgot the top two other pieces of advice - Make sure you have a decent adaptive firewall, and run anything even slightly worrisome in a virtual machine, never on your main operating system.

spain• 12 years ago

It's sad. However instead of ditching it entirely I have moved to a combination of MSE for real-time protection and Malwarebytes as backup, which I run every month or so to get anything that might manage to slip through.

kijin2• 12 years ago

I've been doing exactly that, but by the time Malwarebytes catches the virus, the damage might already be done. So even if you use Malwarebytes for occasional scans, there is legitimate need for better realtime protection.

Maybe I should get the paid version of Malwarebytes that can also do realtime scans?

frik2• 12 years ago

I noticed the same. MSE is generally great, but it feels like IE 6 back in 2005 (no investment in years)... :(

Running a multi GB backup with Microsoft's robocopy cmd utility crashes the MSE service. That's really annoying.

Given that "Microsoft Forefront" is a rebranded MSE (it can be controlled over the network), I wonder why its real-time scanner can't handle ~100MB/s IO for several hours.

ryanburk• 12 years ago

IE6 is a really great analogy based on what happened inside of microsoft on this team over the past few years.[1]

[1] I helped start up this team in 2004

bobbles• 12 years ago

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

duskwuff2• 12 years ago

For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.

ygra• 12 years ago

Or, more sneakily, by embedding it in your hostmask.

TazeTSchnitzel• 12 years ago

http://bash.org/?13213

Like this?

simcop2387• 12 years ago

DCC SEND LOLLERCOPTER

There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

frik2• 12 years ago

It was a bug in Linksys, Netgear routers that rebooted the device.

bug report e.g. http://colloquy.info/project/ticket/531

thelsdj• 12 years ago

I had a modem that would disconnect if someone typed: ATH0++ in IRC.

mschuster912• 12 years ago

DCC SEND startkeylogger or such combined both exploits. Ah, I had quite a fun with that a couple of years back.

IIRC it still bites a couple of people on Freenode, but the most networks have auto-kick bots in place for these scriptkiddies.

JimDabell• 12 years ago

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

beagle3• 12 years ago

There wasn't really a "control code context" - it was (2 second silence)+++(1 second silence) to switch to command mode, and then ATH to disconnect.

Bad firmwares would also accept same from remote side, although supposedly it should only have come from the local side.

spacemanmatt• 12 years ago

BitCom, a trashy DOS based terminal program, would lower the signal on the DTR pin, which would hang up the modem instantly, when it saw the text, "NO CARRIER" on a line by itself. Obviously, that line got dropped in forums and chat rooms as the "word of the day for BitCom users" on a regular basis.

thristian• 12 years ago

Actually, it wasn't "badly written firmware". Hayes modems actually looked for "+++", then a second or so of no traffic, before they would switch into command-mode, and that delay was patented. So "Hayes-compatible" modems would implement the system without the delay, and as a result were vulnerable to remote DoS.

anonymfus• 12 years ago

This reminds me how the string %English% transferred via SMS crashed some old Siemens phones and GSM modules because of error in detection of embedded images.

And how recently string سمَـَّوُوُحخ ̷̴̐خ ̷̴̐خ ̷̴̐خ امارتيخ ̷̴̐خ could crash some versions of iOS and OS X.

nivla3• 12 years ago

OR they could have just used the string from EICAR test file [1].

Since I don't use bitcoin, let me ask, does everyone have to download the whole blockchain to their computer in order to mine or receive/sent the coins? Wouldn't the blockchain be in XX GB size by now?

[1] http://en.wikipedia.org/wiki/EICAR_test_file

bowmessage• 12 years ago

Yes, they do. And yes its quite large! Over 10 GB.

Jach• 12 years ago

No they don't. Mining software that connects to pools is independent of having a blockchain copy. There are also several bitcoin wallet implementations that don't require a full copy of the blockchain.

andrewmunsell• 12 years ago

If you use a client such as Electrum, it uses a server based model to index the Blockchain. The advantage of this is primarily "instant" start up time of the client.

https://electrum.org/

ars• 12 years ago

Over 20GB actually, and growing by about 2GB per month.

codystebbins• 12 years ago

Not sure about mining, but I would assume yes the blockchain is needed.

In order to have a wallet and just use bitcoin no the user does not need to download the whole blockchain depending on the wallet software. There are wallets that use public shared remote servers to access the blockchain that are reputable in the community.

https://electrum.org/

https://multibit.org/

https://darkwallet.unsystem.net/ (don't use yet, alpha)

nullc2• 12 years ago

The string from the EICAR test file has been in the current testnet chain since the start in order to try to spot these issues before they bothered users.

Unfortunately, it appears that AV software completely ignores files larger than 32 MBytes, so it won't notice them in the blockchain— just the chainstate. And so the grand idea of putting the triggers in coinbases didn't work there.

The other fun thing is that the EICAR test trigger is too long to easily stuff in a transaction. Unfortunately there are other "signatures" which are as short as 16 bytes.

servowire3• 12 years ago

16 bytes is the limit?

servowire3• 12 years ago

You don't need the entire blockchain to send/receive. Only when running a "Full node". If you are not intending to keep your node online for 24/7 you can use a SPV style client like Electrum or Multibit. They are lightweight clients without a blockchain attached.

etiam• 12 years ago

We actually received advance warning of this some time ago: https://news.ycombinator.com/item?id=7542920

After some consideration and the feedback here https://news.ycombinator.com/item?id=7543196 I decided to inform one major antivirus vendor about it. They offered their thanks for the warning, but also the opinion that false alerts would be strongly limited since the virus signatures are in files that would generally not be scanned. The scope of this remains to be seen, but apparently at least Microsoft Security Essentials doesn't handle this entirely without problems.

izietto• 12 years ago

The part I prefer:

It appears to be a joke or prank, simply because this particular virus does nothing more than periodically show "YOUR COMPUTER HAS BEEN STONED" on one out of every eight computer boot-ups, and is over 25 years old.

When viruses were mainly jokes...

jamedjo• 12 years ago

The Xkcd would go "We thought we sanitised our input but we still lost this years student records. Did you really name your son Little Bobby Drop [DOS/STONED]{16 byte malware Signature}?"

userbinator2• 12 years ago

I think this is another great example of how modern AV software can be used as a tool of mass censorship. They can simply add signatures for any file contents they disagree with (or some other organisation with the appropriate power requests to do so), and it will disappear from their user's computers under the pretense of being malicious. Users will trust them in order to "stay safe".

That's why I believe in behavioural monitoring rather than signature-based approaches, since what's malicious is really the activity itself.

MS Security Essentials reporting false positives in the Bitcoin blockchain

Related Stories