Malware Modification Contest Has Antivirus Vendors Upset 167
SkiifGeek writes "Race to Zero, a sideline competition being set up at this year's DefCon, already has some Antivirus vendors steaming over the objectives of the contest. They are upset because it is essentially a polymorphism exercise. Entrants are given a set of malware samples which they must then modify to pass through a battery of antivirus scanners without detection while still carrying a viable payload. Even if competitors ignore the published vulnerabilities and weaknesses affecting antivirus vendors, the competition should turn up some interesting results. It may provide technical insight and concepts for further research as similar competitions have done in the past."
Oh no! (Score:5, Insightful)
Re:Oh no! (Score:4, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
Re:Oh no! (Score:5, Insightful)
Re: (Score:2)
This is something that anti-virus company should have been doing themselves CONSTANTLY anyway, and it's only now that someone is doing something they should have been doing all along that they decide to wipe the tomato off their face?
The line between anti-virus and adware/spyware/malware scanner is blurring so much now anyway that they're seemingly just upset over having to do more work. Basically they're just up-selling bloatware now, and scaring grandmothers and soccer mom's into thinking they
Re: (Score:2)
Why should this upset them? (Score:5, Insightful)
Heck, if I were Symantec, McAffee et al -- I'd take the opportunity to try to *recruit* programmers who had interesting entries in the contest! (Better to have them working for you, right?)
Re:Why should this upset them? (Score:5, Informative)
Re:Why should this upset them? (Score:5, Interesting)
Re: (Score:2, Interesting)
Re:Why should this upset them? (Score:5, Insightful)
They dont need actually viruses and malware, they just need people (and businesses) to be afraid of them enough to consider them treat.
All you have to give to people is feeling of security and to make them think that you can shield them from any nasty stuff they might have heard on TV. And people are easily scared because they in general know little about computers.
People are scared and they get AVs (or careless and they wouldnt get AV even if there was billion of virii), so you fight for market share rather than install.
And your only feature you are ging to sell to those people is confidence of unpenetrable shield.
So yeah, AV companies do want perception of threat high and actually threat low. Thats when they make most money.
Every reall threat costs them money, Every imaginary threat makes them money.
Re: (Score:2, Informative)
Re: (Score:2)
Anti-malware programs are more like a very strong padlock on a flimsy Windows OS door. The padlock may be tough, but the door is easy to kick in or simply take off the hinges. The only one who can make it hard to get into the computer (house) is the maker of the OS (door). OSX and Linux have a stronger door and a good lock. Hanging on a stronger padlock won't give much extra protection against burglars and the padlock sellers know that.
They had a lock picking cont
Re: (Score:2)
Re:Why should this upset them? (Score:5, Insightful)
Re: (Score:2, Insightful)
Take for example, Network Intrusion Detection Systems.
Re: (Score:2)
I don't even need a sales force. True, it cost me more to have in house peons gather virus signatures and add them to my database, or add algorithms to my AV tools, but since I don't have to pay nearly as much for a sales force more viruses equals greater profits.
I think this part of your calculation is a little off. Virus scanners are not just signature engines (ideally). I think the "actual threat" of viruses is far less significant that the "percieved threat", and anyone with money prepares for the "perceived threat". I'd draw an analogy with home security systems. The people that buy home security systems are typically the least likely to need them because they are liklely to be relatively wealthy and live in relatively low-crime areas. So even though the threa
Re: (Score:3, Insightful)
Re: (Score:1)
Re:Why should this upset them? (Score:5, Interesting)
Re: (Score:3, Informative)
If passed into law (this bill already has passed the house twice but never has cleared the Senate), I-SPY would make it a criminal offense punishable by fines and/or up to five years in prison for "intentionally access[ing] a protected computer without authorization, or exceed[ing] authorized access to a protected computer, by causing a computer program or code to be copied onto the protected computer, and intentionally us[ing] that program or code in furtherance of another Federal criminal offense." Similar activity that is designed to defraud or injure a person or cause damage to a protected computer, but is not conducted in furtherance of another Federal offense, subjects the perpetrator to a fine and/or up to two years in prison.
I'm fairly sure viruses would fall under at least the bold part. I have no idea how much (if at all) this is a result of lobbying by antivirus vendors.
Re: (Score:2)
Re:Why should this upset them? (Score:5, Insightful)
Essentially, this punches a huge hole in the security model of Norton and McAfee's product lines, rendering them completely ineffective against this sort of threat.
Personally, I've always found it remarkable that they've managed to hold on as long as they have, given just how deeply flawed the very notion of an Antivirus is.
