full-disclosure - Re: Avast Antivirus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 19 Jan 2012 19:42:22 +0100
From: Floste <floste@....de>
To: Juergen Schmidt <ju@...de>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Avast Antivirus

>So if a sandboxed process injects a DLL in say a running IE process outside

That is exactly what we are talking about! Avast allows you to run a
program inside a sandbox. A program running inside the sandbox can still
inject dlls into processes outside of the sandbox! So much for the
so-called sandbox.
Avast automatically suggests to use the sandbox if one tries to start
certain possibly dangerous programs.

In addition to the sandbox Avast has onother, diffenent feature called
"SafeZone". Unlike the sandbox, SafeZone is supposed to keep keyloggers
out of certain processes. But you can get into these "safe" processes
using dll-injection.

This only applies if the user is running an x64 operating system. (The
os type matters, not the application type) I guess that they do
additional security checks in kernelmode on x86 os, but not on x64 os.

Btw: I like heise security :)

Am 19.01.2012 12:04, schrieb Juergen Schmidt:
> On Tue, 17 Jan 2012, Floste wrote:
> 
>> Hello,
>>
>> Avast Antivirus also comes with sandbox and a "SafeZone". But both can
>> be circumvented using simple dll-injection and they seem to do nothing
>> about it: http://forum.avast.com/index.php?topic=82291.0
>>
>> Maybe this post here will encourage them to fix it.
> 
> In my understanding a sandbox is not supposed to prevent you from
> getting in from the outside but from escaping from the inside. So if a
> sandboxed process injects a DLL in say a running IE process outside --
> then we are talking about vulns
> 
> 
> bye, ju
> 
> 
> 
> -- 
> Juergen Schmidt       Chefredakteur  heise Security     www.heisec.de
> Heise Zeitschriften Verlag, Karl-Wiechert-Allee 10 ,   D-30625 Hannover
> Tel. +49 511 5352 300      FAX +49 511 5352 417       EMail ju@...sec.de
> GPG-Key: 0x38EA4970,  5D7B 476D 84D5 94FF E7C5  67BE F895 0A18 38EA 4970
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/