644374
story
Comments: 167 +- Developers: Malware Modification Contest Has Antivirus Vendors Upset on Sunday April 27 2008, @12:07PM
background: url(//a.fsdn.com/sd/topics/topicprogramming.gif); width:80px; height:48px;
programming
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicit.gif); width:75px; height:61px;
it
background: url(//a.fsdn.com/sd/topics/topictech2.gif); width:60px; height:80px;
technology
SkiifGeek writes "Race to Zero, a sideline competition being set up at this year's DefCon, already has some Antivirus vendors steaming over the objectives of the contest. They are upset because it is essentially a polymorphism exercise. Entrants are given a set of malware samples which they must then modify to pass through a battery of antivirus scanners without detection while still carrying a viable payload. Even if competitors ignore the published vulnerabilities and weaknesses affecting antivirus vendors, the competition should turn up some interesting results. It may provide technical insight and concepts for further research as similar competitions have done in the past."
Related Stories
A penny saved is ridiculous.
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
Oh no! (Score:5, Insightful)
Re:Oh no! (Score:4, Interesting)
Parent
Re: (Score:3, Interesting)
Re:Oh no! (Score:5, Insightful)
Parent
Why should this upset them? (Score:5, Insightful)
Heck, if I were Symantec, McAffee et al -- I'd take the opportunity to try to *recruit* programmers who had interesting entries in the contest! (Better to have them working for you, right?)
Re:Why should this upset them? (Score:5, Informative)
Parent
Re:Why should this upset them? (Score:5, Interesting)
Parent
Re: (Score:2, Interesting)
Re:Why should this upset them? (Score:5, Insightful)
They dont need actually viruses and malware, they just need people (and businesses) to be afraid of them enough to consider them treat.
All you have to give to people is feeling of security and to make them think that you can shield them from any nasty stuff they might have heard on TV. And people are easily scared because they in general know little about computers.
People are scared and they get AVs (or careless and they wouldnt get AV even if there was billion of virii), so you fight for market share rather than install.
And your only feature you are ging to sell to those people is confidence of unpenetrable shield.
So yeah, AV companies do want perception of threat high and actually threat low. Thats when they make most money.
Every reall threat costs them money, Every imaginary threat makes them money.
Parent
Re:Why should this upset them? (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Re:Why should this upset them? (Score:5, Insightful)
Essentially, this punches a huge hole in the security model of Norton and McAfee's product lines, rendering them completely ineffective against this sort of threat.
Personally, I've always found it remarkable that they've managed to hold on as long as they have, given just how deeply flawed the very notion of an Antivirus is.
As long as you've got a decently secure operating system, nothing more than a rudimentary antivirus should be necessary.
Parent
Re:Why should this upset them? (Score:5, Insightful)
I don't care how secure your OS is, if users are going to click on SomeFamousPersonNaked.exe , then they are going to eventually get owned - "secure" OS or not. We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
I run both Windows and Linux and the only time I have had a AV product tell me "oh noes, there is a virus" is when I have been manually TRYING to infect a system in order to reverse engineer what the damn thing does (in order to create cleanup packages for work). These are in non-networked VM's where we also re-image the host afterwards. But really - a secure USER is what we need. The OS won't make all that much difference compared to the user.
Parent
Re: (Score:2, Insightful)
I don't care how secure your OS is, if users are going to click on SomeFamousPersonNaked.exe , then they are going to eventually get owned - "secure" OS or not. We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
No. Linux and MacOS do not get attacked, because normal users don't run with the sort of privileges that would allow the virus (or trojan as in your example) to do very much damage or replicate itself.
Similarly, replication of such a virus becomes even more difficult, as E-mail clients and servers both generally tend to block attachments containing executables...
Sure, there are mechanisms for it to happen, but trojans generally don't spread very fast or very far. A true "virus" typically utilizes an OS e
Re:Why should this upset them? (Score:5, Insightful)
Sure, it can't burn itself into the registry or equivalent, but it sure as hell can replicate itself. Hell, it can even cause a lot of headaches when you're lazy like me and have a whole drive mounted in
Trojans are a different beast, of course, as they rely on the OS more heavily.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
In the Windows case, I hope you have a backup because its time to re-install Windows.
PS, rkhunter is a great example of a program that detects for real Linux infections, for those looking.
Re:Why should this upset them? (Score:5, Insightful)
WTF? Any program I run has +rw access to ~ (can start itself from .profile, do arbitrary damage to all the files I actually care about, and steal passwords and the like) and the ability to connect(2) to random parts of the internet (ability to replicate, send passwords, and fetch ads). No privileges beyond this are needed to cause trouble.
The real reason is probably more to do with the size and average competency of the userbase.
Parent
Re: (Score:3, Informative)
But what happens when we actually DO accomplish full-on Linux on the desktop? What happens if, hypotheti
Privileges are needed (Score:4, Insightful)
There's not need for elevated permissions.
No there is need. Under Linux a non privileged software has only access to high-level network access, such as opening a regular connection. There's no low-level access to network (crafting the data packets as wished) for non privileged software.
