Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 987761" data-attributes="member: 32260">Most Windows drivers (including AV drivers) can have hidden vulnerabilities. The vulnerability can be hidden for years until someone discovers it. The case of Avast is only an example. The attackers chose Avast because it is a very popular AV. This does not mean that similar vulnerabilities are absent in other less popular AVs. Here is a fragment of the book &quot;A Guide to Kernel Exploitation: Attacking the Core&quot; published in the year 2011:The main problem is not in Avast but in the fact that well signed drivers can be used to attack the kernel. This particular driver could be used to attack users who never installed Avast. The same is true for any well signed but vulnerable driver (there are many such drivers). On Windows 10+, such drivers can be blocked by the system (Microsoft has done this after Avast&#039;s request). On other Windows versions, such known drivers can be blacklisted by AV vendors.Generally, AVs are very complex software and have to have a relatively large attack surface:[URL unfurl=&quot;true&quot;]https://speakerdeck.com/nafiez/poc-2019-hunting-vulnerability-in-antivirus-products?slide=19[/URL][ATTACH=full]266467[/ATTACH]Despite these well known issues, the AV is still the best security solution for most people. It is like Democracy - has got many issues, but no one invented a better solution (so far).<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 987761, member: 32260"] Most Windows drivers (including AV drivers) can have hidden vulnerabilities. The vulnerability can be hidden for years until someone discovers it. The case of Avast is only an example. The attackers chose Avast because it is a very popular AV. This does not mean that similar vulnerabilities are absent in other less popular AVs. Here is a fragment of the book "A Guide to Kernel Exploitation: Attacking the Core" published in the year 2011: The main problem is not in Avast but in the fact that well signed drivers can be used to attack the kernel. This particular driver could be used to attack users who never installed Avast. The same is true for any well signed but vulnerable driver (there are many such drivers). On Windows 10+, such drivers can be blocked by the system (Microsoft has done this after Avast's request). On other Windows versions, such known drivers can be blacklisted by AV vendors. Generally, AVs are very complex software and have to have a relatively large attack surface: [URL unfurl="true"]https://speakerdeck.com/nafiez/poc-2019-hunting-vulnerability-in-antivirus-products?slide=19[/URL] [ATTACH type="full" alt="1652082355992.png"]266467[/ATTACH] [COLOR=rgb(0, 168, 133)][B]Despite these well known issues, the AV is still the best security solution for most people. It is like Democracy - has got many issues, but no one invented a better solution (so far).[/B][/COLOR]:) [/QUOTE]

Verification