{"id":78849,"date":"2020-04-22T13:42:05","date_gmt":"2020-04-22T11:42:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki"},"modified":"2020-04-22T13:42:05","modified_gmt":"2020-04-22T11:42:05","slug":"bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bolshinstvo-antivirusov-okazalis-podverzheny-atake-cherez-simvolicheskie-ssylki","title":{"rendered":"Most antiviruses were vulnerable to attacks through symbolic links","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Researchers from RACK911 Labs noticed<\/a><\/noindex> that almost all antivirus packages for Windows, Linux, and macOS were vulnerable to attacks exploiting race conditions when deleting files identified as malware.<\/p>\n

To conduct the attack, a file must be uploaded that the antivirus recognizes as malicious (for example, a test signature can be used), and after a certain time, following the detection of the malicious file by the antivirus, but just before the function to delete it is called, the directory containing the file is replaced with a symbolic link. On Windows, the same effect is achieved by replacing the directory using a directory junction. The issue is that almost all antivirus programs did not properly check symbolic links and, believing they were deleting the malicious file, ended up deleting the file in the directory to which the symbolic link points. <\/p>\n

In Linux and macOS, it is shown how a non-privileged user can delete \/etc\/passwd or any other system file, and in Windows, the DLL library of the antivirus itself to block its operation (in Windows, the attack is limited only to deleting files that are not currently used by other applications). For example, the attacker can create a directory called \"exploit\" and upload the file EpSecApiLib.dll with a test virus signature into it, after which, before deletion, they replace the directory \"exploit\" with a link to \"C:\\Program Files (x86)\\McAfee\\Endpoint Security\\Endpoint Security Platform\", which will lead to the deletion of the library EpSecApiLib.dll from the antivirus directory. In Linux and macOS, a similar technique can be applied by replacing the directory with a link to \"\/etc\".<\/p>\n

#!\/bin\/sh
\n rm -rf \/home\/user\/exploit ; mkdir \/home\/user\/exploit\/
\n wget -q https:\/\/www.eicar.org\/download\/eicar.com.txt -O \/home\/user\/exploit\/passwd
\n while inotifywait -m \"\/home\/user\/exploit\/passwd\" | grep -m 5 \"OPEN\"
\n do
\n rm -rf \/home\/user\/exploit ; ln -s \/etc \/home\/user\/exploit
\n done<\/p>\n


\n
\r\n \"Play\r\n
<\/div>\r\n <\/div>
\n<\/center><\/p>\n

Moreover, many antivirus programs for Linux and macOS were found to use predictable file names when handling temporary files in the \/tmp and \/private\/tmp directories, which could be exploited for privilege escalation to the root user. <\/p>\n

By now, the issues have been resolved by most providers, but it is noteworthy that the first notifications of the problem were sent to manufacturers back in the fall of 2018. Despite the fact that not all manufacturers released updates, they were given at least 6 months to address the issues, and RACK911 Labs believes it is now entitled to disclose information about the vulnerabilities. It is noted that RACK911 Labs has long been engaged in vulnerability discovery, but it did not anticipate that working with colleagues in the antivirus industry would be so difficult due to delays in releasing updates and the ignoring of the urgent need to address security concerns.<\/p>\n

Products affected by the issue (the free antivirus package ClamAV is not on the list):<\/p>\n