Thus a potential running virus, *COULD* connect to its C&C if it receives its orders from an IRC channel.
But the virus won't be able to create spoofed packets (used for sophisticated bounces and DDOS) or specially crafted packets to exploit flaws on the target system.
Whereas under Windows, non-privileged applications CAN craft packets, and users run as administrators anyway.
A non privileged process CAN download Ads from the internet, but it will have a harder time injecting them into the browser window.
An admin-privileged process in Windows could hijack the network stack and rewrite HTML on the fly inserting pop-ups and ads.
Under a non-privileged account in Linux, it can't. The virus will need instead to be able to rewrite the configuration of all gazillion of browser that exist in Linux, either injecting a spyware plugin or rerouting the traffic through a proxy process spawned by the virus. Anyway, the absence of a single point of attack, and the lack of monoculture make Linux a more complicated target.
Also, few user-friendly type distros (Ubuntu and the like) come with a sendmail (or equivalent) configured out-of-the-box for internet message delivery. Usually it's only configured to deliver alerts to the local user account.
A potential operational Spam bot would either have to send directly the spam to the internet and both hope that the network isn't configured to reject email not going out through the SMTP server and hope that the infected machine doesn't sit on a dynamic IP which will automatically get discarded on the receiving machine.
Or the potential Spam Bot will need additional complexity to retrieve the user's SMTP configuration, which will be difficult, both because there's a gazillion of different mail clients under linux, and both because several of them password-encrypt the credential (Thunderbird can do it and all KDE software store their passwords in KWallet which is masterpassword-encrypted by default).
This is security by diversity, and why it's good to avoid monocultures.
This is opposed to Windows, where most users have outlook express, which lacks the ability to encrypt the credentials.
Under Linux, it takes several step to execute code downloaded from a browser, as a reference, see the HOWTOs about downloading the latest GPU drivers straigth from the constructor site instead of using whatever is the regular package management/delivery mechanism used by the distro (you have to manually chmod it "executable". Clicking on it usually opens an editor).
And that's neglecting that it is possible to "noexec" the whole home, in which case it's not even possible to *run* code from ~.
So even if he wanted to, a linux user can't just click on "NataliePortmanNaked.sh" and execute it (unless its a regular package inside Synaptic or YaST, of course) whereas a Windows user can click on "PetrifiedWithHotGrits.exe".
Also, downloading software from random websites isn't as common in Linux as in Windows. Mostly only geeks download software for Linux and usually they download it in (controllable) source form, where anomalies could more easily get spotted.
The regular user will employ the package management system for the distro to get the needed package from the regular repository instead, as because of the diversity of Linux distros, he'll need a custom compiled packagee for the present distro,
ie.: Windows wanting kitten-powered screensaver will google around to find a page proposing some spyware infested screensaver. Anyone can download, but you *need* to be computer-literate and careful about your source to *avoid* getting undesired stuff.
The Linux users will browser Synaptic and download the package "omg-lol-ponie
Parent
Re: (Score:3, Interesting)
"wtf is this? You don't need network access or access to this directory, go away."
Mandatory Access Controls are coming along nicely. About time too.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Not on Linux. (Score:4, Interesting)
As such, it is not particularly easy to download and run SomeFamousPersonNaked.bin -- you have to download it to somewhere, then you have to change its permissions, and then you have to run it -- and even then, they still don't have root.
However, for a very long time, an antivirus actually made some sort of sense on Windows, because you would have exploits from visiting a webpage or reading an email. You actually had a situation where the most security-conscious users would never use the Preview Pane, so that they could delete suspicious emails without looking at them. In that particular kind of insane world, it makes sense to have antivirus -- and that is precisely why antivirus seems so laughable now.
Parent
Re: (Score:3, Insightful)
We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
Which would put a very low upper limit on Linux's market share. The way Linux saves the noobs is that you don't do it in the first place, you go to add/remove programs and find the software you want there. The way Linux saves the warez-wannabes is that Linux doesn't need cracks. I'm sure that if Linux became more mainstream with more commercial software, you could have trusted shops that you could add in the same way as repositories. Think something like tucows, cnet, snapfiles etc. only for Linux. Basicly
Re: (Score:2)
If you can just break your code into several hundred or thousand blocks of nonthreatening code, then all you need is a way to randomize their placement in the binary. It doesn't seem THAT difficult. You could even have it relink itself into a new binary every time it is run.
You would probably need to separate the original programming from the randomization for debugging reasons. In other words you would probab
Re: (Score:2)
Managing short-term and long-term resources (Score:4, Interesting)
But what if what the antivirus vendors need is not time to study but time to come up with cures? I've worked on plenty of software where the problem was well-understood, but you could be so pestered to death by people trying to tell you there was a problem that you had no time left to work on a cure.
I don't follow this community closely, but speaking from general knowledge of software projects over several decades ...
It seems likely that these competitions do not teach the antivirus vendors what they don't know. It probably creates a firedrill internally where a long-range effort to do a substantive upgrade that would do what people wish for is side-tracked by a short-term need to make sure that people's machines are not broken into by a new stupid trick today, thanks to additional resources provided by well-meaning but "mal-informed" volunteers.
