The Hacker Diary

A False Sense of Security : AntiVirus Part III

Previously, we touched on the concept that AV is not infallible as you would be lead to believe by advertisers. This post is the continuation of that study.

PART III

continued from here

To begin, I decided to compress NetCat with UPX. The syntax and flags used were as follows:

"upx C:\NetCat\nc.exe --best --ultra-brute --compress-icons=3 --strip-relocs=1"

Now that it has been compressed, let's take a look at the virgin executable's virus total scan first to find out what AV's detected it.

From the results, we see that these 21 different AntiVirus solutions were the only ones to detect our UNPACKED executable. Technically, NetCat is not a virus or malware but the potential for it to be used as such exists; as a result of this it should be flagged by all and an optional detection in their configurations.

Now that it's been packed, I decided to see if our simple one time packing of the executable would be sufficient to hide from any of our antivirus solutions, so I uploaded it to Virus Total expecting to have 21 total detections once more.

I was wrong.

Out of our list of AV's, only 15 detected NetCat as it was before and 1 just flagged that it was packed not even detecting the real threat.

But were not done yet are we? Dig in, it's only going to get messier from here.

I decided to write a batch file that would process the executable sequentially through UPX compression and something I haven't touched on until right now called "Morphine".

The actual code for the batch was:

@ECHO OFF
REM: Variables
REM:************************
SET INPUT=C:\HackTools\NetCat\nc.exe
SET OUTPUT=C:\Users\Admin\Desktop\nc.exe

@echo.
@echo ******************************************
@echo * Compressing Executable with UPX *
@echo ******************************************
@echo.

C:\HackTools\Packers\upx\upx --best --ultra-brute --compress-icons=3 --strip-relocs=1 %INPUT% -o %OUTPUT%

@echo.
@echo ******************************************
@echo *** Opening LordPE to Obtain Imagebase ***
@echo ******************************************
@echo.

start "%ProgramFiles%\Internet Explorer\IEXPLORE.EXE" "C:\HackTools\exetools\LordPE\LordPE.exe"

@ECHO Path of executable is %OUTPUT%
@echo.
@echo.
@echo.

:imagebase
set IMAGEBASE=
set /P IMAGEBASE=Type input: %=%
if "%IMAGEBASE%"=="" goto input
echo Your input was: %IMAGEBASE%

Pause

@echo.
@echo.
@echo.
@echo ******************************************
@echo * Morphine is crypting the executable *
@echo ******************************************
@echo.
@echo.
@echo.

C:\HackTools\Packers\Morphine\morphine.exe -b:%IMAGEBASE% -o:%OUTPUT% %OUTPUT%

PAUSE

Morphine which has been around for quite some time in the underground blackhat hacker circles, is used to make executables "KAV undetectable". I downloaded a dated version of Morphine in hopes that a 2004 release of the tool would have been reverse engineered by AV companies and easily unpacked to reveal the executable being masked. KAV (which is short for Kaspersky Antivirus) is apparently used as the benchmark of detection when it comes to masking malware by the underground of virus and remote access trojan writers. Floating in IRC (Internet Relay Chat) chatrooms and researching for this post in google, I find numerous posts referencing Kaspersky as the antivirus to beat and as such my expectations of it's performance are naturally higher than that of the others.

It was time to process our executable.

As you can see from the video above, I run our batch script which compresses our executable then packs our executable with Morphine. Then I upload it to Virus Total and take a look at the results.

As you can see, the majority of antivirus solutions are only detecting that the file has been packed and some even identify the packer. Few detect the true identity of our executable, which is NetCat.

This is a double edged sword.

On one hand we are being flagged which is good, but on the other hand if we cannot identify the true identity of an executable and are subverted by packing, then we may subject to its true intentions. Additionally, we have false positives of different viruses by some av's.

We have seen that Morphine is for the most part detected now and unfortunately only a handful of Antivirus solutions even identify our masked executable as NetCat. But we must keep in mind we did not have a 100% detection ratio and additionally we used a tool that was dated. To me it is un-acceptable for any Antivirus to not detect Morphine after this much elapsed time. Just think to yourself, what happens when we use the most current releases?

Since I am not part of the underground group of people who specialize in these activities, I frankly don't know where to go to get the latest release. I am sure with some crafty googling I could find it but I don't need to at this point. If a tool that is 5-6 years old can still mask an executable, it's not a stretch to assume the most current release slips under the radar as well, which brings me to the last and final stage in this demonstration.

From the research I had done, I found that many virus and trojan writers wrote their OWN packing/encrypting routines to mask their malware leaving Morphine out of the equation altogether. This is a HUGE problem for AV and you. If your AV doesn't have a signature to compare with there will be no detection.

Packing It Myself

I decided to finish this post by attempting to pack an executable myself based on information gleaned from google and google I did. I searched google with this search string "exe packing" and clicked the first result with skepticism.

In 30 seconds or less, I had enough information from google to not only write my own encrypting routine but mask NetCat from 31 out of 39 AntiVirus solutions!!!!!!!!!

Following the instructions from google result http://davidiorg.blogspot.com/2008/06/exe-packing-hard-way.html, I was able to evade 31 out of 39 antivirus solutions.

NOTE: David has a pretty clear explanation on his site that someone who has intermediate knowledge of the topic could easily understand and execute.

The results of packing netcat are chilling.

As you can see, with little effort and google, I was able to successfully bypass all but 8 AntiVirus solutions. Few of those solutions which were mainstream and advertised even had a detection let alone identified NetCat.

Conclusion and Q & A

When I started this post, I decidedly set out to expose that of which I already knew to be true. I didn't expect however that a google would give me enough information to pack netcat and evade that many av solutions with little know-how or effort especially since the information posted was done so in 2008. Antivirus solutions need to reinvent the wheel and get with the times if they are to survive in the wild wild west ages of the internet.

What antivirus is the best for me to use?

In my opinion there are a couple different solutions available that I would recommend. I personally use AntiVir XP which is free for non-commercial use. Kaspersky from what I have seen in hacking forums researching, shows the highest level of visibility in that it's very good at thwarting coders; which is why it appears to be the standard to beat. However, the results of manually packing the executable did not look favorably on Kaspersky so I really don't know what to think about KAV. Additionally, KAV may have intentionally not detected netcat as netcat can be used for good or bad. Sophos also appears to have high visibility and NOD32 is allegedly the best hueristical scanner available however NOD32 failed to catch NetCat... Intentional?

My company uses XXX Anti Virus and we've never had any issues. How is your "study" relevant?

Rootkits. The idea that if your not showing symptoms you can't be infected is a fallacy that many believe. Blackhat hackers aren't you average novice banging away at their keyboard 2:30 in the morning, rather they silently continue to monitor and steal information without you ever knowing any different. This is more dangerous than a conventional threat because a virus or trojan will rear it's ugly head eventually and you will take the nessesary precautions to protect your credit/identity/credentials/etc. A rootkit is similar to a trojan except it's a completely silent killer that modifies it's host operations system. It does this in such a manner that it's exceptionally hard to find or detect and often the best policy is to completely wipe the system.

What else can I do to protect myself?

Read. Read as much as you can about how viruses and malware work. Become familiar with common methods and common viruses. Monitor or subscribe to hacker publications.

I didn't understand some of the terms you used.

Go here -> A Glossary of Terms!

Tell me what you think of my results.