As long as you've got a decently secure operating system, nothing more than a rudimentary antivirus should be necessary.
Re:Why should this upset them? (Score:5, Insightful)
I don't care how secure your OS is, if users are going to click on SomeFamousPersonNaked.exe , then they are going to eventually get owned - "secure" OS or not. We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
I run both Windows and Linux and the only time I have had a AV product tell me "oh noes, there is a virus" is when I have been manually TRYING to infect a system in order to reverse engineer what the damn thing does (in order to create cleanup packages for work). These are in non-networked VM's where we also re-image the host afterwards. But really - a secure USER is what we need. The OS won't make all that much difference compared to the user.
Re: (Score:2, Insightful)
I don't care how secure your OS is, if users are going to click on SomeFamousPersonNaked.exe , then they are going to eventually get owned - "secure" OS or not. We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
No. Linux and MacOS do not get attacked, because normal users don't run with the sort of privileges that would allow the virus (or trojan as in your example) to do very much damage or replicate itself.
Similarly, replication of such a virus becomes even more difficult, as E-mail clients and servers both generally tend to block attachments containing executables...
Sure, there are mechanisms for it to happen, but trojans generally don't spread very fast or very far. A true "virus" typically utilizes an OS e
Re:Why should this upset them? (Score:5, Insightful)
Sure, it can't burn itself into the registry or equivalent, but it sure as hell can replicate itself. Hell, it can even cause a lot of headaches when you're lazy like me and have a whole drive mounted in
Trojans are a different beast, of course, as they rely on the OS more heavily.
Re: (Score:3, Informative)
Re: (Score:2)
And yes, this is a security/convenience trade-off. I'm a programmer. I don't have time to setup a user just for my executables, thank you.
Noexec is fine for an average user, but where should I, the programmer, put all my stuff?
Re: (Score:3, Insightful)
In the Windows case, I hope you have a backup because its time to re-install Windows.
PS, rkhunter is a great example of a program that detects for real Linux infections, for those looking.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
P.S. Last time I installed it, all sorts of nasty things happened to my pre-compiled stuff. What would you do about those? Clock is ticking.
Re:Why should this upset them? (Score:5, Insightful)
WTF? Any program I run has +rw access to ~ (can start itself from .profile, do arbitrary damage to all the files I actually care about, and steal passwords and the like) and the ability to connect(2) to random parts of the internet (ability to replicate, send passwords, and fetch ads). No privileges beyond this are needed to cause trouble.
The real reason is probably more to do with the size and average competency of the userbase.
Re: (Score:3, Informative)
But what happens when we actually DO accomplish full-on Linux on the desktop? What happens if, hypotheti
Privileges are needed (Score:4, Insightful)
There's not need for elevated permissions.
No there is need. Under Linux a non privileged software has only access to high-level network access, such as opening a regular connection. There's no low-level access to network (crafting the data packets as wished) for non privileged software.
Thus a potential running virus, *COULD* connect to its C&C if it receives its orders from an IRC channel.
But the virus won't be able to create spoofed packets (used for sophisticated bounces and DDOS) or specially crafted packets to exploit flaws on the target system.
Whereas under Windows, non-privileged applications CAN craft packets, and users run as administrators anyway.
A non privileged process CAN download Ads from the internet, but it will have a harder time injecting them into the browser window.
An admin-privileged process in Windows could hijack the network stack and rewrite HTML on the fly inserting pop-ups and ads.
Under a non-privileged account in Linux, it can't. The virus will need instead to be able to rewrite the configuration of all gazillion of browser that exist in Linux, either injecting a spyware plugin or rerouting the traffic through a proxy process spawned by the virus. Anyway, the absence of a single point of attack, and the lack of monoculture make Linux a more complicated target.
Also, few user-friendly type distros (Ubuntu and the like) come with a sendmail (or equivalent) configured out-of-the-box for internet message delivery. Usually it's only configured to deliver alerts to the local user account.
A potential operational Spam bot would either have to send directly the spam to the internet and both hope that the network isn't configured to reject email not going out through the SMTP server and hope that the infected machine doesn't sit on a dynamic IP which will automatically get discarded on the receiving machine.
Or the potential Spam Bot will need additional complexity to retrieve the user's SMTP configuration, which will be difficult, both because there's a gazillion of different mail clients under linux, and both because several of them password-encrypt the credential (Thunderbird can do it and all KDE software store their passwords in KWallet which is masterpassword-encrypted by default).
This is security by diversity, and why it's good to avoid monocultures.
This is opposed to Windows, where most users have outlook express, which lacks the ability to encrypt the credentials.
