Malware Attack Bypasses Major Defenses

Security firm Matousec said it has discovered a vulnerability affecting almost all known security software. Malware can bait-and-switch security scanners, using unsuspicious system-level calls that get a secure green light, and then altering the calls to include attack code before they get executed.

According to Matousec’s advisory, "the results can be summarized in one sentence: If a product uses SSDT [system service descriptor table ] hooks or other kinds of kernel-mode hooks on a similar level to implement security features, it is vulnerable. In other words, 100% of the tested products were found vulnerable."

Tested products included all major antivirus vendors PC security suites, such as Kaspersky Internet Security 2010, McAfee Total Protection 2010, Norton Internet Security 2010, Sophos Endpoint Security and Control 9.0.5 and Trend Micro Internet Security Pro 2010.

At issue is hooking -- the prevailing technique that security software uses to protect a PC. Security suites often "hook" into the operating system at the user level, which Matousec said is inherently unsafe, or else lower down in the stack, through Windows DLL (dynamic link library) files, evaluating all calls and only allowing through ones they deem safe, thus preventing malicious processes or applications from running.

Next, any safe calls proceed, often via a bottom-level DLL file that communicates directly with the kernel. (The kernel is the bridge between applications and data processing.)

The attack affects both the user- and kernel-hooking techniques, and appears to also work on accounts which do not have administrator-level privileges. According Matousec, "all dynamic link libraries belonging to [the] Windows API reside in the user-mode portion of processes' address space, hence the application code might avoid calling them, which effectively bypasses hooks made by security software. If the application needs to communicate with the kernel, it can use the system call instruction directly. And this action cannot be caught or prevented by any type of user mode hooking."

Matousec said it developed proof-of-concept attack code, which it used to test numerous products. The firm declined to release the code, or to publish its recommendations for preventing hooking attacks, but said it notified affected vendors of the problem in October 2008 and that "some vendors confirmed the vulnerability."

Until vendors patch their software, Matousec recommends against installing multiple security products in an attempt to remediate the vulnerability. "One might think that installing two security applications will protect against the argument-switch attack. This makes, however, the situation even worse."

The problem, beyond a performance hit, is that both products will compete to "hook" any process first, making it unclear which product is at work at any given moment. Furthermore, products do not work in parallel; the attack can simply defeat whichever first grabs the hook.