Virtual browsing

My two previous posts remind me of this site somebody pointed me to recently. It purports to test recent malware against quite a few if not most of the best Windows security products. I think these tests are a better indication of the effectiveness of security products (anti-virus, anti-spyware etc.) than tests against a huge bank of malware samples. In such tests, security products often score 96-97% in detecting malware; in tests like this, they score far lower- 40-60%- because "0-day" malware is designed to evade detection- and largely does.
This is why the results obtained by DefenseWall (a product I'd never heard of) impressed me: 100% protection. How do they do it? Well I checked the product web site, and it seems DefenseWall is a virtual system: a computer within a computer. av-comapratives.org has a review. (The DefenseWall site seems to have disappeared, so I don't know if the product still exists.)
Running a virtual system is one way to beat malware- until the virtual system is breached, and you need to run the virtual system in a virtual system to remain secure- but it must carry a performance penalty.
While Windows users are running virtual machines and sandboxes to remain secure, I'm running Linux with no layers of virtualisation, no sandboxes, no HIPS or behaviour blocker- indeed, no security products at all to slow down my computer. Of course it's possible to argue that this security is down to Linux's low profile rather than inherent superior security, but for the moment at least Linux is ipso facto more secure.

Malvertising

Malvertising is where third-party ad servers serve up "poisoned" ads- fake anti-virus scams usually comprising a bit of social engineering and an exploit kit to make it a drive-by download if the social engineering fails. the attraction for cyber criminals is that they can get access to mainstream web sites by hacking third-party servers, or ad feeds into those servers- they can attack the weakest link and see their malware on the most trusted websites.

I've noticed a few stories about malvertising today, and a few different points leap out of the stories.

The BBC has a story here about malware on a government-backed website. Not that that surprises me- I've been saying for a long time that the idea that if you're careful where you surf, malware won't be a problem is deluded. What I noticed was this statement:

The exploit only affected users of Internet Explorer, including the most recent versions. Other browsers, including Firefox, were not affected.

Really? This is an exploit to which even the most recent versions of IE are vulnerable? Well, I've also been saying for a long time that Firefox is a safer browser for Windows, and I recently posted about IE getting pwned, but is IE really wide open to an exploit? (Since switching to Linux, I've followed the browser wars with less interest.)

The BBC has another story about malware on the London Stock Exchange site. The following grabbed my attention:

Security expert Paul Mutton fell victim when he viewed the site on 27 February.

He visited the LSE homepage to find out why some people reported that they could not access it.

The site was blocked by Firefox, he said, but accessible via Google's Chrome browser.

"It seemed to work with Chrome but then a few seconds later, without having to click on anything, pop-ups started to appear," he said.

The malicious code closed down several of the programs Mr Mutton was using and stopped new ones being started.

"I visited the site and it compromised my machine," said Mr Mutton.

Now if I was a security expert and had to visit a suspect site, I'd do it in Linux, to be honest. I assume Paul Mutton is a real security expert (this is the BBC) and had his system up-to-date (no vulnerable versions of Adobe PDF or Sun Java or Macromedia Flash installed), so where was the zero-day vulnerability? In Chrome, for all its claims of sandboxing? Or in the OS? Or in some other web-facing application?

My final BBC story reports on malware in Spotify. This story actually allows me to identify the vulnerability exploited- unsurprisingly, it's a fairly old vulnerability in Adobe PDF software- affecting version 8.1.2, when adobe is now shipping 9.4.2. These sort of exploits (affecting software other than the browser and OS- such as PDF readers) are actually as much of a risk as zero-day browser or OS vulnerabilities (meaning Microsoft, if you use IE on windows), which is why I found the previous two stories so surprising, as they suggest zero-day exploits in browsers or windows.

"Users with anti-virus software will have been protected," Spotify said in a statement.

Well, if you check the VirusTotal report available by following the links, you'll find this is horseshit- vulnerabilities may be years old, but if you still have the vulnerable software installed years later, you'll still be vulnerable to the latest malware, and the chance of your anti-virus program detecting that malware is slim.

Secure that PC!

I really should change the title of this blog, as the title refers to computer security. Since buying a router and switching to Linux, I really haven't been that interested in the topic- my PC sits behind the router firewall and it's not vulnerable to Windows malware.
But today a couple of web pages caught my eye. The first was this page, a collection of anti-virus tests and and an attempt to collate the results. How useful the exercise is, is moot, but this test caught my eye. Partly because it's a review sponsored by Norton in which Norton comes out top (dubious) but mainly because it tests AV products on Windows XP SP2 with Internet Explorer 6 (even more dubious). That not even SP2 updated, that's SP2 as it was when it came out without any updates- by now as full of security vulnerabilities which can be levered to install malware as Swiss cheese is full of holes.
I would like to have seen the results obtained if the testers had used XP SP3 fully updated with IE8 or an alternative browser. My guess is that the system wouldn't have been infected even without any AV present, but that's not what Norton or any other AV company want you to hear.
Krebs on Security, the second page to catch my eye today, makes the point that it's often the non-Windows applications that are a security threat on Windows PCs:

A study released earlier this year found that the average Windows user has software from 22 vendors on her PC, and needs to install a new security update roughly every five days in order to use these programs safely.

