AntiVirus As Attack Surface

The concept of attack surface is fairly simple – increasing the amount of code on a system decreases the security of that system, to some degree. The degree to which that code degrades your systems security is really based on two factors; the quality of the code and how that code can be interacted with. High quality code, which has been developed to be secure, and makes use of security techniques, will be more difficult to exploit.  If you can’t interact with the code you’ll have a very difficult time exploiting it.

Antivirus’s are very weak in terms of the second aspect – they interact with attacker controlled data by design. AVs work in a hostile environment, and they do it in a fairly dangerous way.

Exploiting a browser today isn’t easy. Most of them patch consistently, have bounty programs, make use of security techniques like ASLR, and implement powerful sandboxes. So attacking a modern browser isn’t the best idea. But why attack the browser when there’s an AV running?

In a very brief and immature analysis of AVs I’ve found numerous package components that aren’t ASLR enabled. Many of these components are actually injected into the browser process, essentially defeating the purpose of ASLR. And that’s not the least of it – programs with ‘web scanners’ or ’email scanners’ are parsing input straight from webpages – attacker controlled data – and they’re doing it in such a way that would mean full bypass of a sandbox.

So while an exploit can get Untrusted Integrity in Chrome’s web renderer it could get full Admin access by exploiting the AV, all from the same source of attacker controlled data.

So why don’t we see this more often? Diversity, mostly. Antivirus, as an industry, is filled with many contenders. There are dozens of products out there, and none has more than 30% of the market share on its own. MSE, by Microsoft, has the greatest market share in North America and due to its simplicity and it being so non-invasive it’s less ripe for exploit compared to those filled with a thousand different features.

But Java doesn’t have the massive market share it used to, and it’s constantly exploited. So we can’t really rely on market share to save us. And in terms of APT against companies an AV is perfect – it’s one program you can know is installed on every endpoint for a user, a simple phishing attack will become far more effective when you get instant RCE as an Admin.

The point is that AVs are adding a lot of attack surface and you have to ask just how much they’re providing. That’s the case with all software – how much does it provide and how much is it making this harder. AV products need to get proactive about security because they are far too tempting an attack vector.