Can consumer av products protect


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Can consumer av products protect

  1. 1. Analysis Brief August 15, 2012 Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities? Tested Products Avast Internet Security 7 AVG Internet Security 2012 Avira Internet Security 2012 CA Total Defense Internet Security Suite ESET Smart Security 5 F-Secure Internet Security 2012 Kaspersky Internet Security McAfee Internet Security 2012 Microsoft Security Essentials Norman Security Suite Pro Norton Internet Security 2012 Panda Internet Security 2012 Trend Micro Titanium + Internet SecurityThis analysis brief was produced as part of NSS Labs’ independent testing information services. Leadingvendors were selected for participation at no cost, and NSS Labs received no vendor funding to produce thisanalysis brief. 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  2. 2. OverviewNSS Labs conducts significant research on the capabilities of endpoint protection (AV) products. As NSSresearchers were preparing for the impending Consumer Endpoint Protection Group Test, two criticalvulnerabilities against popular Microsoft products were disclosed. The first vulnerability resides within MicrosoftXML Core Services 3.0, 4.0, 5.0, and 6.0 and the second within Internet Explorer 8. Microsoft has since deliveredcritical patches for both CVE’s in June and July 2012, respectively.Unfortunately, exploits against both vulnerabilities are already being observed in the wild, and users that havenot yet patched their systems are at risk. Many users who have not yet patched, or have delayed patching,assume their endpoint protection suite is defending their system in the interim.The mission of endpoint protection is to defend users against exploits and malware when a patch is not availableor has not yet been applied. NSS Labs conducted testing on 13 popular consumer anti-virus (AV) products, tosee how well they repelled attacks on systems not yet patched for the CVE-2012-1875 and CVE-2012-1889vulnerabilities.Consumer-grade AV products that offer effective protection against these vulnerabilities allow users time topatch systems (particularly important in enterprise environments with “bring your own device” (BYOD) policies inplace.) However, the successful exploitation of either of these critical vulnerabilities would reflect a significantproduct failure, especially given the high profile and critical nature of these vulnerabilities. Product HTTP HTTPS Overall Note Avast 100% 100% 100% Kaspersky 100% 100% 100% McAfee 100% 100% 100% Trend 100% 100% 100% ESET 100% 50% 75% HTTPS Problem Norton 100% 50% 75% HTTPS Problem AVG 100% 0% 50% HTTPS Problem Avira 100% 0% 50% HTTPS Problem F-Secure 50% 0% 25% HTTPS Problem Microsoft Security Essentials 50% 0% 25% HTTPS Problem Norman 25% 25% 25% Panda 25% 25% 25% CA Total Defense 50% 0% 25% HTTPS Problem Figure 1: Summary of Findings 2 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  3. 3. NSS Labs Findings:• Consumers who delay patching, or fail to patch more than their operating system alone, are at elevated risk of compromise.• Only 4 of the 13 products blocked all attacks; exploit prevention remains a challenge for most products.• More than half of the products failed to protect against attacks over HTTPS that were blocked over HTTP, a serious deficiency for a desktop AV / host intrusion prevention system (HIPS.)• Where BYOD policies are in place in enterprise environments, delays in patching leave corporate networks at serious risk of compromise.• NSS Labs researchers are not the only ones testing security products - criminal organizations also have sophisticated testing processes in order to determine which product detects which malware, and how the various products can be evaded. Some crimeware will include various one-click buttons to “Bypass Vendor X,” for example.NSS Labs Recommends:• Users of products that failed to block these attacks should update/patch immediately or otherwise mitigate.• Where feasible, do not rely on AV software alone to protect your system; install a HIPS product or “Internet security” suite (AV+HIPS) to provide an additional layer of protection.• Enterprises with BYOD policies should carefully monitor for unpatched systems and consider enforcing defense in depth strategies (“Internet security” suites, for example) on all BYOD systems.• Users of Gmail, Facebook, and other services that utilize HTTPS should consider endpoint protection (AV) products that can defend against threats being transported across this protocol.• Consumers should consider using patch management tools such as the Secunia Personal Software InspectorAnalysisNSS Labs conducted testing on 13 popular consumer anti-virus (AV) products, to see how well they repelledattacks on systems not yet patched for the CVE-2012-1875 and CVE-2012-1889 vulnerabilities. The successfulexploitation of either of these critical vulnerabilities can result in arbitrary remote code execution by the attacker,thus posing a significant threat to users.To test the antivirus products, NSS Labs researchers crafted one payload containing shellcode to launchcalc.exe, and a second payload that invoked a reverse Meterpreter shell over HTTPS. Additional testing wasdone to see if the products could easily be disabled upon successful exploitation of the vulnerability and if basicobfuscation tactics would defeat protection.Raw exploits were augmented with common evasion tactics, such as Base 64, Unicode, and JavaScriptencoding. In addition to attacks over HTTP, NSS Labs also used the HTTPS protocol. 3 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  4. 