The Magic of Magic Bytes

[iago]

This is pretty neat.  He has a single file that runs differently depending on whether its extension is .html, .bat, or .exe. 

Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability through
forged magic byte.



AUTHOR: Andrey Bayora (www.securityelf.org)



For more details, screenshots and examples please read my article "The Magic
of magic byte" at www.securityelf.org . In addition, you will find a sample
"triple headed" program which has 3 different 'execution entry points',
depending on the extension of the file (exe, html or eml) - just change the
extension and the SAME file will be executed by (at least) THREE DIFFERENT
programs! (thanks to contributing author Wayne Langlois from
www.diamondcs.com.au).

DATE: October 25, 2005



VULNERABLE vendors and software (tested):



1.  ArcaVir 2005 (engine 2005-06-03,vir def 2005-06-27, scanner ver
2005-03-06, package ver 2005-06-21)

2.  AVG 7 (updates 24 June, ver.7.0.323, virus base 267.8.0/27)

3.  eTrust CA (ver 7.0.1.4, engine 11.9.1, vir sig. 9229)

4.  Dr.Web (v.4.32b, update 27.06.2005)

5.  F-Prot (ver. 3.16c, update 6/24/2005)

6.  Ikarus (latest demo version for DOS)

7.  Kaspersky (update 24 June, ver. 5.0.372)

8.  McAfee Internet Security Suite 7.1.5 (updates 25 June, ver 9.1.08,
engine 4.4.00, dat 4.0.4519 6/22/2005)

9.  McAfee Corporate (updates 25 June, ver. 8.0.0 patch 10, vir def 4521,
engine 4400)

10. Norman ( ver 5.81, engine 5.83.02, update 2005/06/23)

11. TrendMicro PC-Cillin 2005 (ver 12.0.1244, engine 7.510.1002, pattern
2.701.00)

12. TrendMicro OfficeScan (ver7.0, engine 7.510.1002, vir pattern 2.701.00
6/23/2005)

13. Panda Titanium 2005 (updates 24 June, ver 4.02.01)

14. UNA - Ukrainian National Antivirus (ver. 1.83.2.16 kernel v.265)

15. Sophos 3.91 (engine 2.28.4, virData 3.91)



IMPORTANT NOTE:

Similar vulnerability may exist in many other antivirus\anti-spyware desktop
and gateway products. In addition, various "file filter" solutions may be
affected as well.



NOT VULNERABLE vendors and software (tested):



1.  F-Secure (updates 24 June, ver 5.56 b.10450)

2.  Avast (ver. 4.6.655, vir databas 0525-5 06/25/2005)

3.  BitDefender (ver. 8.0.200, update 6/24/2005, engine 7.01934)

4.  ClamWin (ver. 0.86.1, upd 24 June 2005)

5.  NOD32 (updates 24 June, ver 2.50.25, vir database 1.1152)

6.  Symantec Corporate (ver 10.0.0.359, engine 103.0.2.7)

7.  Norton Internet Security 2005 (ver 11.5.6.14)

8.  VBA32 (ver 3.10.4, updates 27.06.2005)

9.  HBEDV Antivir Personal (ver 6.31.00.01, engine 6.31.0.7, vir def
6.31.0.109 6/24/2005)

10. Sophos 5 (ver. 5.0.2, vir def 3.93, upd 6/30/2005)

11. Sophos 3.95 (engine 2.30.4)



SEVERITY: critical



DESCRIPTION:



The problem exists in the scanning engine - in the routine that determines
the file type. If some file types (file types tested are .BAT, .HTML and
.EML) changed to have the MAGIC BYTE of the EXE files (MZ) at the beginning,
then many antivirus programs will be unable to detect the malicious file. It
will break the normal flow of the antivirus scanning and many existent and
future viruses will be undetected.



NOTE: In my test, I used the EXE headers (MZ), but it is possible to use
other headers (magic byte) that will lead to the same effect.



ANALYSIS:



Some file types like .bat, .html and .eml can be properly executed even if
they have some "unrelated" beginning. For example, in the case of .BAT
files - it is possible to prepend some "junk" data at the beginning of the
file without altering correct execution of the batch file. In my tests, I
used the calc.exe headers (first 120 bytes - middle of the dosstub section)
to change 5 different files of existing viruses. In addition, the simplest
test of this vulnerability is to prepend only the magic byte (MZ) to the
existing malicious file and check if this file is detected by antivirus
program.



NOTE, that this is NOT the case where the change of existing virus file
resulted in the "broken" detection signature (see details and the test logic
in "The Magic of magic byte" article at www.securityelf.org).



WORKAROUND:

I did not found any effective one besides of patching the vulnerable engine.



CREDITS:

The idea for this vulnerability came during discussions from Wayne Langlois
at diamondcs.com.au, who hinted that JPEGs could probably be exploited in
this way.



TIME LINE:



July 13, 2005 - Initial vendor notification

July 16, 2005 - Second vendor notification

.....Waiting.....Waiting....

October 24, 2005 - Public disclosure (uncoordinated)



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Joe]

Hah, doesn't effect ClamScan.