Under Linux, it takes several step to execute code downloaded from a browser, as a reference, see the HOWTOs about downloading the latest GPU drivers straigth from the constructor site instead of using whatever is the regular package management/delivery mechanism used by the distro (you have to manually chmod it "executable". Clicking on it usually opens an editor).
And that's neglecting that it is possible to "noexec" the whole home, in which case it's not even possible to *run* code from ~.
So even if he wanted to, a linux user can't just click on "NataliePortmanNaked.sh" and execute it (unless its a regular package inside Synaptic or YaST, of course) whereas a Windows user can click on "PetrifiedWithHotGrits.exe".
Also, downloading software from random websites isn't as common in Linux as in Windows. Mostly only geeks download software for Linux and usually they download it in (controllable) source form, where anomalies could more easily get spotted.
The regular user will employ the package management system for the distro to get the needed package from the regular repository instead, as because of the diversity of Linux distros, he'll need a custom compiled packagee for the present distro,
ie.: Windows wanting kitten-powered screensaver will google around to find a page proposing some spyware infested screensaver. Anyone can download, but you *need* to be computer-literate and careful about your source to *avoid* getting undesired stuff.
The Linux users will browser Synaptic and download the package "omg-lol-ponie
Re: (Score:2)
Now, if removing crap from pwned Windows machines was that easy, we'd all be much better off.
Re: (Score:2)
Re: (Score:3, Interesting)
"wtf is this? You don't need network access or access to this directory, go away."
Mandatory Access Controls are coming along nicely. About time too.
Re: (Score:2)
In order for a program to run, does it not also need execute permission? If none of the users space has execute permissions, the virus can't run the first time. If all the users normal programs are in a read only program folder, how will a nasty program the user may have downloaded into his user space run the first time?
Re: (Score:3, Informative)
Re: (Score:2)
No. Linux and MacOS do not get attacked, because normal users don't run with the sort of privileges that would allow the virus (or trojan as in your example) to do very much damage or replicate itself.
I never really understand why people think this is true. What exactly are the privileges required to do damage, or replicate? Linux essentially runs as the logged in user. That means you can:
Run a process.
Send email.
Write to any file the user can.
A good virus needs to:
survive a reboot.
find a new target.
send
Re: (Score:2)
Just install yourself as a cron job, to be run once per hour for example. That way you don't even have to stay resident and won't show up in process listing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If the system has user crontabs (most *nix systems do) you can start up soon after boot. Even if not you can start up immediately after login which is sufficiant for a single user machine.
If you are feeling malicous you can also destroy the users data (which on a single user machine is probablly the most important thing on there).
Sending spam and hitting vulnerable services do not generally require any speci
Re: (Score:2)
That is assuming that the user is completely stupid, OTOH if you click dancingpigs.exe and get prompted to give your root password or even just accept/deny, most users will click cancel (if they dont you haven't explained sudo well enough).
No, they won't. They'll type in their passwords and click 'OK', because that's the only way they can see to get the computer to do what they want.
There is no way to secure a machine where an ignorant end user can run arbitrary code. Not now, not ever.
Re: (Score:2)
The next generation is considerably more computer literate, and most Windows users now do have a semi-decent idea of "what not to do" in terms of avoiding nastyware (or at the very least, the average user is more cognicent of this sort of thing than 3-4 years ago).
Re: (Score:2)
You underestimate humanity.
Nope. If anything, I overestimate them. I'm an optimist like that.
The next generation is considerably more computer literate, and most Windows users now do have a semi-decent idea of "what not to do" in terms of avoiding nastyware (or at the very least, the average user is more cognicent of this sort of thing than 3-4 years ago).
No, they don't. They still want to see $CELEBRITY naked. They're still happy to type a few words into a computer to do that. After all, what'the
Re: (Score:2)
And unfortunately if you make a system so secure even a fool can use it, only a fool would want to. /sigh/
BTW, I'm not disagreeing with you. This is the security vs usability dilemma. There is no satisfactory solution.
Not on Linux. (Score:4, Interesting)
As such, it is not particularly easy to download and run SomeFamousPersonNaked.bin -- you have to download it to somewhere, then you have to change its permissions, and then you have to run it -- and even then, they still don't have root.
However, for a very long time, an antivirus actually made some sort of sense on Windows, because you would have exploits from visiting a webpage or reading an email. You actually had a situation where the most security-conscious users would never use the Preview Pane, so that they could delete suspicious emails without looking at them. In that particular kind of insane world, it makes sense to have antivirus -- and that is precisely why antivirus seems so laughable now.