4. Three distinct patterns of capabilities begin to emerge throughout this test. However a much morecomprehensive end-point protection test, scheduled for completion later this year, will provide a better indicationof comparative capabilities of the products.One surprising finding was that Base 64, Unicode, and JavaScript encoding failed to trip up antivirus productsas they have in previous NSS Labs tests. NSS Labs researchers will include several more evasions in the end-point product tests later this year.Basic Exploit ProtectionThe first test was to see which products could block the exploitation of two recent, high-risk vulnerabilities andidentify at which stage the product stopped the attack. Did the product block the exploit from triggering thevulnerability or simply the content delivered by the exploit? Avast, AVG, Avira, ESET, Kaspersky, McAfee,Norton, and Trend Micro all blocked both attacks against CVE-2012-1889 when NSS engineers attempted toexploit the two vulnerabilities. Avast AVG Avira CA ESET F-Secure CVE-2012-1875-calc CVE-2012-1875-reverse shell Kaspersky CVE-2012-1889-calc McAfee CVE-2012-1889-reverse shell Microsoft Norman Norton Panda Trend 0% 25% 50% 75% 100% Figure 2: Exploits Delivered Via HTTPF-Secure blocked both exploits against CVE-2012-1889 while failing to prevent either exploit against CVE-2012-1875. Conversely, CA and Microsoft blocked both attacks against CVE-2012-1875, while failing to preventeither exploit against CVE-2012-1889. Norman and Panda also failed to prevent both exploits against CVE-2012- 4 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  5. 5. 1889 and blocked only one of the two exploits against CVE-2012-1875, indicating that their protection relies ondetecting the malicious content being delivered after an exploit has successfully compromised the system asopposed to preventing the exploit itself.The World Is Going To HTTPS / SSLIn addition to banking and e-commerce sites, HTTPS is being used exclusively by some of the most popularInternet-based applications such as Google’s webmail service, Gmail.For the next phase NSS Labs researchers transmitted the exploits over an encrypted channel using the HTTPSprotocol. In these tests, only Avast, Kaspersky, McAfee, and Trend Micro successfully blocked both exploitswhile nine (9) of the 13 products fully or partially failed to protect the victim. Avast AVG Avira CA ESET F-Secure CVE-2012-1875-calc CVE-2012-1875-reverse shell Kaspersky CVE-2012-1889-calc McAfee CVE-2012-1889-reverse shell Microsoft Norman Norton Panda Trend 0% 25% 50% 75% 100% Figure 3: Exploits Delivered Via HTTPSAVG, Avira, CA, F-secure, and Microsoft failed to block any of the exploits, even though they had partial, or evencomplete, success in blocking the same attack when delivered over HTTP, indicating a failure to implementprotection against exploits delivered via HTTPS. ESET and Norton failed to block both attacks against CVE-2012-1875 when delivered via HTTPS, indicating a flaw in how the products handle attacks delivered via HTTPSagainst the browser itself. 5 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  6. 6. Where attackers elect to use SSL, it is quite possible that even known malware will slip past the faulty intrusionprevention found in these products.En GardeOnce an endpoint defense mechanism of any kind has been bypassed, the next step taken by most attackers isto attempt to disable it completely. This would, for example, enable further malicious software to be downloadedwithout risk of it being detected by the protection mechanism.There are significant differences in the abilities of market-leading products to defend themselves against beingdisabled. Unfortunately both Microsoft and CA offerings presented virtually no defensive capabilities. Bothproducts could be disabled with a simple “kill” command.Other products presented varying degrees of resilience and full details will be in the reports of the EPP testingresults in late 2012.The Good, The Bad, And The UglyAvast, Kaspersky, McAfee, and Trend were able to block all four attempted exploits when delivered via HTTP orHTTPS protocols. ESET and Norton both blocked the four initial attacks, but when HTTPS was added to the mixthey failed to block either attack exploiting CVE-2012-1875. AVG and Avira both blocked all four attemptedexploits, but were unable to deal with the HTTPS variations. Avast AVG CVE-2012-1875-calc-HTTP Avira CVE-2012-1875-reverse shell-HTTP CA ESET CVE-2012-1889-calc-HTTP F-Secure CVE-2012-1889-reverse shell-HTTP Kaspersky McAfee CVE-2012-1875-calc-HTTPS Microsoft CVE-2012-1875-reverse shell-HTTPS Norman Norton CVE-2012-1889-calc-HTTPS Panda Trend CVE-2012-1889-reverse shell-HTTPS 0% 20% 40% 60% 80% 100% Figure 4: Combined Results 6 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •
  7. 7. CA, Microsoft, Norman, and Panda, were all able to block only two of the eight total variations of the attacks.While Norman and Panda only blocked one exploit over HTTP, the same exploit was blocked over HTTPS,indicating that HTTPS does not appear to be an issue for either product.The combinations of failures and successes are dramatic and necessitate further research. It is clear that manyof the products are not blocking exploits. However, more testing is required to determine if those that scoredwell in this test had signatures for calc.exe and Meterpreter traffic, or actually block the exploits regardless ofpayload.The failure to deal with HTTPS would seem conclusive, but NSS Labs will further validate the results in morecomprehensive testing that will include a several more exploits and a battery of new and existing malware, bothknown and unknown to the products under test.©2012 NSS Labs, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrievalsystem, or transmitted without the express written consent of the authors.Please note that access to or use of this report is conditioned on the following: The information in this brief is subject to change by NSS Labs without notice. The information in this brief is believed by NSS Labs to be accurate and reliable at the time of publication, but is not guaranteed. All use of and reliance on this brief are at the reader’s sole risk. NSS Labs is not liable or responsible for any damages, losses, or expenses arising from any error or omission in this report. NO WARRANTIES, EXPRESS OR IMPLIED ARE GIVEN BY THE NSS LABS. ALL IMPLIED WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT ARE DISCLAIMED AND EXCLUDED BY NSS LABS. IN NO EVENT SHALL NSS LABS BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES, OR FOR ANY LOSS OF PROFIT, REVENUE, DATA, COMPUTER PROGRAMS, OR OTHER ASSETS, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.This brief does not imply any endorsement, sponsorship, affiliation, or verification by or with any organizations mentioned inthis brief.All trademarks, service marks, and trade names used in this brief are the trademarks, service marks, and trade names of theirrespective owners. 7 6207 Bee Caves Road, Suite 350 • Austin, TX 78746 • 512.961.5300 •