Subscribe to the RSS feed in case you are interested in updates

Release mode: Coordinated but limited disclosure.
Ref         : [TZO-31-2009] - Ikarus multiple evasions through CAB,RAR,ZIP
Vendor      : http://www.ikarus.at     
Status      : Patched (after engine version 1.1.58)
CVE         : none provided
Credit      : t.b.a
OSVDB vendor entry: Ikarus is not listed as a vendor in OSVDB
Security notification reaction rating : good
Notification to patch window : 77 days
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html


Affected products :

• IKARUS virus utilities  (scan-time)
• IKARUS myM@ilWall
• IKARUS Content Wall
• IKARUS security.proxy

I. Background
Ikarus Software GMBH is an Anti-virus company based in Austria.

II. Description
The parsing engine can be bypassed by a specially crafted and formated RAR (Headflags and Packsize),ZIP (Filelenght) and CAB (Filesize) archive.

III. Impact
The bug results in denying the engine the possibility to inspect code within the RAR, ZIP archives. There is no inspection of content at all.

A general description of the impact and nature of AV Bypasses/evasions can be read at :  http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html


IV. Disclosure time-line
DD/MM/YYYY

• 23/03/2009 : Send proof of concept (ZIP), description the terms under which I cooperate and the planned disclosure date
  
  
• 04/04/2009 : Send proof of concept (RAR)
  
  
• 07/04/2009 : Ikarus acknowledges receipt, patching Dev builds has begun10/04/2009 : Resending ZIP PoC
  
  
• 13/04/2009 : Submitting CAB PoC
  
  
• 17/04/2009 : Ikarus demands to delay disclosure
  
  
• 01/05/2009 : Ikarus states that it has started Q&A for the new builds
  
  
• 03/06/2009 : Ikarus informs me that they started deploying the patches/updates and that credit will be given on a website to come
  
  
• 09/06/2009 : Release of this advisory

        

80% of all attacks come from within the enterprise - so the dogma.

After the Verizon report that stated that the insider threat is grossly exagerated here is another interesting piece from Taosecurity :

• Did you know that the 80% statistic is based on a 17 year old report with questionable procedures?
  
  
• Did you know that this is know since a 2001 CSI/FBI study quoted Dr. Eugene Schultz ? [1]
  

  There is currently considerable confusion concerning where most attacks originate. Unfortunately, a lot of this confusion comes from the fact that some people keep quoting a 17-year-old FBI statistic that indicated that 80 percent of all attacks originated from the [inside].

• Quote: "For the past five years, incidents caused by insiders accounted for 7% or less of all Web intrusions. In 2003, outsiders accounted for 53%. About one-quarter of respondents said they “don’t know” the origin of their Web incidents, and 18% said “both” the inside and outside participated."
  
  
• While the 80% myth seems busted, insiders apparently caused more financial damages than outsiders.
  

Read more at TaoSecurity

It seems to appear to the public that, as an example, Symantec does not suffer from the same bugs as reported in other vendors products, as I have not released any advisories for them. This is not the case. Symantec and some other vendors seems to either play the "collect all bugs, publish one advisory game" delaying the patches and exposure window in an unnecessary fashion or take a rather long time reproducing simple bugs, which isn't really any better.

My reaction to this is to stop submitting vulnerabilities to such vendors and only continue to submit POC files once patches are issued. To remove the incentive to collect multiple bugs and release one advisory, I will publish one advisory per bug, regardless of how many patches there are released.

Currently on the "Stop to submit POC files" list are :

• Symantec
• IBM
• Quickheal
  

Subscribe to the RSS feed in case you are interested in updates

Release mode: Forced disclosure  
Ref : [TZO-30-2009] - Kaspersky PDF evasion (Forced disclosure) 
Vendor : http://www.kaspersky.com 
Status : Silent fix that doesn't work - No appropriate patch 
CVE : none provided Credit : none given  
OSVDB vendor entry: No [1]

Security notification reaction rating : Catastropic
Not only did the headquarter not answer, they (tried) to patch this vulnerability silently, only to fail at it. See Timeline.

This is not the first time that Kaspersky did not answer but patched bugs without credit, advisory or anything. This was however the last time I will not disclose, I am no longer part of an entity that tolerates irresponsible non-disclosure.

A professional reaction to a vulnerability notification is a way to measure the maturity of a vendor in terms of security. Kaspersky is given a grace period of two (2) weeks to reply to my notifications. Failure to do so will result in details of all the other reported bugs be released in two (2) weeks.

Notification to patch window : x+n
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html

Affected products (all versions) :

• Kaspersky Internet Security
• Kaspersky Anti-Virus
• Kaspersky Mobile Security
• Kaspersky Small Office Security
• Kaspersky Open Space Security
• Kaspersky Business Space Security
• Kaspersky Work Space Security
• Kaspersky Enterprise Space Security
• Kaspersky Targeted Security
• Kaspersky® Anti-Virus for Microsoft ISA Server
• Kaspersky® Anti-Virus for Proxy Server
• Kaspersky® Anti-Virus for Check Point Firewall-1
• Kaspersky® Anti-Virus for Windows Server
• Kaspersky® Anti-Virus for Windows Server Enterprise Edition
• Kaspersky® Anti-Virus for Novell NetWare
• Kaspersky® Anti-Virus for Linux File Server
• Kaspersky® Anti-Virus for Samba Server
• Kaspersky® Security for Microsoft Exchange 2007
• Kaspersky® Security for Microsoft Exchange 2003
• Kaspersky® Anti-Virus for Lotus Notes/Domino
• Kaspersky® Anti-Virus for Windows Workstation
• Kaspersky® Anti-Virus for Linux Workstation
• Kaspersky® Anti-Virus for Linux Mail Server
• Kaspersky® Mail Gateway Kaspersky® Anti-virus for MIMEsweeper
  