Re: (Score:2)
You're right that it's about secure users, but it's much easier to be a secure user on Linux, precisely because you would never download foo.exe -- or foo.sh, or whatever. For the most part, you get things through your package manager, or not at all.
Of course, that's because "you" know what you're doing and would act the same, even using Windows.
The typical end user, however, does not.
As such, it is not particularly easy to download and run SomeFamousPersonNaked.bin -- you have to download it to somew
Re: (Score:2)
Of course, that's because "you" know what you're doing and would act the same, even using Windows.
No, I wouldn't, because on Windows, there are no good package managers. Your best bet is to only install software that's good by reputation, and to do so from their domain -- meaning you're vulnerable to MITM attacks, etc.
All the attacker needs to do is wrap it in a .tgz file, where permissions are preserved.
Making it now several more steps -- you still have to unpack the tarball, and double-click the files inside. That's a far cry from clicking an executable, and then "Open from current location" and you're done.
Kind of like syntactic vinegar.
Re: (Score:3, Insightful)
We've all heard the "Linux doesn't get attacked much because it has an insignificant market share" and sort of argued around it - maybe the real one is "Linux doesn't get attacked much because the average Linux user knows enough to not click on ridiculous shit that gets emailed to them."
Which would put a very low upper limit on Linux's market share. The way Linux saves the noobs is that you don't do it in the first place, you go to add/remove programs and find the software you want there. The way Linux saves the warez-wannabes is that Linux doesn't need cracks. I'm sure that if Linux became more mainstream with more commercial software, you could have trusted shops that you could add in the same way as repositories. Think something like tucows, cnet, snapfiles etc. only for Linux. Basicly
Re: (Score:2)
Re: (Score:2)
Sure, I could perhaps convince Joe Linux user to run "rm -rf
Re: (Score:2)
Did you just say that the firewall protects against buffer overflows on inbound ports? Block traffic? Yes. Permit traffic? Yes. Inspect for buffer overflows?
Re: (Score:2)
Viruses (not worms) are a stupid user issue. There's not much you can do about that, the thing will get run, and your beloved antivirus program of choice will not protect you from your users.
Re: (Score:2)
If you can just break your code into several hundred or thousand blocks of nonthreatening code, then all you need is a way to randomize their placement in the binary. It doesn't seem THAT difficult. You could even have it relink itself into a new binary every time it is run.
You would probably need to separate the original programming from the randomization for debugging reasons. In other words you would probab
Re: (Score:2)
Wow. Somebody has never worked in the security field before.
The OS doesn't matter a tenth as much as the user matters. As long as the user has the ability to execute code (with any rights, not necessarily root or admin), then viruses will spread. Links in web pages, instant messages, email attachments... whatever it is, the USER is the problem, not the OS.
OpenBSD would make a fine virus
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Managing short-term and long-term resources (Score:4, Interesting)
But what if what the antivirus vendors need is not time to study but time to come up with cures? I've worked on plenty of software where the problem was well-understood, but you could be so pestered to death by people trying to tell you there was a problem that you had no time left to work on a cure.
I don't follow this community closely, but speaking from general knowledge of software projects over several decades ...
It seems likely that these competitions do not teach the antivirus vendors what they don't know. It probably creates a firedrill internally where a long-range effort to do a substantive upgrade that would do what people wish for is side-tracked by a short-term need to make sure that people's machines are not broken into by a new stupid trick today, thanks to additional resources provided by well-meaning but "mal-informed" volunteers.
Resources are always in short supply in companies, and there's a constant need to triage between short-term and long-term planning. Events like this increase the stress on short-term projects, causing them to draw precious resources away from long-term projects. The claim that this provides valuable data to the vendors sounds like spin created by malware vendors who are chuckling all the way to the bank because they get free help from a community of people who I suspect don't realize the harm they are doing.
What they should be having is competitive events to come up with cool public-domain techniques for recognizing and stopping such malware in the general cases, thus reducing short-term strain on anti-virus vendors.
Re: (Score:2)
Can you say Ralph Nader? (Score:5, Insightful)
lets translate FTFA
How about this slogan "Unsafe with any version!"
I think they are afraid that regular joe end users are about to find out that programs meant to protect your pc are always an after the fact effort which leaves you vulnerable until you update and that there is no way to keep you safe from a zero-day facebook exploit. Even the government websites can be malicious until patched/fixed.
And soon, the conclusion will be
Wow, it would be such a shame if joe bloggs end user found out the truth. tisk tisk
Re: (Score:2)
Solution:
Update to version 0.93.
The vulnerabilities are reported in versions prior to 0.92.1.
