22

Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, indicating the real-time virus scan was working. However, this got me thinking... since this is a relatively short string of ASCII printable characters, this could be easily inserted into many forms of user-input. So depending on how the Anti-Virus software handles this, you may be able to use this to force a deletion of a file if you are able to append this to it. For example, let's say a Web server logs all the requests you send it, and you insert this EICAR virus signature into a request and it gets logged into a file, and the file then gets deleted. I tried searching google for malicious use of the EICAR virus test but wasn't able to find any examples of misuse of this in the wild. Anyone know if this has been done before? It's an interesting idea that an Anti-Virus software ironically could be a threat to what would otherwise be non-threatining. Thoughts?

[EDIT]

In conclusion, if implemented correctly in the AV software, the EICAR Test appended to a log file would not be detected (which is good). However, I found out that this is not always implemented correctly. Therefore, some anti-virus software may wrongfully take action if this were to be appended to a log file. See my analysis done below:

Anti-Virus software that accurately detects the EICAR Test signature by itself in a file: https://www.virustotal.com/en/file/56606ad869484ccbb4d012f46c9c73ea9b20f9863351741aab96763345209564/analysis/1409779284/

Anti-Virus software that detects the EICAR test signature even if it's been appended to a file (this violates the EICAR Test rule, and thus was not implemented in the AV software according to Protocol): https://www.virustotal.com/en/file/f5b88459f4b2c6425bdfc5c8f4f17027e0bfcc65a4c39dbb48f96c81ce17369c/analysis/1409779665/

[/EDIT]

Improve this question
2
  • 1
    It seems like EICAR and the "beginning of file" requirement is beside the point: if your AV software deletes all "infected" files on sight, then a malicious user could simply insert a real virus signature into a log file. The delete-on-sight policy seems fraught with all sorts of unintended potential consequences, and I think it may be the real issue here. Am I missing something?
    – Nate Eldredge
    Sep 4, 2014 at 3:39
  • The fact that the EICAR test signature is all just printable ASCII characters makes it easier to inject into things.
    – ansichart
    Sep 6, 2014 at 2:46

2 Answers 2

Reset to default
14

No, it won't work this way.

Reading the documentation from EICAR we can see why:

The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters.

So, the file must start with the said string, and must not be larger than 128 bytes. All of your logs will probably start with a timestamp, and have more than 128 bytes on it.

Improve this answer
5
  • 6
    Interesting. Trend Micro's ServerProtect still deletes the text file even if the string does not start with it. I prefixed the string with "blah " and dumped it into a file and it was deleted instantly. They must not have implemented this EICAR Virus Test according to protocol.
    – ansichart
    Sep 3, 2014 at 19:58
  • I will mark this as the correct answer. In conclusion this will not work to delete log files, assuming it was implemented correctly. Turns out not all Anti-Virus software implements this test correctly.
    – ansichart
    Sep 3, 2014 at 20:07
  • 5
    You can try this yourself. Make a copy of one of your logs, and add the string to it. If the file gets deleted, call your AV vendor immediately. It would be very easy to someone use the antivirus to clean up logs, logging in as the signature string on ssh, or accessing the signature string on Apache, or anything that he needs to cover up.
    – ThoriumBR
    Sep 3, 2014 at 20:10
  • There are lots of people (and vendors) which just search for the string anywhere. I've once had a hard time to explain an auditor that its perfectly ok for the EICAR string to occur inside the subject of a mail.
    – Steffen Ullrich
    Sep 3, 2014 at 20:26
  • ~/tmp/test $ echo 'Padded to 102 characters........ X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' | wc -c 102 ~/tmp/test $ echo 'Padded to 102 characters........ X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > x ~/tmp/test $ ls -l x ls: x: No such file or directory ~/tmp/test $ echo 'Padded to 103 characters......... X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > x ~/tmp/test $ ls -l x -rw-r--r-- 1 ben staff 103 Sep 3 15:36 x
    – ansichart
    Sep 3, 2014 at 20:39
3

Although the EICAR test string won't cause logs to be deleted when it is appended to them, there are other strings which will. You can piss a lot of people off on IRC by going on large channels and posting strings that come from genuinely malicious code and see how many people disconnect instantly when their AV kills the IRC client, just to rejoin a short time later and complain that their log file was eaten. This generally only works with malicious HTML or JS, though, as it's most likely to contain printable ASCII that would be recognized as a viral signature.

There are more malicious uses of this trick than irritating people in online chats. Badly configured servers that scan log files can end up destroying evidence if said evidence contains "viral" strings.

Improve this answer
2
  • Any examples? ;)
    – nobody
    Jan 3, 2021 at 6:49
  • @nobody Can't remember off the top of my head. Look for some updates to virus signature databases.
    – forest
    Jan 3, 2021 at 6:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .