Denial of Service

Denial of Service

Both local and remote denial-of-service (DoS) attacks against antivirus software are possible; indeed, one of the most common attacks is aimed at disabling AV protection.
"A DoS is an attack launched against software or against a machine running some software, with the aim of making the targeted software or machine unavailable."

Local Denial-of-Service Attacks

A local denial of service is a DoS attack that can be launched only from the same machine on which the targeted antivirus software is installed. There are common types of DoS Attacks.

• Compression Bombs

A simple, well-known, and widely available local denial-of-service attack against antivirus software is the compression bomb, also referred to as a zip bomb or the “zip of death.”

Creating a Simple Compression Bomb

In this section, you create a simple compression bomb using common standard Unix and Linux tools. First you need to create a big zero-filled file with the command dd:

dd if=/dev/zero bs=1024M count=1 > file

After creating this “dummy” file, you need to compress it. You can use any compression tool and format, such as GZip or BZip2. The following command creates a max 2GB dummy file and then directly compresses it with BZip2, resulting in a 1522-byte-long compressed file:

dd if=/dev/zero bs=2048M count=1 | bzip2 -9 > file.bz2

You can quickly check the resulting size by using the wc tool:

$ LANG=C dd if=/dev/zero bs=2048M count=1 | bzip2 -9 | wc -c 0+1 records in

0+1 records out 

2147479552 bytes (2.1 GB) copied, 15.619 s, 137 MB/s

1522

This is a really simple compression bomb attack.

==================================

Bugs in File Format Parsers

File format parser bugs can also be used locally to prevent an antivirus scanner from detecting malware. A non-trivial example of this is when the malware drops a malformed file that is known to trigger the bug in the antivirus file parser and cause it to die or become stuck (for example, an infinite loop).

Here is another easier example of how to implement a file format bug. Imagine you have two files with the following path structure:

base_dir\file-causing-parsing-bug.bin base_dir\sub-folder\real-malware.exe

Attacks against Kernel Drivers

Other typical examples of local DoS attacks against antivirus products are those focused on kernel driver vulnerabilities. Most antivirus products for Windows deploy kernel drivers that can be used to protect the antivirus program from being killed, to prevent a debugger from attaching to their services, to install a file system filter driver for real-time file scanning, or to install an NDIS mini-filter to analyze the network traffic. 

These tricks are a useful way, for example, to reboot the machine after performing some action without asking the user for confirmation or requiring high-level privileges. They can also be used in a multistage exploit. A hypothetical, yet possible, scenario follows: 

1. An attacker abuses a vulnerability that allows one of the following: a file to be copied to a user’s Startup directory, a bug that allows a driver to be installed, or a bug that allows a library to be copied in a location that will later be picked up and loaded in the address space of high-privileged processes after rebooting.

 2. The attacker then uses a kernel driver bug to force the machine to reboot so that the changes take effect.

Local DoS vulnerabilities in antivirus kernel drivers are very prolific; a few vulnerabilities appear each year, affecting a wide range of antivirus products from the most popular to the less known. 

Remote Denial-of-Service Attacks

Remote DoS vulnerabilities can also be discovered in antivirus products, as in any other software with a remote surface that is exposed. A remote denial of service is a DoS attack that can be launched remotely, targeting the antivirus software installed in the victim’s computer. There are many possible remote DoS attack vectors, with the following being the most common:

• Compression bombs, as in the case of local denial of services Bugs in fi le format parsers, as in the case of local denial of services
• Bugs in network protocol parsers.

• Attacks against antivirus network services that listen to network interfaces other than the loopback network interface (localhost IP address, 127.0.0.1)