Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bug

[Bipin Gautam <visitbipin@xxxxxxxxxxx>]

Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bug.

Affected Product (Only tested on...):

Mcafee Virus Scan professional (8.0.0.12)
Norton Antivirus 2003
Kaspersky 4.5x
Ad-Aware (6.0.1.181)
The Cleaner

Risk Level: Medium


Description:
------------

A malicious code can reside in a computer (with users privilege) bypassing 
"manual scans" of any Antivirus, Trojan & Spy ware scanners by simply issuing 
this command to itself.

cacls.exe hUNT.exe /T /C /P dumb_user:R

If "only execute" permission is set some AV auto-protect engine will also fail 
t stop a malicious code execution....By this way... any software?s with even 
Admin. privilege can't access this file (hUNT.exe) normally because the only 
person who has normal access to this file is "dumb_user"

If the scanner is unable to access the file that is under the security content 
of "dumb_user"... the auto-protect engine will also fail to stop a malicious 
code from executing. Mostly, a user's HOME directory *only accessible* by the 
by the particular user... cauz mostly* permission is set in a way he/she is 
only the owner of that directory. In that case, if a malicious code gets copied 
in desktop (inside home directory, or the directory that's only* accessible by 
the user) the auto-protect engine will also fail to stop a malicious code 
execution.

3APA3A (3APA3A[at]SECURITY.NNOV.RU] pointed out another interesting issue...
You still can bypass antiviral protection for manual scans with file encryption 
(on-access scanners may impersonate accessing user). This time file can only be 
scanned by administrator if administrator is recovery agent.

In manual scan... the scanner runs under the security content of Administrator 
who is responsible for scanning the system.... hence the virus goes unnoticed 
due to NTFS file permission restriction. But, if the Auto-Protect engine loads 
as a kernel driver, the virus gets stopped in the way during execution. But 
many trojan, spyware scanner just run with the Administrative privilege, so its 
a ISSUE for all those products.

Please follow the procedure & confirm if other antivirus products are 
vulnerable as well.

No wonder, there are several false assumptions in windows security 
configuration as well, when a JOE administrator could permanently lock himself 
up in his own machine.

regards,
Bipin Gautam
http://www.geocities.com/visitbipin/

 

Disclaimer: The information in the advisory is believed to be accurate at the 
time of printing based on currently available information. Use of the 
information constitutes acceptance for use in an AS IS condition. There are no 
warranties with regard to this information. Neither the author nor the 
publisher accepts any liability for any direct, indirect or consequential loss 
or damage arising from use of, or reliance on this information.