full-disclosure - Re: Avast Antivirus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 20 Jan 2012 12:26:44 -0500
From: Jeffrey Walton <noloader@...il.com>
To: Floste <floste@....de>
Cc: full-disclosure@...ts.grok.org.uk, Juergen Schmidt <ju@...de>
Subject: Re: Avast Antivirus

On Thu, Jan 19, 2012 at 1:42 PM, Floste <floste@....de> wrote:
>>So if a sandboxed process injects a DLL in say a running IE process outside
>
> That is exactly what we are talking about! Avast allows you to run a
> program inside a sandbox. A program running inside the sandbox can still
> inject dlls into processes outside of the sandbox! So much for the
> so-called sandbox.
> Avast automatically suggests to use the sandbox if one tries to start
> certain possibly dangerous programs.
>
> In addition to the sandbox Avast has onother, diffenent feature called
> "SafeZone". Unlike the sandbox, SafeZone is supposed to keep keyloggers
> out of certain processes. But you can get into these "safe" processes
> using dll-injection.
>
>
> This only applies if the user is running an x64 operating system. (The
> os type matters, not the application type) I guess that they do
> additional security checks in kernelmode on x86 os, but not on x64 os.
I believe for Vista and below, Kernel Patch Protection (Patch Guard)
is optional for x86, but mandatory for x64. Put another way, vendors
are supposed to use the Kernel Data and Filtering Support API rather
than hot patching the System Service Dispatch Table (SSDT) to extend
Object Manager functionality.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/