[iago]

TrendMicro's response:

I forwarded the Magic Byte message thread to Trend Micro and this was their
response... they want me and my clients to upgrade to their latest version
in order to get realistic protection... Anyone from Trend Micro listening?

-----Original Message-----
From: retail@support.trendmicro.com [mailto:retail@support.trendmicro.com]
Sent: Saturday, October 29, 2005 4:02 AM
To: auri@auri.net
Subject: [SR #:1-40483753] RE: Update for the magic byte bug

Dear Valued Client,                                                       

Thank you for taking the time to contact and update us with this concern, I
am Jonathan from the Consumer Support Team and I'll be assisting you on this
matter.

The issue you are inquiring about is already been addressed in the Trend
Micro PC-Cillin Internet Security 2006 version.

Hope this proves to be useful to you!

Please let me know if we were able to resolve your concern(s) so we may
formally close this case.  Your immediate response  will be most
appreciated. Again, thank you for writing us. Should you have further
inquiries, please do not hesitate to call us. Other means of reaching our
office are indicated below.

Please do not hesitate to contact us back should you have any further
concern/s.

NOTE: The Knowledge Base is a depository of information allowing users to
get help in resolving any issue that may arise in using Trend Micro
products. You can always visit the Knowledge Base website at this link
<http://kb.trendmicro.com/solutions/solutionSearch.asp>


Sincerely Yours,

Jonathan Lua
Consumer Support Team, Product Support Services
TrendLabs HQ, Trend Micro Incorporated

P.S.
In order for us to have a history of our correspondence and help us process
your inquiry faster, please DO NOT DELETE the subject and the contents of
this email. The subject contains the case ID while the content serves as the
case history.

Are your products new pattern formats (NPF) compliant?
Please see http://www.trendmicro.com/npf  to verify product compliancy

<<<====================================================>>>
[URL / website]      http://www.trendmicro.com/en/home/us/personal.htm
[E-mail]                    pc-cillin@support.trendmicro.com
[Knowledge Base]  http://kb.trendmicro.com/solutions/Default.asp?
[Contact us]            http://www.trendmicro.com/en/support/contact.htm
[Retail Products]     1 - 800 - 864 - 6027 (from 5am to 5pm PST)
<<<====================================================>>>

If you have any comments with our support, please contact:
Retail_manager@support.trendmicro.com

If you would like to voice out some of your comments about Trend and her
products, please contact: comments@support.trendmicro.com


-----Original Message-----

From:  auri@auri.net
Sent:  10/29/2005 09:26:34 AM
To:  "US Tech Support" <support@trendmicro.com>; <info@trendmicro.com>
Subject:  Update for the magic byte bug

Is this being resolved in TM Internet Security 2005 please?

Thanks again!

Best,

-Auri

[deadly7]

Good game junk-code in virii.

[Sidoh]

viruses is more frequently considered the correct plural of virus.  :P

[iago]

viruses is more frequently considered the correct plural of virus.  :P

You are correct.  One of those "Strange but True" things :)

[Sidoh]

You are correct.  One of those "Strange but True" things :)

( OFF TOPIC WARNING!   O_O )

Sneezes are 1/8th an orgasm.

Haha, that was actually someone said in WoW when I was playing with ~15 other people.  Obviously, one of the members was female because they said "I feel sorry for anyone who believes that."  Haha.

[deadly7]

viruses is more frequently considered the correct plural of virus. :P

You are correct. One of those "Strange but True" things :)

Yeah, but not according to my english teacher!!

[iago]

I think when you have more than one virus in a human, or the normal kind, it's virii. 

And when it's a computer virus, it's viruses. 

At least, that's what I've been told..

[Quik]

You are correct.  One of those "Strange but True" things :)

( OFF TOPIC WARNING! O_O )

Sneezes are 1/8th an orgasm.

Haha, that was actually someone said in WoW when I was playing with ~15 other people.  Obviously, one of the members was female because they said "I feel sorry for anyone who believes that."  Haha.

It's true: it's on the snapple caps.

[Sidoh]

It's true: it's on the snapple caps.

Haha, I wonder how they'd measure that.  I'd wager that orgasms are more pleasureful from person to person.

[Blaze]

It's true: it's on the snapple caps.

Haha, I wonder how they'd measure that.  I'd wager that orgasms are more pleasureful from person to person.

gender to gender*

[iago]

It's true: it's on the snapple caps.

Haha, I wonder how they'd measure that.  I'd wager that orgasms are more pleasureful from person to person.

gender to gender*

People who are different genders also tend to be different people.

It reminds me of the fact/legend that dolphins are the only creature (besides mean) that enjoys sex -- who asked them?

[Quik]

It's true: it's on the snapple caps.

Haha, I wonder how they'd measure that. I'd wager that orgasms are more pleasureful from person to person.

gender to gender*

People who are different genders also tend to be different people.

It reminds me of the fact/legend that dolphins are the only creature (besides mean) that enjoys sex -- who asked them?

It's the coo-ing sound they make when they orgasm, it's a sound of pleasure. I make a similar sound, let me assure you of that.

[Sidoh]

gender to gender*

I'm pretty sure that each person finds an orgasm more or less pleasurable than the last person.  Those who have not experienced it much are obviously going to find it much more pleasurable than a porn star or something like that. ;P