Solution:
Update to version 0.92.1.
This is exactly what I was saying, and is true of all antivirus software. If you don't stay updated, you are vulnerable. The POINT was why pay so much for it?
Depends on conditions... (Score:3, Insightful)
The AV vendors who are complaining are more afraid of *other* vendors than xploits... If anything found here goes to all then it levels the playing field open source style...
Andy
Re: (Score:1)
Re: (Score:1, Insightful)
Who said anything about "in private"? I hope they post all the entries on their website. Shouldn't consumers have the right to know how they're vulnerable?
Besides, I hardly believe the Defcon crowd will go for a "Trust us, for reasons we can't disclose, the winner was ..." And with all the people at Defcon, the results are bound to get leaked somewhere anyway.
Re: (Score:3, Insightful)
This contest will just go a little farth
Re: (Score:2)
really helpful (Score:1)
Trivial (Score:3, Interesting)
Hey,why are the cops ringing at my door???
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Guess what: Your invention has already been created. AF companies have countered with "heuristic" or "behavioral" virus detection. The purpose of this exercise is to game not just the signatures, but the heuristics as well.
Re: (Score:2)
The idea is trivial, not the implementation. That's why antivirus still work the way they do.
Re: (Score:2)
S
Re: (Score:2)
Bad publicity (Score:2)
Proactive instead of reactive (Score:1)
Re: (Score:2)
I think AV vendors would rather be in the business of selling a placebo than selling a cure.
What I fear personally is recombination, where malware writers start setting up protocols for automatically and randomly exchanging code/modules with other malware without need for human intervention. That's where I feel the next explosion could come from - both in the variety of malware and the speed at which new innovations propagate across various strains. The only thing holding it back would seem to be the pr
Re: (Score:2)
Maybe they should actually fix the problems? (Score:3, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
Since you seem to be a security expert in your own right, beyond anything Marcus have ever done, feel free to explain why this basic idea will not w
Problem vs solutions (Score:2)
Probably would be more clear if they were investigating with genetics/biological malware instead of computer one.
Re: (Score:2)
Re: (Score:2)
All problems have solutions and practicality becomes relative to how much you want to stay virus free.
Imagine a scenario like you mentioned in which there was no known solution, no patch forthcoming from MS or AV vendors, and internet connectivity meant you would be infected.
Then disconnecting your Windows computer from the net and using another operating system might be practical even if it means you have to give up productivity.
Suffice to say
I'm sure... (Score:2)
...that Michelle Madigan would love to get an undercover report of all the big mean hackers making new viruses in Las Vegas. Too bad she was busted last time she tried to spy on Defcon.
What? A real world test? Ev1l H4x0|~z! (Score:3, Insightful)
Of course, if you find the virus out in the wild and identify it, you've already failed for a lot of people. (but I'm sure they don't like to talk about that).
This is like a safe manufacturer objecting to someone actually trying to break open a safe like a real criminal would. "What! You used a crowbar and liquid nitrogen?! You're just letting the criminals know more about cold+crowbar usage!!! You should know OUR safes protect against sledgehammers VERY well."
Get real AV vendors. Everyone already knows you can't stand up to new viruses, and only protect against the known ones. People still buy your damn software anyway, because it's better than nothing.
Missed opportunity (Score:2)
No van analogy? (Score:2)
Trucks are interesting
What about the van?
http://en.wikipedia.org/wiki/Magic_Lantern_(software) [wikipedia.org]
That would be a fun contest.
Find the shoulder road.
Re: (Score:2, Insightful)
By Rice's theorem, proving any non-trivial property of a program is equivalent to the halting problem. Hence AV detection is an ultimately losing battle.
But then, there is no need to be able to prove 100% that the software is harmful. The simple rule could be: If you cannot proof that it isn't harmful, it's a security risk. Of course for that rule to be useful, the class of programs where you can prove it has to be large enough to allow for any useful behaviour. This certainly is hard, and maybe it's not achievable, but I don't know of any proof for that.
Note that the halting problem does not say that you cannot write a program which can tell for some algo
Re: (Score:2)
But then, there is no need to be able to prove 100% that the software is harmful. The simple rule could be: If you cannot proof that it isn't harmful, it's a security risk. Of course for that rule to be useful, the class of programs where you can prove it has to be large enough to allow for any useful behaviour. This certainly is hard, and maybe it's not achievable, but I don't know of any proof for that.
The trouble with that idea is stuff like DRM, copy protection, and game anti-cheat functionality. Deliberately written to make it hard to determine anything about what it does, uses malware-like obfuscation techniques, etc.