• We've upgraded our forums. Please post any issues/requests in this thread.

Is Security Software Becoming a Security Risk?

Polaris573

Senior Moderator
Joined
Feb 26, 2005
Messages
4,268 (0.91/day)
Likes
672
Location
Little Rock, USA
Processor LGA 775 Intel Q9550 2.8 Ghz
Motherboard MSI P7N Diamond - 780i Chipset
Cooling Arctic Freezer
Memory 6GB G.Skill DDRII 800 4-4-3-5
Video Card(s) Sapphire HD 7850 2 GB PCI-E
Storage 1 TB Seagate 32MB Cache, 250 GB Seagate 16MB Cache
Display(s) Acer X203w
Case Coolermaster Centurion 5
Audio Device(s) Creative Sound Blaster X-Fi Xtreme Music
Power Supply OCZ StealthXStream 600 Watt
Software Windows 7 Ultimate x64
#1
Is the software we're using to protect ourselves from online attacks becoming a liability? That's what Thierry Zoller believes. For the past two years, the security engineer for n.runs AG has taken a close look at the way antivirus software inspects e-mail traffic, and he thinks companies that try to improve security by checking data with more than one antivirus engine may actually be making things worse. Why? Because bugs in the "parser" software used to examine different file formats can easily be exploited by attackers, so increasing your use of antivirus software increases the chances that you could be successfully attacked. Antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.

Zoller and his colleague Sergio Alvarez have been looking into this issue for the past two years and they've found more than 80 parser bugs in antivirus software, most of which have not yet been patched. The flaws they've found affect every major antivirus vendor, and many of them could allow attackers to run unauthorized code on a victim's system, Zoller said. "People think that putting one AV engine after another is somehow defense in depth. They think that if one engine doesn't catch the worm, the other will catch it," he said. "You haven't decreased your attack surface; you've increased it, because every AV engine has bugs". Although attackers have exploited parsing bugs in browsers for years now, with some success, Zoller believes that because antivirus software runs everywhere, and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future. The bottom line, he says, is that Antivirus software is broken. "One e-mail and boom, you're gone," he said. Research into parsing bugs has been spurred by a heightened focus in recent years on "fuzzing" software, which is used by researchers to flood software with a barrage of invalid data in order to see if the product can be made to crash. This is often the first step toward discovering a way of running unauthorized software on a victim's machine. A parsing bug in the way the Safari browser processed .tiff graphic files was used recently to circumvent Apple's strict controls over what software may be installed on the iPhone. Zoller says he has been criticized by his peers in the security industry for "questioning the very glue that holds IT security all together," but he believes that by bringing this issue to the forefront, the industry will be forced to address a very real security problem. Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in antivirus software were remotely exploitable, meaning that attackers could launch their attacks from anywhere on the Internet. Nowadays, that percentage is close to 80 percent, he said. Zoller's company sees a business opportunity here. N.runs, based in Oberursel, Germany, is building a product, code-named ParsingSafe, that will help protect antivirus software from the kind of parsing attacks that he has documented. Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. "The research almost appears to be goading criminals into 'getting better' at attacking vulnerabilities ... hardly helpful," he said via instant message. "There's no doubt that the list of vulnerabilities they have already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited." Though Cooper agrees that antivirus file parsing vulnerabilities do pose a risk, he said there are several reasons they have not yet been the focus of widespread criminal attacks. For one, criminals are already being effective enough with their current tactics, such as sending malicious e-mail attachments. A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught. Security vendors have long known about vulnerabilities in their software, said Marc Maiffret, chief technology officer with eEye digital security. "Security software is just as vulnerable as any other software," he said via instant message. "We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits."

Show full news post
 

Random Murderer

The Anti-Midas
Joined
Dec 6, 2006
Messages
6,977 (1.73/day)
Likes
1,887
Location
Florida, A.K.A. the Sweatbox
System Name TOO MUCH RADIATOR! | The TV Box a.k.a. The Shoebox
Processor Core i7 4930K @ 4.5GHz | Core i5 6600K @ 4.5GHz
Motherboard Asus X79 Rampage IV Extreme | Asus Z170i Pro Gaming
Cooling Custom water on CPU and GPU, dual 360mm radiators | Corsair H80i
Memory 4x 8GB G.Skill TridentX DDR3-1600 | 2x 4GB G.Skill RipJaws 4 DDR4-3000
Video Card(s) Sapphire AMD R9 295x2 | PowerColor AMD HD7970
Storage Samsung SSD 830 256GB, various others | 2x 1TB Seagate Barracudas in RAID1
Display(s) Dell U2713HM 2560x1440 IPS | Panasonic TC-L32E5 1080p IPS TV
Case Thermaltake Suppressor F51 (stripped down to hold two radiators) | Cooler Master Elite 130
Audio Device(s) RM-DAC -> Xiang Sheng 708b -> Sennheiser HD650 | HDMI sound device on 7970
Power Supply LEPA G1600-MA 1600W | Corsair CX750M 750W
Software Win 10 64
Benchmark Scores over 9000 BungholioMarks, "Bitchin' Fast"
#2
i'll summarize it for the lazy readers:
YES.
 

F-22

New Member
Joined
Nov 9, 2007
Messages
103 (0.03/day)
Likes
7
#3
Not only might it be a secuirty risk, but they're unnecessary unless you're a AOL Grandma, or a Myspace noob.
 
Joined
Feb 26, 2007
Messages
850 (0.22/day)
Likes
23
Location
USA
#4
i'll summarize it for the lazy readers:
YES.
LoL
Not only might it be a secuirty risk, but they're unnecessary unless you're a AOL Grandma, or a Myspace noob.
There are probably a lot of people out there that are better off with AV software. If people were more willing to sit down and pay attention to an hour of information on how to keep yourself safe they would be better off. But people seem to be happier paying ~$20 a month for it.
 
Joined
Nov 12, 2006
Messages
2,996 (0.74/day)
Likes
232
Location
London - Close your eyes and you'll see me
System Name COLOSSUS-MK4
Processor E8400 @4.4 GHz - FSB @550 MHZ
Motherboard Asus P5K Premium (Black Pearl)
Cooling Xigmatek HDT-S1283
Memory 2x1GB Geil BlckDrgn 800 @1158 5-5-5-18
Video Card(s) 8800GT 512MB @740/1782/2080
Storage Hitachi T7K250 250GB & 7200.10 Seagate 250GB
Display(s) Gateway FPD1975W 19" Widescreen
Case Antec 1200
Audio Device(s) Xi-FI Xtreme Audio
Power Supply CoolerMaster IGreen 500W
Software XP Home SP3
Benchmark Scores SuperPi: 10.563 Sciencemark: 2563.14
#5
Not only might it be a secuirty risk, but they're unnecessary unless you're a AOL Grandma, or a Myspace noob.
I think they're pretty damn necessary. I can be as careful as I like and I'll find a few bugs in my machine every so often. They may not be serious but I buy online- I'm not taking the risk.