Antivirus security: naked during updates

Abstract

SUMMARYThe security of modern computer systems heavily depends on security tools, especially on antivirus software solutions. In the anti‐malware research community, development of techniques for evading detection by antivirus software is an active research area. This has led to malware that can bypass or subvert antivirus software. The common strategies deployed include the use of obfuscated code and staged malware whose first instance (usually installer such as dropper and downloader) is not detected by the antivirus software. Increasingly, most of the modern malware are staged ones in order for them to be not detected by antivirus solutions at the early stage of intrusion. The installers then determine the method for further intrusion including antivirus bypassing techniques. Some malware target boot and/or shutdown time when antivirus software may be inactive so that they can perform their malicious activities. However, there can be another time frame where antivirus solutions may be inactive, namely, during the time of update. All antivirus software share a unique characteristic that they must be updated at a very high frequency to provide up‐to‐date protection of their system. In this paper, we suggest a novel attack vector that targets antivirus updates and show practical examples of how a system and antivirus software itself can be compromised during the update of antivirus software. Local privilege escalation using this vulnerability is also described. We have investigated this design vulnerability with several of the major antivirus software products such as Avira, AVG, McAfee, Microsoft, and Symantec and found that they are vulnerable to this new attack vector. The paper also discusses possible solutions that can be used to mitigate the attack in the existing versions of the antivirus software as well as in the future ones. Copyright © 2013 John Wiley & Sons, Ltd.

Design, implementation and evaluation of a novel anti-virus parasitic malware

“…Byungho et al have discovered that a core component of Avira can be paused during an update, which leads to a total compromise of Avira; full details can be found in their work [22]. To summarise, Avira's Real-Time Protection service is restarted on some updates.…”

“…For example, a service and a couple of drivers are in charge of selfprotection in Avira AntiVirus 2013 product line [22]. RealTime Protection service is crucial in Avira's self-protection mechanism, because it provides real-time protection not only to the system (such as on-access detection of malware), but also to itself (self-protection such as prevention of unauthorised alteration on Avira's processes, files, and registry keys).…”

Design and Analysis of a New Feature-Distributed Malware

“…Chari et al discussed unsafe component resolution on Unix, and proposed a mechanism to prevent such unsafe resolutions by detecting modifications to path names by untrusted users on the system [25]. Min et al showed that replacing protected software component of anti-virus solutions is possible [21]. They explored major anti-virus vendors such as Symantec, McAfee, AVG, and Avira, and successfully compromised antivirus solutions during their update.…”

“…Similarly, new files cannot be added to the AVG folder. Therefore, it is much harder to replace or modify AVG's files [21].…”

A novel malware for subversion of self-protection in anti-virus

“…Self‐protection feature is usually implemented with one or more kernel‐mode drivers and Windows services. For example, a service and a couple of drivers are in charge of self‐protection in AVIRA ANTIVIRUS 2013 (Avira, Tettnang, Germany) product line . Real‐Time Protection service is crucial in Avira's self‐protection mechanism, because it provides real‐time protection not only to the system (such as on‐access detection of malware) but also to itself (self‐protection such as prevention of unauthorised alteration on Avira's processes, files, and registry keys).…”