How bad is a source code leak for an antivirus?

Question

I was reading that Symantec suffered a source code leak and I was wondering how bad this is for a anti-virus product. Do these products rely heavily upon "(in)Security Through Obscurity" or does it really matter? ClamAV is open source, does this weaken the security that it can provide?

Answer 1

It is definitely possible that it will be easier to avoid heuristic based algorithms if you know specifically what they are checking for and makes it much less of a black box test. Other than that depending on what was leaked if they got the signatures themselves that would be invaluable because you'd then know exactly what they were looking for and you'd be able to modify accordingly.

Answer 2

I'm not certain this is necessarily security through obscurity by design. Symantec, like many corporate entities before them, see their source code as the intellectual property and not necessarily guarded for the sole reason of protecting their product from directed attacks. (Note that it doesn't hurt to have a little security by obscurity as long as it isn't your only means of protection.)

However, with that said, having their (old) source code read can open up new avenues for exploits. Although it is 5 years old, it is entirely possible (and generally probable) that parts of the source code have been reused in many of their more recent products.

Personally, I have reviewed -- as part of my job -- source code for products which have been in iterations for the past 10 years or more. The latest editions almost always have at least some code from their initial versions because it is usually the case that the core simply gets augmented rather than re-written.

Answer 3

I was thinking that it might be possible to discover and exploit vulnerabilities in the AV itself, and craft viruses that attack the AV directly. Seeing that Symantec has a lot of power over the OS, owning the AV would be quite the rootkit.

Answer 4

Virus and antivirus software play an elaborate hide-and-seek game; they have done so for the last 20 years at least. An antivirus tries to "look at" all the places where a virus may hide; new virus try to find new hiding places, that antivirus do not know of yet. Reverse engineering is done both ways, and having access to source code sure makes reverse engineering easier.

Still, access to source code should not be fatal in that direction. Obscurity is the only weapon in the virus arsenal; once reverse-engineered, it becomes obvious how the virus replicates itself, how to detect it, and how to remove it. Having the source code of a virus would kill it. On the other hand, having the complete source code of an antivirus does not tell you how to defeat it; it only tells you what kind of virus will not escape it. A virus developer would still have to find a new path through which the virus may go and proliferate, that the antivirus developer did not think of. The virus developer could gather the same information through testing. Having access to the antivirus source code thus makes virus development quantitatively less tiresome, but not qualitatively easier.

Depressingly, most antivirus software primarily detect virus through so-called signatures (chunks of code which appear in some known virus but probably not in "normal software") and most virus try to escape antivirus by simply having a new, distinct signature. This is depressing because it means that both virus and antivirus developers are still, basically, in the Stone Age. The antivirus developers win by adding new signatures as fast as possible. The virus developers win by being so numerous that antivirus developers are overwhelmed. There is no elegance here, just raw numbers. However, it means that an antivirus is mostly a big grep engine; theory of implementation of such systems has been known and masterfully described for decades (since 1973 for volume 3, specifically). So, there is very little to learn, for a virus developer, from the source code of an antivirus.

To sum up, I would say that the damage resulting from antivirus source code leakage is mostly a Public Relations issue: as a "security company", they should know better than letting their corporate assets leak that way. But it does not have much impact on the actual security offered by the product itself.