Multiple Major Security Products Open To Big Vulns Via 'Hooking Engines'

The momentum's been growing the last few years for the security community to turn its microscope inward as security researchers start to dig in earnest for serious vulnerabilities within security products. That'll be reflected in several talks at Black Hat USA in Las Vegas next week -- including research from enSilo that takes a thorough look at six different common security issues stemming from faulty implementation of code hooking and injections techniques.

Spread across 15 different products--many of them antivirus and security platforms--the discoveries resonate due to the fact that many security products and other applications use the same vulnerable hooking engines, making for a much broader attack surface area than if these hooking functions were developed on a one-off basis.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

Used by a range of products that depend on virtualization, sandboxing, performance management, or otherwise changing the behavior of operating system functions, hooking is an especially important technique for security products that depend on it to monitor for malicious activity on systems.

According to Udi Yavo and Tomer Bitton, co-founders enSilo, when they began the work that eventually blossomed into what would become their talk scheduled for next week, "Captain Hook: Pirating AVs to Bypass Exploit Mitigations," they initially thought they'd only found an isolated flaw in the anti-malware hooking engine of a single security product. But the scope of the problems grew as the pair found that many security platforms and other software are prone to serious vulnerabilities in the way their hooking engines interact with underlying system processes.

"Overall, hooking and injections are an important part of security products, because they have to monitor what’s happening in the system to operate,” Yavo says. “However, they must realize that doing such intrusive operations has implications that affect security. Ironically, the fact that they are in the system and vulnerable bypasses the security controls of the underlying operating system."

Not Just Security Software

Vulnerabilities in hooking engines also go beyond security products, the researchers say. As part of their presentation, they'll also discuss issues in the Microsoft Detours hooking engine, which is due out for a patch in August. However, it was the security product implications that really resonated with the duo; issues in these types of products are particularly insidious because security practitioners tend to view them as inviolate.

For example, if a security product were to report an attack through a vulnerable security product, most security teams would likely mark it as a false positive and move on, Yavo says. Security products are generally trusted, and the overwhelming number of alerts would probably cause most organizations to overlook such a warning, he warns.

Yavo and Britton found a number of exploits that would be effective against some of the security products they examined. Affected vendors included AVG, Kaspersky, McAfee, Symantec, Trend Micro, Bitdefender, Webroot, AVAST and Vera. For example, in one AV, they were able to show that an attacker could exploit improper hooking implementations to bypass ASLR in both 32-bit and 64-bit applications.

 "There was also another vendor which was maybe even a bit worse,” Yavo says. “If you combined all the issues that they had with the injections and the hooking, it allowed the attacker to gain persistency on the system because the injection method was not secure. An attacker could message their injection method to get injected into every process in the system, because the hooking engine was also flawed.”

The presentation is scheduled for Wednesday, August 3, but those interested in the presentation can get a technical teaser of some of the pair's findings in a blog they recently posted about their work.