This is the review of Antivirus Bypass Techniques book.

(My) Conclusion

This book is a niche subject book, to be more precise it’s about a niche tool (antivirus) used in a niche domain (endpoint security) of cybersecurity.

As his name implies, it describes how antivirus products are working and different technique to evade this antivirus products.

The book it’is not very technical (compared with a programming book) but it implies some knowledge of Windows OS architecture, Assembler and Python.

If you are new to this subject (like myself) it’s very good introduction that will give you a rather technical glimpse of the mouse and cat “game” played between the antivirus developers and malware creators.

If you are already working in the endpoint security domain you (probably) already know all the techniques presented in the book.

1.Introduction to the Security Landscape

This chapter is exploring the following topics:

• definition of different malware types:
  • Virus: A malware type that replicates itself in the system.
  • Worm: A type of malware whose purpose is to spread throughout a network and
    infect computers connected to that network.
  • Rootkit: A type of malware that is found in lower levels of the operating system that
    tend to be highly privileged.
  • Downloader: A type of malware whose function is to download and run from the
    internet some other malicious files.
  • Ransomware: A type of malware whose purpose is to encrypt computer files and
    demand financial ransom from the user before they can access their files.
  • Botnet: Botnet malware causes the user to be a small part of a large network of
    infected computers.
  • Backdoor: A type of malware whose purpose is  to leave open a “back door”, providing the attacker with ongoing access to the user’s computer.
  • PUP: An acronym that stands for potentially unwanted program, a name that
    includes malware whose purpose is to present undesirable content to the user, for
    instance, ads.
  • Dropper: A type of malware whose purpose is to “drop” a component of itself into
    the hard drive.
  • Scareware: A type of malware that presents false data about the computer it is
    installed on, so as to frighten the user into performing actions that could be
    malicious, such as installing fake antivirus software or even paying money for it.
  • Trojan: A type of malware that performs as if it were a legitimate, innocent
    application within the operating system.
  • Spyware: A type of malware whose purpose is to spy on the user and steal their
    information to sell it for financial gain.
• definition of different protection system types:
  • EDR (Endpoint Detection and Response): The purpose of EDR systems is to protect the business user from malware
    attacks through real-time response to any type of event defined as malicious.
  • Firewall: A system for monitoring, blocking, and identification of network-based
    threats, based on a pre-defined policy.
  • IDS/IPS (Intrusion Detection and Protection System): IDS and IPS provide network-level security, based on generic signatures, which inspects network packets and searches for malicious patterns or malicious flow.
  • DLP (Data Loss Prevention): DLP’s sole purpose is to stop and report on sensitive data exfiltrated from the organization, whether on portable media (thumb drive/disk on key), email, uploading to a file server, or more.
• the basics of an antivirus product. Most of the antivirus products have different types of engines:
  • static engine: Conducts comparisons of existing files within the operating system against a database of signatures, and in this way can identify malware.
  • dynamic engine: Is checking the files at runtime using API monitoring (the goal of API monitoring is to intercept API calls in the operating system and to detect the malicious ones) and sand-boxing (A sandbox is a virtual environment that is separated from the memory of the physical host computer. This allows the detection and analysis of malicious software by executing it within a virtual environment)
  • heuristic engine: This type of engine determines a score for each file by conducting a statistical analysis that combines the static and dynamic engine methodologies.
  • unpacker engine: Unpacking is the process of restoring the original malware code; the malicious code was “packed” in order to hide a malicious patterns and thus thwart
    signature-based detection. The unpacker engine is able to detect if a file contains a (known) unpacker code.

2.Before Research Begins

In order to evade the antivirus products you must have a good understanding about how the different antivirus program components are working. The authors are using different tools (on Windows OS only) that usually are used for malware analysis to discover the working mechanics of the AVG Antivirus.

The authors are using the following tools :

• Process Explorer is a tool that will will provide us with a lot of relevant information about the processes that are running in the operating system like the file name of the processes, the percentage of the CPU resources for the processes, the amount of memory and RAM allocated to the processes. Using the Process Explorer it is possible for example to find the hook that are used by the antivirus software to conduct monitoring on every process that exists within the operating system. This hook is usually a DLL file that is injected into every process running within the operating system
• Process Monitor is a tool that can be used to observe the behavior of each process in the operating system from the moment when are started until the moment are closed. Using the Process Monitor is possible for example to find the processes used by the antivirus software for specific tasks like scanning a specific file.
• Autoruns is a tool that shows what programs are configured to run during system bootup or login, and when you start various built-in Windows applications. With Autoruns is possible to use filters to find for example all the antivirus software files that are loaded at the startup of the operating system.
• Regshot is an open source tool that lets you take a snapshot of your registry, then compare two registry shots, before and after installing a program. In this case it is used to find all the registry changes that took place after installing the antivirus software

3.Antivirus Research Approaches

The authors are proposing two methods to bypass the  antivirus software:

• Find and exploit a vulnerability in the antivirus software
• Find and use a detection bypass method

This chapter gives a few details about the first method; basically it presents a few vulnerabilities on different antivirus software packages that had impact on the way the antivirus was functioning:

• Insufficient permissions on the static signature file. The file containing static signature had insufficient permissions meaning that any low-privileged user could modify the content of the file.
• Unquoted service path. When a service is created within the Windows operating system and the executable path contains spaces and the path is not enclosed within quotation marks, the service will be susceptible to an Unquoted Service Path vulnerability.
  To exploit this vulnerability, an executable file must be created in a particular location in the service’s executable path, and instead of starting up the antivirus service, the service we created previously will load first and cause the antivirus to not load during operating system startup
• DLL hijaking. When software wants to load a particular DLL, it uses the LoadLibraryW() Windows API call. It passes as a parameter to this function the name of the DLL it wishes to load. It is not recommended to use the LoadLibrary() function, due to the fact that it is
  possible to replace the original DLL with another one that has the same name, and in that
  way to cause the program to run our DLL instead of the originally intended DLL.

If you are interested of other types of vulnerabilities linked to the antivirus products you can look into the CVE MITRE database using the keyword antivirus.

4.Bypassing the Dynamic Engine

As explained in the first chapter the dynamic engine is checking the runtime behavior of files using API monitoring and sand-boxing. The authors are presenting two types of techniques for bypassing the dynamic engine:

 Bypass using process Injection

Process injection goal is to inject a piece of code into the process memory address space of another process, give this memory address space
execution permissions, and then execute the injected code. The general steps of a process injection are:

1. Identify a target process.
2. Receive a handle for the targeted process to access its process address space.
3. Allocate a virtual memory address space where the code will be injected and
   executed, and assign an execution flag if needed.
4. Perform code injection into the allocated memory address space of the targeted
   process.
5. Execute the injected code.

The authors are presenting three process injections techniques; there are a lot more techniques, for a non-exhaustive list you can check MITRE Pricess Injection Techniques :

• DLL Injection DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).
• Process hollowing Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.
• Process doppelganging This technique is using the Windows Transactional NTFS (TxF) API. TxF was introduced in Vista as a method to perform safe file operations.To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. Adversaries may abuse TxF for replacing the memory of a legitimate process, enabling the veiled execution of malicious code.

Bypass using timing-based techniques

Timing based techniques are based on the fact that antivirus vendors prefer to scan about 100,000 files in 24 minutes, with a detection rate of about 70%, over scanning the same number of files in 24 hours, with a detection rate of around 95%.

The first technique will utilize Windows API calls that cause the delay of the malware functionality, so the dynamic engine will not be able to spot the malware because it is not executed in a timely manner. A basic technique to  implement this behavior is by using the sleep() function combined with the GetTickCount() function.

The usage of the sleep() function only can be detected by the antivirus static engine and then antivirus emulator (used by dynamic engine) will simulate the pass of the sleep time thus bypassing the malware defense mechanism. The  usage of GetTickCount() (which returns the amount of time the operating system has been up and running) will counter this (time forward) emulation because the malware will be able to detect it.

The second technique is named by the authors the memory bombing and take advantage of the limited time that antivirus software has to dedicate to each individual file during scanning.

The pseudo-code for this technique looks like:

int main(){
  char *memory_bombing = NULL;

  //Initialize the memory_bombing variable with a bunch of
  //zeroes.
  //At this point, the antivirus is struggling to scan the
  //file and forfeits
  memory_bombing = (char *) calloc(200000000, sizeof(char));

  if(memory_bombing != NULL) {
      //free the memory allocated to memory_bombing
      free(memory_bombing);
      payload();
  }
  return 0;
}

The logic behind this type of bypass technique relies on the dynamic antivirus engine
scanning for malicious code in newly spawned processes by allocating virtual memory so
that the executed process can be scanned for malicious code in a sandboxed environment.
The allocated memory is limited because antivirus engines do not want to impact the user
experience so if the antivirus engine have to allocate a large amount of memory the antivirus engines will not scan the file.

5.Bypassing the Static Engine

The static engine is using file signatures to spot malicious files so, a lot of antiv-viruses are embedding the YARA tool; the chapter contains also a small introduction to YARA templates.

