Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1080576" data-attributes="member: 32260"><p>I have created this video as a continuation of the AVs challenge.</p><p>It can demonstrate that antimalware kernel drivers and protected services of popular antivirus software can be tampered with (from Userland with high privileges), assuming VBS does not protect them.</p><p></p><p>The attack method could be already used in the wild because most of it is documented. However, I have not seen any reference to it on the web. It does not use vulnerable drivers and does not abuse PPL.</p><p></p><p><strong>It is not a full attack, but it can be a part of a targeted attack in organizations. </strong></p><p><strong>Please note: Avast is only an example. I tested the presented method on several well-known antivirus software with similar effects.</strong></p><p></p><h3><a href="https://malwaretips.com/threads/the-comodos-challenge.129472/" target="_blank">App Review - The Comodo&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/comodos-challenge-part-2.129514/" target="_blank">App Review - Comodo&#039;s challenge part 2.</a></h3><h3><a href="https://malwaretips.com/threads/esets-challenge.129485/" target="_blank">App Review - Eset&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/microsoft-defenders-challenge.129597/" target="_blank">App Review - Microsoft Defender&#039;s challenge</a>.</h3><h3><a href="https://malwaretips.com/threads/bitdefenders-challenge.129753/" target="_blank">App Review - Bitdefender&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/the-zone-alarm-challenge.129801/" target="_blank">App Review - The Zone Alarm challenge.</a></h3><h3><a href="https://malwaretips.com/threads/the-emsisoft-enterprise-security-challenge.129862/" target="_blank">App Review - The Emsisoft Enterprise Security challenge.</a></h3></blockquote><p></p>

[QUOTE="Andy Ful, post: 1080576, member: 32260"] I have created this video as a continuation of the AVs challenge. It can demonstrate that antimalware kernel drivers and protected services of popular antivirus software can be tampered with (from Userland with high privileges), assuming VBS does not protect them. The attack method could be already used in the wild because most of it is documented. However, I have not seen any reference to it on the web. It does not use vulnerable drivers and does not abuse PPL. [B]It is not a full attack, but it can be a part of a targeted attack in organizations. Please note: Avast is only an example. I tested the presented method on several well-known antivirus software with similar effects.[/B] [HEADING=2][URL='https://malwaretips.com/threads/the-comodos-challenge.129472/']App Review - The Comodo's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/comodos-challenge-part-2.129514/']App Review - Comodo's challenge part 2.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/esets-challenge.129485/']App Review - Eset's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/microsoft-defenders-challenge.129597/']App Review - Microsoft Defender's challenge[/URL].[/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/bitdefenders-challenge.129753/']App Review - Bitdefender's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/the-zone-alarm-challenge.129801/']App Review - The Zone Alarm challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/the-emsisoft-enterprise-security-challenge.129862/']App Review - The Emsisoft Enterprise Security challenge.[/URL][/HEADING] [/QUOTE]

Verification