2

I was wondering how those client softwares protect themselves from worms / malwares etc. Symantec protects their files from malicious users / admins with the tamper protection mechanism, but sometimes for troubleshooting it needs to be disabled.

This is how to stop the service: https://support.symantec.com/en_US/article.TECH192023.html

But, if a user can do it, can't a malicious worm do it as well? Which causes the whole protection to be useless?

Improve this question
5
  • Does this option exist in CLI version also?
    – balex
    May 29, 2016 at 10:15
  • @pbwned i think it does, but again, everything that an administrator can do easily - a malware can copy and the whole protection will be useless. i know that it can be password protected, but again - what if the product hangs? and password prompt doesn't show up? i'm more talking about how they solve "doomsday" problems
    – ArielB
    May 29, 2016 at 10:17
  • It is obvious that what admin can do, malware can do also. But I really don't think and I also didn't find any answers that related to the possibility of turning off the Tamper protection. I am sure, that people from Symantec know what this potential risk could do. So if its only possible from GUI, I personally don't think any malware developer would be so stupid to do a visible operation (disabling the tampering service). That would pay attention by the user and the game would finish.
    – balex
    May 29, 2016 at 10:24
  • @pbwned well, usually it can also be done through command line i think, but even if not, there's no problem simulating the GUI during night. but! what if GUI doesn't work? then you're not even able to disable the tamper protection. what if restart doesn't work? even worst, what if the driver is bootable, and safemode will automatically load the driver? is it acceptable not to handle those issues?
    – ArielB
    May 29, 2016 at 11:25
  • so what's the recommendation? to let or not let a way to "bypass" the self-protection? because if you do let an easy way - all machines will be compromised easily.
    – ArielB
    May 29, 2016 at 15:37

2 Answers 2

Reset to default
2

You are correct. Not just this feature, but antivirus in general, can be bypassed. That doesn't mean it's useless - it can be quite useful because it stops a lot of known threats and threat actors have to do a lot of work to bypass it.

So deploy antivirus by all means. But also know its limitations. Don't rely on antivirus alone to keep you secure.

Improve this answer
2
  • Well, i know that alot of not only antiviruses, but endpoint protection services protect themselves - but every "published" workaround to disable it just makes it useless, no?
    – ArielB
    May 29, 2016 at 13:28
  • Other than that it makes the bad guys do a little more work, yes
    – Mark Koek
    May 31, 2016 at 7:39
4

In order for malware to disable anti-malware protection, it typically needs to escalate its privileges to admin levels. And that's what the anti-malware tools prevent.

So sure, an admin level malware could do that, but in most cases that would be pointless, as it already has admin access and can do anything it wants.

In summary - no, anti-malware and antivirus are valuable in stopping many types of attacks.

Improve this answer
4
  • partially.. there are alot of services / situations where admin is needed (for example, during upgrade), or even users that are admins on their machines. if you don't protect against administrator, the attacker can use those windows to do whatever he wants to your anti-malware. no? even further, if those apps are anti-malwares that should detect and prevent those accesses - they need also a way to disable themselves - which aggregates my question instead of anti-virus to those anti-malware tools
    – ArielB
    May 29, 2016 at 14:05
  • 3
    @ArielB When the malware already has administration privileges, its too late anyway because it can remove any anti-tampering measures directly from the program code without going the detour over the admin panel of the anti malware program directly. Regarding working as admin: newer end-user operating systems make it difficult to do that unless the user knows what they are doing.
    – Philipp
    May 29, 2016 at 14:24
  • uhm, i'm not sure - let's say you disable any stoppage of the anti-malware - then even malware with admin privileges won't be able to stop the service (the designated driver of the anti-malware will just reject any stop request, or any remove thread opening). am i mistaken?
    – ArielB
    May 29, 2016 at 14:28
  • another addition, anti-malwares that respect themselves disallow administrators from stopping them. for example, by supplying a password (which is also a bit problematic btw) - but again, those "normal" flows can fail
    – ArielB
    May 29, 2016 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .