App Review Eset's challenge.

[Andy Ful]

Content source

https://youtu.be/pO2QA1-qKYE

 

[Andy Ful]

This video is an addition to the :

App Review - The Comodo's challenge.

Can Comodo's Auto-Containment be bypassed?

malwaretips.com

I posted it to show that the method is quite general and not related to the particular AV. It shows that kernel drivers can be disabled from UserLand without exploiting vulnerable drivers.
Please note: The video is not an Eset protection test, because the presented method is not a full real-world attack.
It is possible that the method can be used as a part of a real-world attack, especially in Enterprises.
The presented method can be stopped by configuring Eset HIPS to block CMD (cmd[.]exe). But, several LOLBins can be used instead of CMD.

 

[Shadowra]

I wonder how you block AV services and if it would work with Kaspersky & Bitdefender

 

[Andy Ful]

I wonder how you block AV services and if it would work with Kaspersky & Bitdefender

The second part of the attack can block many AV kernel drivers. It cannot block drivers protected by VBS (Virtualization-based Security).
The first part uses a shortcut with CmdLines. The CmdLines can use several LOLBins to initialize the attack. In the video, I used the CMD LOLBin.
The current AVs have some chances to stop the first part of the attack by blocking CmdLines or LOLBins. So, the attack can be successful in some settings and fail in others.

 

[rashmi]

Is this attack test fit for products like OSArmor or CyberLock, or do they simply block CMD, so it won't be a fair test evaluating their mechanism like AI or suspicious?

 

[Trident]

The first part uses a shortcut with CmdLines. The CmdLines can use several LOLBins to initialize the attack. In the video, I used the CMD LOLBin.
The current AVs have some chances to stop the first part of the attack by blocking CmdLines or LOLBins. So, the attack can be successful in some settings and fail in others.

Are you aiming at the filter drivers? And does it affect only kernel-mode services? What if an application has multiple services in user and kernel mode, will all be affected? Interesting how no attempts for repair are made by Comodo and Eset… They certainly must have some scheduled tasks as well that should be able to perform a check.

 

[rashmi]

The second part of the attack can block many AV kernel drivers. It cannot block drivers protected by VBS (Virtualization-based Security).

Would products with Virtualization-based Security, like Kaspersky, survive the second part of the attack if V-bS is enabled in K?

 

[Andy Ful]

Is this attack test fit for products like OSArmor or CyberLock, or do they simply block CMD, so it won't be a fair test evaluating their mechanism like AI or suspicious?

I do not know well OSA and CyberLock, so I cannot answer the question. Furthermore, those security applications are not standalone-type protections, so they do not require advanced auto-protection.

 

[Andy Ful]

Are you aiming at the filter drivers? And does it affect only kernel-mode services? What if an application has multiple services in user and kernel mode, will all be affected?

Yes, for all the above questions.

Interesting how no attempts for repair are made by Comodo and Eset.

My videos do not exclude that the repair can happen later. All AVs are connected to the cloud and can send some telemetry.

 

[CyberDevil]

Interesting how no attempts for repair are made by Comodo and Eset…

I wonder if there is any point in reporting this to Eset in some way?

 

[Andy Ful]

I wonder if there is any point in reporting this to Eset in some way?

The problem is that submitting POCs in a standard way is pretty much useless. Some time ago in another MT thread, I presented a method (without details) to disable Microsoft Defender and use any malware to infect the computer. It was a full attack POC and it did not require high privileges. I use Microsoft Defender in daily work and developed a few security applications, so I submitted several POC's to prevent such attacks in the wild. After a few weeks, the attack could still be successful with simple modifications.
After a few months, a similar method was included in the arsenal of Read Teams, and then Microsoft finally improved Tamper Protection.

So, the solution would be discussing the attack method with someone who directly works on the AV code and not only on adding new signatures.

 

[Andy Ful]

Would products with Virtualization-based Security, like Kaspersky, survive the second part of the attack if V-bS is enabled in K?

Most probably yes.