6

It was recently reported that the hacking group Fxmsp "...claimed to have secured access to three leading antivirus companies," and that they "...extracted sensitive source code from antivirus software, AI, and security plugins belonging to the three companies." Further, the group is:

...[O]ffering to sell it, and network access, for over $300,000 USD.

[emphasis mine]

Reporting on this revelation, a Forbes.com article warned that:

Access to the source code allows hackers the opportunity to locate showstopping vulnerabilities and exploit them, rendering the software useless... or worse. They could even turn what was once legitimate protection from malware into an incredibly effective spying tool.

The report doesn't mention who the compromised security vendors are nor could I find any indication this information has been publicly released.

Which leads to my question. What if my organization is running the compromised security software? What can we do to protect our environment? Are there best-practices that even envision a scenario like this?

Improve this question
4
  • 2
    Your questions somehow links access to source code (that's what article claims) with product being "compromised. This is huge difference - Android and Linux source code is public, which doesn't mean both are compromised.
    – George Y.
    May 11, 2019 at 18:18
  • @GeorgeY. Not to mention, leaked AV source code has been circulating for ages.
    – forest
    May 12, 2019 at 2:08
  • @George I've updated my question to emphasise that fxmsp's claim of having "secured access" to the AV firms includes remote network access. I found that aspect of their claim more worrisome than simply having copies of source code.
    – I say Reinstate Monica
    May 13, 2019 at 10:50
  • 1
    @TwistyImpersonator compromised "network access" still doesn't mean the company-produced software is compromised. Its still a large gap to cross.
    – George Y.
    May 13, 2019 at 23:53

2 Answers 2

Reset to default
1

I would say security "in-depth always". What you have read is what is public in a way. Wearing my tin-foil hat, it's a good idea to assume advanced and state sponsored groups have attacks on other security software too (you might have read how an Israeli group hacked Kaspersky and saw how a Russian group also hacked them and stole data a few years ago). The Israeli hackers had in a way better network monitoring than Kaspersky itself. So the aim is to make it as difficult as possible for the bad guys and the so-called good guys too.

Good practices?

  • Isolate / segment networks.
  • Disable USB/thunderbolt ports.
  • Airgap critical networks/PCs.
  • Keep software updated (this is unfortunately a two-edged sword, but one side is sharper than the other)
  • Use 2FA
  • Train people to avoid phishing / malware campaings
  • Check your internal networks for certs expiration :D
  • Use a network monitoring tool to spot strange traffic.
  • Do not allow things like RDP be public on the internet (quite a few hacks in the last years happened because of this).

and many, many more.

Improve this answer
3
  • With the exception of air-gapping, how do these best practices protect computers that are already running potentially compromised code, as is the premise of my question?
    – I say Reinstate Monica
    May 13, 2019 at 10:43
  • All running software in all computers is always potentially compromised. That's why security in depth tries to put several barriers to prevent the bad guys from accessing the potentially vulnerable software. Usually nowadays a number of factors have to align for a device to be compromised in a secure environment (e.g. different flaws in different components). But if a device is accessible and running compromised software, then it's game over for that and (potentially) everything else that is accessible from that device... Having said this, I'm not sure what you are asking :D
    – Augusto
    May 13, 2019 at 11:18
  • Most of these exact practices won't save you from a compromised AV package, but they are good examples of in-depth security in general.
    – Nosajimiki
    May 13, 2019 at 15:16
1

Compromised AV software is a pretty big deal, it often has all sorts of privileges to your system including control over your software firewall.

If you are lucky, they will just use the access to install ransomware or something else that is obviously malicious. In this case, your best defense is good backups. When your machine show signs of infection, you restore your system to just before the malicious update that gave them access to your machine, then remove the AV software and replace it with a different product.

Things that are just designed to hijack your machine like spyware, botnetware, etc. can be more dangerous because the intrusion is designed to thwart your computer's whole defense system that would normally protect against such things while being able to hide for far to long for a backup restoration to remain a viable option. The best thing you can do here is have a good firewall/AIS built into your router. Your router may not be able to fix the infection, but sometimes it can prevent such infections from being able to communicate with the command-and-control server rendering the infection essentially inert.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .