recently, some old news has become new again. when i first read about DLL search order hijacking in nick harbour's post on mandiant's blog i thought to myself 'gee, that sounds an awful lot like a companion virus, except without the self-replication part'.
apparently i wasn't the only one. robert sandilands made the companion virus connection too, except for some reason he combined execution precedence companion viruses with path precedence companion viruses. path precedence is the only one needed here, and if you really think about path precedence companions or you go back and read nick harbour's post again you'll see that the all this focus people are giving to the issue of the current directory is taking attention away from a broader issue.
while the current directory could be used to initiate a compromise of a machine, if the malicious DLL is anywhere in the search path before the legitimate DLL there will still be a problem with an exotic form of persistence, and if an additional vulnerability (say in a browser, for example) can be used to plant a malicious DLL at the beginning of the search path then we will once again be able to compromise a machine regardless of the current directory centric mitigations that are available right now.
the real problem with DLL search paths is that they exist at all. there should be no searching, no question of which DLL your process is trying to load or where to find it. so long as there is searching for DLLs, there exists the possibility of finding and loading the wrong one (the malicious one).
Showing posts with label robert sandilands. Show all posts
Showing posts with label robert sandilands. Show all posts
Thursday, August 26, 2010
Tuesday, May 20, 2008
the user is responsible but ill-equipped
no doubt by now many of you have read about microsoft saying that the reason there was more malware on vista than on windows 2000 was because of the user... there's been a bit of a knee-jerk reaction against this but to a certain extent microsoft is actually right...
robert sandilands demonstrates this reaction against microsoft's argument quite well in his post "Is Vista more or less secure than Windows 2000?"... in fact, when he started talking about how the user shouldn't need to be security experts and just want to get their job done i felt like i was greeting an old acquaintance (i'm referring of course to the argument - robert and i are not actually acquainted yet)...
it's true that computer users shouldn't need to be security experts and it's certainly not realistic to expect they can be, that much i'll agree with, but there's another truth that some don't seem like they want to face: being security vegetables isn't really going to work out for the user either...
i shouldn't need to be an automotive expert in order to drive from point A to point B... i just want to get to my destination and don't want to be bothered with all the technical details... that should be possible, shouldn't it? sure is, but if i want to get there safely i have to follow certain safety protocols colloquially known as the rules of the road... the average person (with some notable darwinian exceptions) understands the need for following safety rules while cruising down the highway, but for the most part they aren't even aware of the existence of the security rules for using computers (were you expecting an information superhighway reference here?)...
mostly they just know they need an anti-virus product... maybe some of them have heard of a firewall, but for most people that's the extent of their awareness of secure computing behaviour and unfortunately that is not enough to keep them safe/secure...
people often liken using a computer to using a mundane household appliance like a toaster, but such people should get over themselves because even with a toaster people need to know not to stick a fork in it... there are safety rules for virtually every tool in existence - some are simply a matter of common sense (though really they're often things we pick up from safety awareness initiatives when we're young), some should be a matter of common sense (like not operating a propane barbecue indoors), and some require the consumer be informed of how to use the tool safely...
using a computer is one of those things where the consumer needs to be informed because safe/secure computer use behaviours haven't penetrated our culture yet, and because the cause is often too far removed from the effect for users to make the necessary connection... and like it or not, the cause often involves the user - when the user gets malware on their system it is usually at least partially as a result of something s/he did or did not do...
that makes the user responsible for what happens to their machine... note that this isn't the same as blaming the user, being responsible and being at fault are two different things... you can't blame someone if there wasn't a reasonable expectation for them to know better, and currently such an expectation wouldn't be reasonable... in the grand scheme of things, however, it should be reasonable; we should be able to expect that of computer users - if boy scouts can "always be prepared" then why are we still feeding computer users pablum instead of teaching them to take responsibility for their actions/inactions and the consequences thereof...
robert sandilands demonstrates this reaction against microsoft's argument quite well in his post "Is Vista more or less secure than Windows 2000?"... in fact, when he started talking about how the user shouldn't need to be security experts and just want to get their job done i felt like i was greeting an old acquaintance (i'm referring of course to the argument - robert and i are not actually acquainted yet)...
it's true that computer users shouldn't need to be security experts and it's certainly not realistic to expect they can be, that much i'll agree with, but there's another truth that some don't seem like they want to face: being security vegetables isn't really going to work out for the user either...
i shouldn't need to be an automotive expert in order to drive from point A to point B... i just want to get to my destination and don't want to be bothered with all the technical details... that should be possible, shouldn't it? sure is, but if i want to get there safely i have to follow certain safety protocols colloquially known as the rules of the road... the average person (with some notable darwinian exceptions) understands the need for following safety rules while cruising down the highway, but for the most part they aren't even aware of the existence of the security rules for using computers (were you expecting an information superhighway reference here?)...
mostly they just know they need an anti-virus product... maybe some of them have heard of a firewall, but for most people that's the extent of their awareness of secure computing behaviour and unfortunately that is not enough to keep them safe/secure...
people often liken using a computer to using a mundane household appliance like a toaster, but such people should get over themselves because even with a toaster people need to know not to stick a fork in it... there are safety rules for virtually every tool in existence - some are simply a matter of common sense (though really they're often things we pick up from safety awareness initiatives when we're young), some should be a matter of common sense (like not operating a propane barbecue indoors), and some require the consumer be informed of how to use the tool safely...
using a computer is one of those things where the consumer needs to be informed because safe/secure computer use behaviours haven't penetrated our culture yet, and because the cause is often too far removed from the effect for users to make the necessary connection... and like it or not, the cause often involves the user - when the user gets malware on their system it is usually at least partially as a result of something s/he did or did not do...
that makes the user responsible for what happens to their machine... note that this isn't the same as blaming the user, being responsible and being at fault are two different things... you can't blame someone if there wasn't a reasonable expectation for them to know better, and currently such an expectation wouldn't be reasonable... in the grand scheme of things, however, it should be reasonable; we should be able to expect that of computer users - if boy scouts can "always be prepared" then why are we still feeding computer users pablum instead of teaching them to take responsibility for their actions/inactions and the consequences thereof...
Monday, March 31, 2008
av-comparatives vs panda
by now i would imagine that most people keeping an eye on the industry have noticed a bit of bad blood emerging between panda and av-comparatives...
luis corrons' post on the panda blog seemed a little like holding someone's feet to the fire - something i've done on occasion so on that level i can't really fault them (and really, sometimes people's feet do need to be held to the fire)... however, there are some very important tricks to doing this successfully... one of the most important being to not have a financial motivation to make the other party look bad - i get away with the things i say in part because i'm not actually in the anti-malware industry, when i say someone's doing something bad there's little or no possibility for my actions to be attributable sour grapes... luis, who represents a product that has apparently been tested by av-comparatives in the past has a financial motivation to call av-comparatives methods into question if that product didn't fare as well as one might hope in the past... perhaps his characterization of the testing at av-comparatives is correct, perhaps it isn't, but a panda representative is not in the best position to be pointing it out...
robert sandilands over at the authentium blog recognized this and threw in his own two cents coming from the perspective of one whose product has never been tested by av-comparatives... unfortunately, robert opted for the personal approach, subtracting the problem element that luis encountered but adding nothing good to replace it... personally, i'm not the least bit interested in his reaction to meeting andreas clementi, there's nothing of substance or value to be found in insinuations...
you see, the second important trick to pulling off holding someone's feet to the fire is to cite specific examples of problems, and back them up with evidence if at all possible so that your criticisms are more than just baseless claims (or worse, simple character assassination/defamation)... luis tried at least to point to a specific problem when he brought up the issue of paid services provided by av-comparatives, but botched the job by giving the apparently misleading impression that av-comparatives charges av vendors money to be included in their tests (which would certainly call the independence of av-comparatives into question if it were true)...
