App Review Avast's challenge.

[Vitali Ortzi]

From my experience with AV vendors and POCs, the new method is not detected/blocked until it becomes prevalent in the wild. So, even if such rare attacks appeared in the wild, the AV vendors added the malware signature without behavioral detection/block of the method.
Currently, the prevalent and well-known method is BYOVD (Bring Your Own Vulnerable Driver). For that method, Avast implemented the vulnerable driver BlockList.

My concern (so far) is not the "AV challenge", but the undetected UAC bypass commonly used in the wild. But, I cannot blame Avast, because even with this possible issue it can compete with top AVs when protecting home users.

Wouldn't a sample first be examined by cybercapture (still doesn't mean avast doesn't need to fix the bypass as good multilayer is key to good defense )

 

[Vitali Ortzi]

Did they ever even attempt to fix it?

I the reason is that it's diffuclt to get issues to the right people and not something sinister like only caring about in the wild

 

[Andy Ful]

Wouldn't a sample first be examined by cybercapture (still doesn't mean avast doesn't need to fix the bypass as good multilayer is key to good defense )

The attack can skirt around SmartScreen, CyberCapture, and Avast Hardened Mode. It does not mean that they fail - simply they are not designed to check the file types used in the attack. I useed trusted EXEs and a few files that are not checked by those security layers. All files except one EXE are hidden, so they are not visible in the Explorer.

 

[Andy Ful]

Some readers may doubt why Avast's CyberCapture cannot detect the attack in the cloud Sandbox. So, let's look at the alternatestreamview.exe process in the Process Explorer:

We can see many DLLs loaded by this executable. CyberCapture does not send all those Dlls to the sandbox, only the EXE file can be sent if it is recognized as suspicious. So, even if the alternatestreamview.exe would be unknown and suspicious, CyberCapture could only examine how this executable behaves in the virtual environment with DLLs native to the sandbox and without the DLL used locally in the attack. This is a well-known limitation, typical to many cloud sandboxes. Otherwise, many files should be uploaded to the cloud causing performance issues, overloading the cloud, etc.

The problem of DLLs can be partially solved when using file reputation cloud lookup like in Smart App Control, Norton Download Insight, etc. However, this approach gives many false positive detections. As usual, the requirement of protection usability necessitates a reduction in security.
If Avast decides to check the reputation of DLLs in the future, it will probably be thanks to changes to Hardened Mode.

 

[Vitali Ortzi]

Some readers may doubt why Avast's CyberCapture cannot detect the attack in the cloud Sandbox. So, let's look at the alternatestreamview.exe process in the Process Explorer:

View attachment 286548

We can see many DLLs loaded by this executable. CyberCapture does not send all those Dlls to the sandbox, only the EXE file can be sent if it is recognized as suspicious. So, even if the alternatestreamview.exe would be unknown and suspicious, CyberCapture could only examine how this executable behaves in the virtual environment with DLLs native to the sandbox and without the DLL used locally in the attack. This is a well-known limitation, typical to many cloud sandboxes. Otherwise, many files should be uploaded to the cloud causing performance issues, overloading the cloud, etc.

The problem of DLLs can be partially solved when using file reputation cloud lookup like in Smart App Control, Norton Download Insight, etc. However, this approach gives many false positive detections. As usual, the requirement of protection usability necessitates a reduction in security.
If Avast decides to check the reputation of DLLs in the future, it will probably be thanks to changes to Hardened Mode.

when I send samples to Symantec thankfully they check every dll but it can take even days till they file back a report in the mail if it's something unknown to them not very convenient but still pretty useful as it's simpler then debugging , disassembling suspicious files myself but even they probably only check certain filetypes and languages so you could probably bypass it with some gaming engine specific scripting language or other simple yet genius methods threat actors use in the wild

Seems like default deny is the only way to stop all current in the wild threats yet both business and consumers usually don't really use default deny as it basically makes everything unknown a false positive
Oh and even with default deny there are all kinds of tricks to bypass many default deny solutions just like you have shown


I really hope windows does something to help users against so many threats as windows security by default has many exploit mitigations Linux lacks and windows I
Is pushing safe languages to it's kernel (forced declaration, compiler memory checks etc )
As long as they keep allow by default then social engineering will cause people to execute malware as usual just like happens to many big corporations meanwhile the base of windows technically as more security features then Linux but who cares when they don't need to try to exploit memory of processes with effective simple social engineering that users basically execute malicious software themselves



Even I can easily get fooled to executing malware on my windows system and at least android ,ios have sandboxes , restricted permissions by default (true security by default) wich makes it harder for attackers to get privileged code running as they have to actually use exploit chains (layers of sandbox , memory checks etc requires in most cases a chain )

 

[Andy Ful]

Seems like default deny is the only way to stop all current in the wild threats yet both business and consumers usually don't really use default deny as it basically makes everything unknown a false positive
Oh and even with default deny there are all kinds of tricks to bypass many default deny solutions just like you have shown

Yes, there is no perfect solution. However, applying a higher security level than the attacker expected really matters. The "predator and prey" model is valid even if the prey can fly high and run fast. The average or weakened target is never safe. It does not mean that everyone has to use the default deny approach. For example, many readers can be safer just by reading the posts on MT about attack methods and developing safer habits. One can make a security solution less strict and more usable if this is covered by knowledge and safe habits.

People can have very different demands about security. I like a solutions that can easily switch between a few security levels, Similar to changing clothes according to the weather.

 

[Vitali Ortzi]

Yes, there is no perfect solution. However, applying a higher security level than the attacker expected really matters. The "predator and prey" model is valid even if the prey can fly high and run fast. The average or weakened target is never safe. It does not mean that everyone has to use the default deny approach. For example, many readers can be safer just by reading the posts on MT about attack methods and developing safer habits. One can make a security solution less strict and more usable if this is covered by knowledge and safe habits.

People can have very different demands about security. I like a solutions that can easily switch between a few security levels, Similar to changing clothes according to the weather.

Definitely
Good behavior practice taught here and recommendations of either configured defender or good third party solution helps a lot
Btw people recommend here DNS with good intelligence (quad9), extensions (users usually recommend here traffic light but I personally recommend checkpoint +Symantec extension combo that had excellent results in my tests )
Wich can help a lot to avoid malicious links from pishing to malware in the first place

So good behavior , layers (asr rules etc ) can definitely help keep most people safe and I'm sure most of the people in this fourm that use good practice are safe from that alone safe no matter what os system they use
(Assuming we aren't all already infected by state sponsored actor at low level firmware like controllers to baseband etc with a sleeping malware waiting for an event)

 

[aliali]

Does Kaspersky antivirus have this issue as well?

 

[Andy Ful]

Does Kaspersky antivirus have this issue as well?

Yes, it had (all tested solutions had it). They asked me to submit the details but I did not check the result.