There are three ways to by pass the static engine:

• • Code Obfuscation is the process of making applications difficult or impossible to de-compile or disassemble, and make the application code more difficult to parse. The code obfuscation could defeat the ARA templates which are looking for specific strings into the files.
  • Encryption In this case the malicious functionality of the malware will be encrypted and appear as a harmless piece of code , meaning the antivirus software will treat it as such and will allow the malware to successfully run on the system.
    But before malware starts to execute its malicious functionality, it needs to decrypt its
    code within runtime memory. Only after the malware decrypts itself will the code be
    ready to begin its malicious actions. There are different encryption techniques used by the malwares:
    • Oligomorphic code includes several decryptors that malware can use. Each time it runs on the system, it randomly chooses a different decryptor to decrypt itself.
    • Polymorphic code mostly uses a polymorphic engine that usually has two roles. The first role is choosing which decryptor to use, and the second role is loading the relevant source code so that the encrypted code will match the selected decryptor.
    • Metamorphic code is code whose goal is to change the content of malware each time it runs, thus causing itself to mutate.
  • Packing A packer is a tool used to mask a malicious file. In general, packers work by taking an EXE file and obfuscating and compressing the code section (“.text” section) using a predefined algorithm. Following this, packers add a region in the file referred to as a stub, whose purpose is to unpack the software or malware in the operating system’s runtime memory and transfer the execution to the original entry point (OEP). The OEP is the entry point that was originally defined as the start of program execution before packing took place.The authors are presenting how the UPX and AsPAck packers are packaging a file and how unpacker will have to work in order to detect the content of the original file.
    

6.Other Antivirus Bypass Techniques

This chapter presents other bypass techniques:

• Binary patching: It consists in opening/executing a binary through a debugger (the x32dbg/x64dbg in the book example), changing (on the fly) some code and then re-generating a new binary using the “Patch File” functionality of the debugger. This technique would defeat the static engine.
• Timestomping; It consists in changing some metadata of a binary file like the created date. This relies on the fact that the creation date could be used for computing static signatures of different files so changing the creation date could defeat a static engine.
• Junk code. Technique very similar to the Code Obfuscation technique presented in the chapter 5 Bypassing the static engine. The Junk code technique could also add empty functions, or loading non-existing files that could confuse the dynamic engine.
• PowerShell. It consists in executing a payload directly from powershell; The powershell binary being a trusted file then the dynamic engine might be bypassed. 
• Single malicious functionality If the static and the dynamic engine are not able to decide if a file is malicious then the heuristic engine will try to compute a score for the scanned file. The heuristic engine have a detection threshold under which a scanned file will not be marked as malicious even if it contains some potentially malicious components. The goal for the malware developer/s is to find the maximum number of malicious actions that will be under the detection threshold of the heuristic engine. 

7.Antivirus Bypass Techniques in Red Team Operations

This chapter is for me rather badly named; it starts by explaining what are the responsibilities and the goals of a red team and how it use the techniques presented into this book in the context of pen tests.

But, the main part if the chapter presents how a malware can check what antivirus products are installed on the endpoints that it wants to attack in order to apply the right bypass techniques, action that the authors are calling the fingerprinting of the antivirus software.

Antivirus fingerprinting can be done based on identifiable constants, such as the following:  Service names (for example, WinDefend is for example the service name for Microsoft Defender), Process names (or example, AVGSvc.exe is the process name of the AVG antivirus), Domain names, Registry keys or Filesystem artifacts.

The authors are recommending the following GitHub repository ethereal-vx/Antivirus-Artifacts  to find more details about Antivirus fingerprinting

8.Best Practices and Recommendations

The last chapter of the book can be split in 2 parts. The first part presents some controls that the antivirus providers could implement in order to mitigate some (not all of them) of the bypass techniques presented in previous chapters.

To mitigate the DLL hijacking vulnerability (a DLL is loaded using his name; see chapter 3 for more explanations) a proper mechanism to validate the loaded DLL module should be implemented. This validation should use not only the DLL name but also by a certificate and a signature.

To mitigate the Unquoted service path vulnerability (an executable path contains spaces and the path is not enclosed within quotation marks; see chapter 3 for more explanation) the solution is simply to wrap quotation marks around the executable path of the service.

For improving the antivirus detection the authors are proposing to use “dynamic” YARA. The goal of the “dynamic” YARA is to scan for potentially malicious strings and code at the memory level, on a dumped memory snapshot. Normally YARA is used by the static engine for file signature but in the case of “dynamic” YARA the template engine is used to look at the memory where the malware has been already de-obfuscated, unpacked, and decrypted.

Another best practice consists in the usage of Antimalware Scan Interface (AMSI) by the application developers.Windows Antimalware Scan Interface (AMSI) is an API that allows custom applications and services to integrate with any antimalware product that’s present on a machine.

The second part of the chapter contains some secure coding recommendations which can be applicable in SDLC of any type of software: Do not use old code, Input validation (of the AntiVirus UI), Read and fix the compiler warnings, Automated code testing, Use integrity validation for the static signature files download.