Linux has the advantage here, because the popular Linux distros check most applications the user is likely to install on the computer to see if they are up to date; windows leaves third-party software unchecked- a nightmare until applications like Secunia came along.
(The main point of the article is that vulnerability counts don't mean anything by themselves- a very sensible point.)
The first line of defence on a Windows computer is ensuring that applications are kept up-to-date and secure, and , if necessary, avoiding applications with a poor security record, as Krebs has suggested in the past.
The second is probably ensuring users don't have admin rights, as Krebs has again suggested several times.
An AV is probably a good third line of defence. This is where those comparative tests come in. If the collation above has any merit, Panda, Avira, Avast! and AVG are the best free options.

How useful is anti-virus in Linux? (Part 2)

In Part 1 I wrote about Linux malware found in a screensaver. In this post, I'm going to talk about a more recent story of a Trojan horse found in a Linux distribution. The story was picked up with glee by Ed Bott:

Every time I write about Windows security software, I get a predictable flood of responses from Linux advocates who claim that they don’t need any such protection. Today comes a shining example of why they’re wrong.

Then Adrian Kingsley-Hughes jumped on the FUD wagon. So should Linux users all be installing anti-virus software? I decided to investigate. With a bit of searching, I found an analysis of the malware script concerned. Submitting the script to VirusTotal produced no detections, but I'd found this blog post from Sophos describing how they detect the malware as Troj/UnIRC-A. Another analysis suggested the malicious package was still available for download. I checked, and it was. The file had already been submitted to VirusTotal in February 2010, when there had been four detections. (A reanalysis didn't produce any more.)



Despite the rather gloating blog from Sophos above, they only added their detection for this malware on the day the story broke. F-Secure added their detection the day after. I don't know when Comodo and Panda added their detections, but I'm guessing they too added their detections after the story broke.

So should Linux users be installing anti-virus products, and combing their systems for malware? There are two points to make here:

• There's no evidence that any anti-virus product would have detected this malware before it was discovered and reported.
• Well over a month after the malware was discovered, it's detected by a tiny minority of anti-virus programs.

The real moral of the story seems to be (as the Sophos blog points out) for administrators to check signatures and checksums of files when using a distro like Gentoo. [Some background I picked up reading the comments sections of various articles about the story: Gentoo is a far from mainstream distro which requires users to compile everything from tarballs.]
In more mainstream distros, software in repositories is digitally signed by the developer, so it is not possible for a package to be replaced with malware. When enabling additional repositories, or trusted third-part repositories, always may sure the appropriate key is installed so software can be authenticated. The following warning means the appropriate key has not been installed, and you are at risk of installing a possibly insecure passage:

You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

See here for an example.

How useful is anti-virus in Linux? (Part 1)

In almost three years of using Linux, I've never come across any Linux malware.
I have come across two tales of Linux malware. I'm revisiting them now to ask: do these stories suggest that using anti-virus software is necessary or advantageous?
In December 2009, malware was found inside a screensaver on gnome-look.org. The malware was a "script with elevated privileges designed to perform a DDoS attack as well as keep itself updated via downloads".
The moral of the story was clear: don't install software packages from untrusted sources.
The malware script can be found in the Ubuntu forum post linked to in the story above, so I decided to save the script as a text file and send it to VirusTotal, to see how many if any anti-virus programs detect it. I found that somebody had already done this, a couple of days after the malware was discovered, and that no anti-virus program at VirusTotal had detected the script at that time.

I then hit the 'Reanalyse' button to see what the result would be seven months later.


This time, eight anti-virus programs detected the script as malicious.
The two points that can be made here are:

• None of the anti-virus products on VirusTotal (which is most of 'em) would have detected this script as malware during the time it was available to download.
• Even seven months later, only a small number of anti-virus programs would detect this malicious script.

To answer the question: is using anti-virus software necessary or advantageous in Linux? In the case of new Linux malware at least, the answer seems to be that anti-virus software has nothing to offer- caution remains the key.

Favicon malware

Nothing could seem more innocent than a favicon. It's the little website icon that sits next to the website address in the browser address bar and is added to your list of favourites (or bookmarks according to the browser you're using). But the little favicon.ico can be infected with malware. (See here and here.)
Nothing is more frustrating than a malware detection from your anti-virus program which reappears every two minutes whatever you do, as seen here on the avast! forum, and here detected by AVG- favicon malware was the cause both times, of course.
But why was the malware reappearing every two minutes? My best guess is that IE was downloading missing favicons, either after the cache had been cleared, or malicious favicons deleted.

Fake Flash For Firefox

Sophos analysts have discovered a piece of malware masquerading itself as a flash player plugin for the Firefox browser:

When the file runs, it pretends to install the adobe flash player for your browser.

Upon restarting Firefox after the installation is complete, Firefox shows an extension has been installed as “Adobe Flash Player 0.2″.

Troj/FFSpy-A monitors your Google searches and sends this information to a remote server. It also inject ads into the web pages you are viewing based on the keywords you have used in your search.

This piece of malware seems to be spreading itself via internet forums pretending to be the installation file for the adobe flash player. To reduce the risk of infection, the user should avoid downloading executables from unknown and untrusted sources.

Let's be careful out there!