Researchers develop attack that bypasses all anti-virus software

Posted on Tuesday, May 11 2010 @ 3:00 CEST by Thomas De Maesschalck
Security researchers have crafted a new exploit that can bypass protections of dozens of the most popular anti-virus tools. In layman's terms, the method works by sending the anti-virus software a sample of code that will pass the security checks and then, before the code is executed, swap it with a malicious payload. All anti-virus programs that use SSDT (System Service Descriptor Table) are affected, which includes all of the 34 products the researchers tested, including software from McAfee, Trend Micro, AVG and BitDefender.
The exploit has to be timed just right so the benign code isn't switched too soon or too late. But for systems running on multicore processors, matousec's "argument-switch" attack is fairly reliable because one thread is often unable to keep track of other simultaneously running threads. As a result, the vast majority of malware protection offered for Windows PCs can be tricked into allowing malicious code that under normal conditions would be blocked.

All that's required is that the AV software use SSDT, or System Service Descriptor Table, hooks to modify parts of the OS kernel.
More info at The Register.


About the Author

Thomas De Maesschalck

Thomas has been messing with computer since early childhood and firmly believes the Internet is the best thing since sliced bread. Enjoys playing with new tech, is fascinated by science, and passionate about financial markets. When not behind a computer, he can be found with running shoes on or lifting heavy weights in the weight room.



Loading Comments