Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1079944" data-attributes="member: 32260"><p>I created this video as the continuation of the AVs challenge to show that Antimalware kernel drivers and protected services of popular AVs can be tampered with (from Userland with <strong>high privileges</strong>), <strong>assuming that they are not protected by VBS</strong>.</p><p>The presented method could be used in the wild because the most important part of it is documented. If so, it was used rarely because I did not see any reference on the web.</p><p>It does not use vulnerable drivers and does not abuse PPL.</p><p></p><p><strong>The presented method is not a full attack, and it is not probable that it can affect home users.</strong> However, it can probably be used as a part of targeted attacks in businesses.</p><p>Zone Alarm is taken only as an example. The presented method was tested by the author on several well-known Antiviruses, with similar effects.</p><p></p><h3><a href="https://malwaretips.com/threads/the-comodos-challenge.129472/" target="_blank">App Review - The Comodo&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/comodos-challenge-part-2.129514/" target="_blank">App Review - Comodo&#039;s challenge part 2.</a></h3><h3><a href="https://malwaretips.com/threads/esets-challenge.129485/" target="_blank">App Review - Eset&#039;s challenge.</a></h3><h3><a href="https://malwaretips.com/threads/microsoft-defenders-challenge.129597/" target="_blank">App Review - Microsoft Defender&#039;s challenge</a>.</h3>
<h3><h3><a href="https://malwaretips.com/threads/bitdefenders-challenge.129753/" target="_blank">App Review - Bitdefender&#039;s challenge.</a></h3>
</h3></blockquote><p></p>

[QUOTE="Andy Ful, post: 1079944, member: 32260"] I created this video as the continuation of the AVs challenge to show that Antimalware kernel drivers and protected services of popular AVs can be tampered with (from Userland with [B]high privileges[/B]), [B]assuming that they are not protected by VBS[/B]. The presented method could be used in the wild because the most important part of it is documented. If so, it was used rarely because I did not see any reference on the web. It does not use vulnerable drivers and does not abuse PPL. [B]The presented method is not a full attack, and it is not probable that it can affect home users.[/B] However, it can probably be used as a part of targeted attacks in businesses. Zone Alarm is taken only as an example. The presented method was tested by the author on several well-known Antiviruses, with similar effects. [HEADING=2][URL='https://malwaretips.com/threads/the-comodos-challenge.129472/']App Review - The Comodo's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/comodos-challenge-part-2.129514/']App Review - Comodo's challenge part 2.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/esets-challenge.129485/']App Review - Eset's challenge.[/URL][/HEADING] [HEADING=2][URL='https://malwaretips.com/threads/microsoft-defenders-challenge.129597/']App Review - Microsoft Defender's challenge[/URL]. [HEADING=2][URL='https://malwaretips.com/threads/bitdefenders-challenge.129753/']App Review - Bitdefender's challenge.[/URL][/HEADING] [/HEADING] [/QUOTE]

Verification