Most antiviruses were vulnerable to attacks through symbolic links

Researchers from RACK911 Labs noticed that almost all antivirus packages for Windows, Linux, and macOS were vulnerable to attacks exploiting race conditions when deleting files identified as malware.

To conduct the attack, a file must be uploaded that the antivirus recognizes as malicious (for example, a test signature can be used), and after a certain time, following the detection of the malicious file by the antivirus, but just before the function to delete it is called, the directory containing the file is replaced with a symbolic link. On Windows, the same effect is achieved by replacing the directory using a directory junction. The issue is that almost all antivirus programs did not properly check symbolic links and, believing they were deleting the malicious file, ended up deleting the file in the directory to which the symbolic link points.

In Linux and macOS, it has been shown how an unprivileged user can delete /etc/passwd or any other system file, and in Windows, a DLL library of the antivirus itself to block its operation (in Windows, the attack is limited to deleting files that are not currently in use by other applications). For example, an attacker can create a directory called 'exploit' and upload the file EpSecApiLib.dll with a test virus signature into it, then, before deletion, replace the 'exploit' directory with a link to 'C:\Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform', which will lead to the deletion of the library EpSecApiLib.dll from the antivirus directory. In Linux and macOS, a similar technique can be applied by replacing the directory with a link to '/etc'.

#!/bin/sh
rm -rf /home/user/exploit ; mkdir /home/user/exploit/
wget -q https://www.eicar.org/download/eicar.com.txt -O /home/user/exploit/passwd
while inotifywait -m '/home/user/exploit/passwd' | grep -m 5 'OPEN'
do
rm -rf /home/user/exploit ; ln -s /etc /home/user/exploit
done

Moreover, many antivirus programs for Linux and macOS were found to use predictable file names when handling temporary files in the /tmp and /private/tmp directories, which could be exploited for privilege escalation to the root user.

By now, the issues have been resolved by most providers, but it is noteworthy that the first notifications of the problem were sent to manufacturers back in the fall of 2018. Despite the fact that not all manufacturers released updates, they were given at least 6 months to address the issues, and RACK911 Labs believes it is now entitled to disclose information about the vulnerabilities. It is noted that RACK911 Labs has long been engaged in vulnerability discovery, but it did not anticipate that working with colleagues in the antivirus industry would be so difficult due to delays in releasing updates and the ignoring of the urgent need to address security concerns.

Products affected by the issue (the free antivirus package ClamAV is not on the list):

• Linux
  • BitDefender GravityZone
  • Comodo Endpoint Security
  • Eset File Server Security
  • F-Secure Linux Security
  • Kaspersy Endpoint Security
  • McAfee Endpoint Security
  • Sophos Anti-Virus for Linux
• Windows
  • Avast Free Anti-Virus
  • Avira Free Anti-Virus
  • BitDefender GravityZone
  • Comodo Endpoint Security
  • F-Secure Computer Protection
  • FireEye Endpoint Security
  • Intercept X (Sophos)
  • Kaspersky Endpoint Security
  • Malwarebytes for Windows
  • McAfee Endpoint Security
  • Panda Dome
  • Webroot Secure Anywhere
• macOS
  • AVG
  • BitDefender Total Security
  • Eset Cyber Security
  • Kaspersky Internet Security
  • McAfee Total Protection
  • Microsoft Defender (BETA)
  • Norton Security
  • Sophos Home
  • Webroot Secure Anywhere

  Source: opennet.ru