Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability!
AUTHOR: Andrey Bayora (www.securityelf.org) For more details, screenshots and examples please read his article "The Magic of magic byte" at www.securityelf.org . In addition, you will find a sample"triple headed" program which has 3 different 'execution entry points',depending on the extension of the file (exe, html or eml) - just change the extension and the SAME file will be executed by (at least) THREE DIFFERENT programs! (thanks to contributing author Wayne Langlois from www.diamondcs.com.au).
DATE: October 25, 2005
VULNERABLE vendors and software (tested):1. ArcaVir 2005 (engine 2005-06-03,vir def 2005-06-27, scanner ver2005-03-06, package ver 2005-06-21)2. AVG 7 (updates 24 June, ver.7.0.323, virus base 267.8.0/27)3. eTrust CA (ver 7.0.1.4, engine 11.9.1, vir sig. 9229)4. Dr.Web (v.4.32b, update 27.06.2005)5. F-Prot (ver. 3.16c, update 6/24/2005)6. Ikarus (latest demo version for DOS)7. Kaspersky (update 24 June, ver. 5.0.372)8. McAfee Internet Security Suite 7.1.5 (updates 25 June, ver 9.1.08,engine 4.4.00, dat 4.0.4519 6/22/2005)9. McAfee Corporate (updates 25 June, ver. 8.0.0 patch 10, vir def 4521,engine 4400)10. Norman ( ver 5.81, engine 5.83.02, update 2005/06/23)11. TrendMicro PC-Cillin 2005 (ver 12.0.1244, engine 7.510.1002, pattern2.701.00)12. TrendMicro OfficeScan (ver7.0, engine 7.510.1002, vir pattern 2.701.006/23/2005)13. Panda Titanium 2005 (updates 24 June, ver 4.02.01)14. UNA - Ukrainian National Antivirus (ver. 1.83.2.16 kernel v.265)15. Sophos 3.91 (engine 2.28.4, virData 3.91)
IMPORTANT NOTE:Similar vulnerability may exist in many other antivirus\anti-spyware desktop and gateway products. In addition, various "file filter" solutions may be affected as well.
DESCRIPTION:The problem exists in the scanning engine - in the routine that determines the file type. If some file types (file types tested are .BAT, .HTML and.EML) changed to have the MAGIC BYTE of the EXE files (MZ) at the beginning, then many antivirus programs will be unable to detect the malicious file. It will break the normal flow of the antivirus scanning and many existent and future viruses will be undetected. NOTE: In his test, he used the EXE headers (MZ), but it is possible to use other headers (magic byte) that will lead to the same effect. ANALYSIS:Some file types like .bat, .html and .eml can be properly executed even if they have some "unrelated" beginning. For example, in the case of .BAT files - it is possible to prepend some "junk" data at the beginning of thefile without altering correct execution of the batch file. In his tests, he used the calc.exe headers (first 120 bytes - middle of the dosstub section)to change 5 different files of existing viruses. In addition, the simplest test of this vulnerability is to prepend only the magic byte (MZ) to the existing malicious file and check if this file is detected by the antivirus program.
I really hope that most AV vendors will react ASAP to this because this vulnerability could be used by virus writers...
DATE: October 25, 2005
VULNERABLE vendors and software (tested):1. ArcaVir 2005 (engine 2005-06-03,vir def 2005-06-27, scanner ver2005-03-06, package ver 2005-06-21)2. AVG 7 (updates 24 June, ver.7.0.323, virus base 267.8.0/27)3. eTrust CA (ver 7.0.1.4, engine 11.9.1, vir sig. 9229)4. Dr.Web (v.4.32b, update 27.06.2005)5. F-Prot (ver. 3.16c, update 6/24/2005)6. Ikarus (latest demo version for DOS)7. Kaspersky (update 24 June, ver. 5.0.372)8. McAfee Internet Security Suite 7.1.5 (updates 25 June, ver 9.1.08,engine 4.4.00, dat 4.0.4519 6/22/2005)9. McAfee Corporate (updates 25 June, ver. 8.0.0 patch 10, vir def 4521,engine 4400)10. Norman ( ver 5.81, engine 5.83.02, update 2005/06/23)11. TrendMicro PC-Cillin 2005 (ver 12.0.1244, engine 7.510.1002, pattern2.701.00)12. TrendMicro OfficeScan (ver7.0, engine 7.510.1002, vir pattern 2.701.006/23/2005)13. Panda Titanium 2005 (updates 24 June, ver 4.02.01)14. UNA - Ukrainian National Antivirus (ver. 1.83.2.16 kernel v.265)15. Sophos 3.91 (engine 2.28.4, virData 3.91)
IMPORTANT NOTE:Similar vulnerability may exist in many other antivirus\anti-spyware desktop and gateway products. In addition, various "file filter" solutions may be affected as well.
DESCRIPTION:The problem exists in the scanning engine - in the routine that determines the file type. If some file types (file types tested are .BAT, .HTML and.EML) changed to have the MAGIC BYTE of the EXE files (MZ) at the beginning, then many antivirus programs will be unable to detect the malicious file. It will break the normal flow of the antivirus scanning and many existent and future viruses will be undetected. NOTE: In his test, he used the EXE headers (MZ), but it is possible to use other headers (magic byte) that will lead to the same effect. ANALYSIS:Some file types like .bat, .html and .eml can be properly executed even if they have some "unrelated" beginning. For example, in the case of .BAT files - it is possible to prepend some "junk" data at the beginning of thefile without altering correct execution of the batch file. In his tests, he used the calc.exe headers (first 120 bytes - middle of the dosstub section)to change 5 different files of existing viruses. In addition, the simplest test of this vulnerability is to prepend only the magic byte (MZ) to the existing malicious file and check if this file is detected by the antivirus program.
I really hope that most AV vendors will react ASAP to this because this vulnerability could be used by virus writers...
posted by Eddy Willems at 8:05 AM
<< Home