Is security software becoming a risk?
That’s what Thierry Zoller believes. For the past two years, the security engineer for n.runs AG has taken a close look at the way anti-virus software inspects e-mail traffic, and he thinks companies that try to improve security by checking data with more than one anti-virus engine may actually be making things worse.
Why? Because bugs in the "parser" software used to examine different file formats can easily be exploited by attackers, so increasing your use of anti-virus software increases the chances that you could be successfully attacked.
Anti-virus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.
Zoller and his colleague, Sergio Alvarez, have been looking into this issue for the past two years and they have found more than 80 parser bugs in anti-virus software, most of which have not yet been patched.
The flaws they have found affect every major anti-virus vendor, and many of them could allow attackers to run unauthorised code on a victim’s system, Zoller says.
"People think that putting one AV engine after another is somehow defence in depth. They think that if one engine doesn’t catch the worm, the other will catch it," he adds. "You have not decreased your attack surface; you have increased it, because every AV engine has bugs."
Although attackers have exploited parsing bugs in browsers for years now, with some success, Zoller believes that because anti-virus software runs everywhere, and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future.
The bottom line, he says, is that anti-virus software is broken. "One e-mail and boom, you’re gone," he adds.
Research into parsing bugs has been spurred by a heightened focus in recent years on "fuzzing" software, which is used by researchers to flood software with a barrage of invalid data in order to see if the product can be made to crash.
This is often the first step toward discovering a way of running unauthorised software on a victim’s machine.
A parsing bug in the way the Safari browser processed .tiff graphic files was used recently to circumvent Apple’s strict controls over what software may be installed on the iPhone.
Zoller says he has been criticised by his peers in the security industry for "questioning the very glue that holds IT security all together," but he believes that by bringing this issue to the forefront, the industry will be forced to address a very real security problem.
Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in antivirus software were remotely exploitable, meaning that attackers could launch their attacks from anywhere on the Internet. Nowadays, that percentage is close to 80%, he says.
Zoller’s company sees a business opportunity here. N.runs, based in Oberursel, Germany, is building a product, code-named ParsingSafe, that aims to help to protect anti-virus software from the kind of parsing attacks that he has documented.
Russ Cooper, a senior scientist with Verizon Business, had some criticism for the work of n.runs. "The research almost appears to be goading criminals into ’getting better’ at attacking vulnerabilities … hardly helpful," he says.
"There is no doubt that the list of vulnerabilities already published in security products looks daunting. However, historically, we have not seen this type of vulnerability exploited."
Though Cooper agrees that anti-virus file parsing vulnerabilities do pose a risk, he says that there are several reasons they have not yet been the focus of widespread criminal attacks.
For one, criminals are already being effective enough with their current tactics, such as sending malicious e-mail attachments.
A second reason is that security software tends to get more scrutiny, meaning that any vulnerability that was being exploited would be quickly patched, and that any criminal involved in an exploit would be more likely to be caught.
Security vendors have long known about vulnerabilities in their software, says Marc Maiffret, chief technology officer with eEye digital security.
"Security software is just as vulnerable as any other software," he adds. "We all hire the same developers that went to the same colleges as Microsoft and learned the same bad habits."
Loading ...