I. Background
Quote: "We develop, produce and distribute information security solutions that protect our customers from IT threats and allow enterprises to manage risk. We provide products that protect information from viruses, hackers and spam for home users and enterprises and offer consulting services and technical support. "

II. Description
The PDF files are not parsed correctly, a PDF file starts with the magic byte "%PDF" and ends with the magic byte "%%EOF", everything in between those markers is parsed and interpreted. Furthermore PDF files are read from the bottom to the top.

Adobe Acrobat nor the FoxitReader care too much about the data that comes prior the magic byte, the kaspersky engine does, not only does it care, it fails to detect the malware inside the PDF file.

I will spare you the details, a PDF file is bascialy a container that starts with %PDF and ends with %%EOF.

What follows are the details of this evasion, note this one is generic and the easiest one, there are plenty more. What you read below is true as amazing as it might seem, you can't have it more simple.

Example of a malicious PDF file :
%PDF Malicious content here %%EOF

Doing :

Enter stuff here, like random text.
%PDF Malicious content here %%EOF

This has the result that the malware is no longer being detected. Note: Not a single byte of the malware itself been altered, and strictly speaking the content that represent a PDF file hasn't been changed at all.

This has been tested with several malicious PDF files and represents a generic evasion of all PDF signatures and heuristics.

Kaspersky was given the PoC file directly through myself and F-Secure, they went ahead an patched this by adding a signature for the POC file, adding a PE header in front of a PDF file (with a PDF extension) still evades detection and the exploit still triggers when opening the file with Adobe. Thus the patch is flawed by design.

Thus the root cause is :

• The PDF file is not parsed from the bottom to the top, it's important to support the format the same way the end-user application does.
  
• The PDF magic byte (was) read from at static offset
• Heuristics are apparently not good enough to detect simple shellcode in a PDF file
  

Kaspersky was given the sample directly through myself and F-Secure, they went ahead and silently patched this by adding a signature for the PoC file. After analysis the patch proved to be incomplete, by adding a PE header in front of a PDF file (with a PDF extension) detection is still evaded and the exploit still triggers when opening the file with Adobe.


A professional reaction to a vulnerability notification is a way to measure the maturity of a vendor in terms of security. Kaspersky is given a grace period of two (2) weeks to reply to my notifications. Failure to do so will result in details of all the other reported bugs be released in two (2) weeks.

III. Impact
The heuristics can be bypassed by a special formated PDF "container", this leads to the bypass of malicious PDF files, old or new. This is not a bypass that relies on archive structures but relies on evading certain
code paths in the av engine "through various means".

A general description of the impact and nature of AV Bypasses/evasions can be read at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html

Note: Certain vendors confirmed this to bypass their engine at runtime.


IV. Timeline
DD/MM/YYYY

• 15/05/2009 : Send proof of concept, description the terms under which I cooperate and the planned disclosure date.
  
  no reply (note - there where receipt acknowledgements (nothing more) for 2 other reports but not this one )
  
  
• xx/05/2009 : F-Secure sends the same sample to Kaspersky
  
  
• 01/06/2009 : Re-sending the proof of concept, description the terms under which I cooperate and the planned disclosure date. No reply
  

• 03/06/2009 : F-Secure informs me that the sample was submitted to Kaspersky
  
  
• 03/06/2009 : Informed F-secure to communicate with Kaspersky and please ask them to reply to my notifications.
  
  

• 03/06/2009 : Kaspersky Moscow visits my blog, searches for "AVP" and "Kaspersky". Obviously they received both reports.
  No reply
  
  
• 04/06/2009 : I discovered that the PoC file is now detected by the latest Kaspersky update.
  
• 04/06/2009 : Discovered that adding a few bytes evades the AV engine again
  +5minutes
  
  
• 09/06/2009 : Release of this advisory on the blog, tweet. Hoping for any reaction prior to sending it to bugtraq et al.
  
  
• 13/06/2009 : Release to Bugtraq et al and start of grace period.
  
  
• 14/06/2009 : Kaspersky sends me an e-mail and promises to get back with updates.
  
  

Note (in all fairness): Kaspersky US did acknowledge the receipt of 2 other bugs,however they couldn't provide any information or any reaction as Moscow simply didn't answer them.

[1] http://osvdb.org/vendor/1/Kaspersky%20Labs
[2] http://blog.didierstevens.com/2009/05/14/malformed-pdf-documents/
[3] http://blog.didierstevens.com/2008/04/09/quickpost-about-the-physical-and-logical-structure-of-pdf-files/

• [TZO-20-2009] AVG ZIP bypass / evasion
• [TZO-21-2009] F-Prot CAB bypass / evasion
• [TZO-172009] Trendmicro RAR,ZIP,CAB evasion (update)