Resources are always in short supply in companies, and there's a constant need to triage between short-term and long-term planning. Events like this increase the stress on short-term projects, causing them to draw precious resources away from long-term projects. The claim that this provides valuable data to the vendors sounds like spin created by malware vendors who are chuckling all the way to the bank because they get free help from a community of people who I suspect don't realize the harm they are doing.
What they should be having is competitive events to come up with cool public-domain techniques for recognizing and stopping such malware in the general cases, thus reducing short-term strain on anti-virus vendors.
Parent
Re:Why should this upset them? (Score:5, Interesting)
Parent
Re: (Score:3, Informative)
If passed into law (this bill already has passed the house twice but never has cleared the Senate), I-SPY would make it a criminal offense punishable by fines and/or up to five years in prison for "intentionally access[ing] a protected computer without authorization, or exceed[ing] authorized access to a protected computer, by causing a computer program or code to be copied onto the protected computer, and intentionally us[ing] that program or code in furtherance of another Federal criminal offense." Similar activity that is designed to defraud or injure a person or cause damage to a protected computer, but is not conducted in furtherance of another Federal offense, subjects the perpetrator to a fine and/or up to two years in prison.
I'm fairly sure viruses would fall under at least the bold part. I have no idea how much (if at all) this is a result of lobbying by antivirus vendors.
Can you say Ralph Nader? (Score:5, Insightful)
lets translate FTFA
How about this slogan "Unsafe with any version!"
I think they are afraid that regular joe end users are about to find out that programs meant to protect your pc are always an after the fact effort which leaves you vulnerable until you update and that there is no way to keep you safe from a zero-day facebook exploit. Even the government websites can be malicious until patched/fixed.
And soon, the conclusion will be
Wow, it would be such a shame if joe bloggs end user found out the truth. tisk tisk
Re: (Score:2)
Solution:
Update to version 0.93.
The vulnerabilities are reported in versions prior to 0.92.1.
Solution:
Update to version 0.92.1.
This is exactly what I was saying, and is true of all antivirus software. If you don't stay updated, you are vulnerable. The POINT was why pay so much for it?
Depends on conditions... (Score:3, Insightful)
The AV vendors who are complaining are more afraid of *other* vendors than xploits... If anything found here goes to all then it levels the playing field open source style...
Andy
Re: (Score:3, Insightful)
This contest will just go a little farth
Trivial (Score:3, Interesting)
Hey,why are the cops ringing at my door???
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Guess what: Your invention has already been created. AF companies have countered with "heuristic" or "behavioral" virus detection. The purpose of this exercise is to game not just the signatures, but the heuristics as well.
Bad publicity (Score:2)
Maybe they should actually fix the problems? (Score:3, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
Since you seem to be a security expert in your own right, beyond anything Marcus have ever done, feel free to explain why this basic idea will not w
Problem vs solutions (Score:2)
Probably would be more clear if they were investigating with genetics/biological malware instead of computer one.
Re: (Score:2)
Re: (Score:2)
All problems have solutions and practicality becomes relative to how much you want to stay virus free.
Imagine a scenario like you mentioned in which there was no known solution, no patch forthcoming from MS or AV vendors, and internet connectivity meant you would be infected.
Then disconnecting your Windows computer from the net and using another operating system might be practical even if it means you have to give up productivity.
Suffice to say
I'm sure... (Score:2)
...that Michelle Madigan would love to get an undercover report of all the big mean hackers making new viruses in Las Vegas. Too bad she was busted last time she tried to spy on Defcon.
What? A real world test? Ev1l H4x0|~z! (Score:3, Insightful)
Of course, if you find the virus out in the wild and identify it, you've already failed for a lot of people. (but I'm sure they don't like to talk about that).
This is like a safe manufacturer objecting to someone actually trying to break open a safe like a real criminal would. "What! You used a crowbar and liquid nitrogen?! You're just letting the criminals know more about cold+crowbar usage!!! You should know OUR safes protect against sledgehammers VERY well."
Get real AV vendors. Everyone already knows you can't stand up to new viruses, and only protect against the known ones. People still buy your damn software anyway, because it's better than nothing.
Re: (Score:2)
I think AV vendors would rather be in the business of selling a placebo than selling a cure.
What I fear personally is recombination, where malware writers start setting up protocols for automatically and randomly exchanging code/modules with other malware without need for human intervention. That's where I feel the next explosion could come from - both in the variety of malware and the speed at which new innovations propagate across various strains. The only thing holding it back would seem to be the pr
Re: (Score:2, Insightful)
By Rice's theorem, proving any non-trivial property of a program is equivalent to the halting problem. Hence AV detection is an ultimately losing battle.
But then, there is no need to be able to prove 100% that the software is harmful. The simple rule could be: If you cannot proof that it isn't harmful, it's a security risk. Of course for that rule to be useful, the class of programs where you can prove it has to be large enough to allow for any useful behaviour. This certainly is hard, and maybe it's not achievable, but I don't know of any proof for that.
Note that the halting problem does not say that you cannot write a program which can tell for some algo