Security News New Attack Uses Microsoft's Application Verifier to Hijack Antivirus Software

[Azure]

Here's Fabian's response:

What Say Thee Emsisoft? DoubleAgent: Taking Full Control Over Your Antivirus

"I suggest having a quick read here:

http://www.kernelmode.info/forum/viewtopic.php?f=2&t=4687

There is really nothing else to add. Just some cheats trying to pass off publicly available knowledge as groundbreaking and original research."

 

[_CyberGhosT_]

I would say more. AV's are becoming obsolete with tools like VodooShield or AppGuard and the only problem is that the majority of the people cannot understand how those tools are working and they completely rely on AV's and disable their common sense. Our mission is to educate people around us and show them alternatives for highly overrated security suites.
Default-deny and good browsing habits are the best security combo.

Amen pablozi, well spoken.

 

[_CyberGhosT_]

Here's Fabian's response:

What Say Thee Emsisoft? DoubleAgent: Taking Full Control Over Your Antivirus

"I suggest having a quick read here:

http://www.kernelmode.info/forum/viewtopic.php?f=2&t=4687

There is really nothing else to add. Just some cheats trying to pass off publicly available knowledge as groundbreaking and original research."

Very relevant, thanks for linking that

 

[509322]

...AppGuard and the only problem is that the majority of the people cannot understand how those tools are working...

It's really not that difficult. The concepts are not mind-boggling. System Space|User Space concepts with some informative, practical instruction and people begin to grasp the product quickly.

 

[509322]

Default-deny and good browsing habits are the best security combo.

They aren't the answer to every security issue, but nevertheless they are certainly a good start.

 

[509322]

This thing works like a cancer cell !

It's been around forever - so don't get bent out of shape about it.

 

[509322]

Discussions in Comodo forum..




Answers from egemen (Comodo engineer)

There are 2 registry keys that need to be blocked from creation.

 

[509322]

A report hits the security forums and, as usual, it almost invariably and immediately gets over-inflated. People cursorily read the article without studying it carefully and without doing any kind of online research - see the word "bypass" somewhere in the article - and cry "infection vector !" and begin the mandatory FUD scuzzlebutt campaigns (there's a guy over at Wilders that has made it a full-time career) - and make the move to start demanding additional protection features from their vendor(s) of choice.

Most of the time the articles are not written in an easily understood manner that a lay-person can connect to their home system in practical, concrete terms... whether or not it even applies to them.

 

[Solarquest]

There are 2 registry keys that need to be blocked from creation.

If you block the 2 keys don't you "just" block the persistence mechanism?

 

[Solarquest]

It's been around forever - so don't get bent out of shape about it.

The vulnerability is known since many years but now the code is public as the effect on AV/the fact the miss it.
The question is, if it is known since so many years and user should not worry too much, why nobody (msft, AV) fixed it?
The fact most AV don't detect it (still) and virtually every program can be injected/used maliciously is not reassuring.
I'm still reading about it but still need to find a good page that makes clarity on this issue and on how to avoid it.

 

[Handsome Recluse]

Discussions in Comodo forum..




Answers from egemen (Comodo engineer)

Aren't these the defaults @cruelsister found trivial to bypass?

 

[Handsome Recluse]

The vulnerability is known since many years but now the code is public as the effect on AV/the fact the miss it.
The question is, if it is known since so many years and user should not worry too much, why nobody (msft, AV) fixed it?
The fact most AV don't detect it (still) and virtually every program can be injected/used maliciously is not reassuring.
I'm still reading about it but still need to find a good page that makes clarity on this issue and on how to avoid it.

Maybe these things just doesn't happen often enough.

 

[Handsome Recluse]

It's really not that difficult. The concepts are not mind-boggling. System Space|User Space concepts with some informative, practical instruction and people begin to grasp the product quickly.

The initial hurdle can't be the only thing that will stop them. Even then, there seems to be no change still. It's not just the matter of can it be implemented, but will it?

 

[Captain Awesome]

Avast, statement attributed to Ondrej Vlcek, CTO and GM of consumer business: “We were alerted by Cybellum last year through our bug bounty program to a potential self-defense bypass exploit. We implemented the fix at the time of reporting and therefore can confirm that both the Avast and AVG 2017 products, launched earlier this year, are not vulnerable. It is important to note that the exploit requires administrator privileges to conduct the attack and once that's the case, there are numerous other ways to cause damage or modify the underlying operating system itself. Therefore, we rate the severity of this issue as "low" and Cybellum's emphasis on the risk of this exploit to be overstated.
Microsoft tool exploit DoubleAgent can turn antivirus software into your worst enemy

 

[FreddyFreeloader]

Is Windows Defender affected by this???

 

[Aura]

From the same article in the post just above yours.

Microsoft issued the following statement through a company spokespesron: "The technique described in the report requires an already-compromised machine and only affects third-party applications that don't use Protected Processes." Protected Processes is a Microsoft security model and code integrity service first offered with Windows 8.1 that enables AV vendors launch their to anti-malware user-mode services as a protected service by allowing only trusted, signed code to load. It also includes built-in defense against code injection attacks and other admin-level attacks. Cybellum noted in its post that no AV software, other than Microsoft's very own product, uses this service.

 

[509322]

The vulnerability is known since many years but now the code is public as the effect on AV/the fact the miss it.
The question is, if it is known since so many years and user should not worry too much, why nobody (msft, AV) fixed it?
The fact most AV don't detect it (still) and virtually every program can be injected/used maliciously is not reassuring.
I'm still reading about it but still need to find a good page that makes clarity on this issue and on how to avoid it.

It's not something to fret about.

There have been malware in the past that used the technique.

AppVerif has to be on your system...

 

[509322]

The initial hurdle can't be the only thing that will stop them. Even then, there seems to be no change still. It's not just the matter of can it be implemented, but will it?

That post referred to learning AppGuard - and not abuse of AppVerif.

 

[509322]

This thread is typical over-inflation of an IT security article along with FUD scuzzlebutt.

 

[509322]

If you block the 2 keys don't you "just" block the persistence mechanism?

The answer is in the article that you posted:

"Simply by creating a Windows Registry key, an attacker could name the application he wants to hijack and then provide his own rogue DLL he'd like injected into a legitimate process."