of course, even if the fees charged by av-comparatives are for things other than inclusion in the test they're still in an awkward position... it's very difficult to profess independence from av vendors when there's any kind of relationship with them... look at virus bulletin, sister company to sophos, which suffered questions about it's independence for years... those concerns fade away a little bit every time sophos fails to achieve a vb100 award but what a dysfunctional non-competitor relationship that winds up being; one company can only do well at the expense of the other... andreas clementi did well to clarify what av-comparatives' fees were for in his post about fee structure, more transparency may not dispel doubts but it at least gives people the information they need to judge for themselves, but i fear that so long as av-comparatives derives any financial benefit directly from members of the industry it's supposed to provide metrics for, the independence of av-comparatives and by extension the impartiality and validity of those metrics will be at least somewhat in question...
andreas' initial reaction to the panda blog post was pretty obviously written in the heat of the moment (which is perhaps why the post has been removed) but there are some issues raised that deserve attention, not the least of which being the apparently materially false statements made by panda, as well as how significant any specific problems with the testing at av-comparatives (should they actual exist) are...
(as a side note, this has highlighted a problem with using google cache to link to historical items as both cached documents appear to differ from what was originally seen)
luis corrons' post on the panda blog seemed a little like holding someone's feet to the fire - something i've done on occasion so on that level i can't really fault them (and really, sometimes people's feet do need to be held to the fire)... however, there are some very important tricks to doing this successfully... one of the most important being to not have a financial motivation to make the other party look bad - i get away with the things i say in part because i'm not actually in the anti-malware industry, when i say someone's doing something bad there's little or no possibility for my actions to be attributable sour grapes... luis, who represents a product that has apparently been tested by av-comparatives in the past has a financial motivation to call av-comparatives methods into question if that product didn't fare as well as one might hope in the past... perhaps his characterization of the testing at av-comparatives is correct, perhaps it isn't, but a panda representative is not in the best position to be pointing it out...
robert sandilands over at the authentium blog recognized this and threw in his own two cents coming from the perspective of one whose product has never been tested by av-comparatives... unfortunately, robert opted for the personal approach, subtracting the problem element that luis encountered but adding nothing good to replace it... personally, i'm not the least bit interested in his reaction to meeting andreas clementi, there's nothing of substance or value to be found in insinuations...
you see, the second important trick to pulling off holding someone's feet to the fire is to cite specific examples of problems, and back them up with evidence if at all possible so that your criticisms are more than just baseless claims (or worse, simple character assassination/defamation)... luis tried at least to point to a specific problem when he brought up the issue of paid services provided by av-comparatives, but botched the job by giving the apparently misleading impression that av-comparatives charges av vendors money to be included in their tests (which would certainly call the independence of av-comparatives into question if it were true)...
of course, even if the fees charged by av-comparatives are for things other than inclusion in the test they're still in an awkward position... it's very difficult to profess independence from av vendors when there's any kind of relationship with them... look at virus bulletin, sister company to sophos, which suffered questions about it's independence for years... those concerns fade away a little bit every time sophos fails to achieve a vb100 award but what a dysfunctional non-competitor relationship that winds up being; one company can only do well at the expense of the other... andreas clementi did well to clarify what av-comparatives' fees were for in his post about fee structure, more transparency may not dispel doubts but it at least gives people the information they need to judge for themselves, but i fear that so long as av-comparatives derives any financial benefit directly from members of the industry it's supposed to provide metrics for, the independence of av-comparatives and by extension the impartiality and validity of those metrics will be at least somewhat in question...
andreas' initial reaction to the panda blog post was pretty obviously written in the heat of the moment (which is perhaps why the post has been removed) but there are some issues raised that deserve attention, not the least of which being the apparently materially false statements made by panda, as well as how significant any specific problems with the testing at av-comparatives (should they actual exist) are...
(as a side note, this has highlighted a problem with using google cache to link to historical items as both cached documents appear to differ from what was originally seen)
Subscribe to:
Posts (Atom)