20

Today at work I was asked to test our anti-virus software on our Linux servers. I attempted to create a text file containing the EICAR Virus Test signature. The file was deleted instantly, indicating the real-time virus scan was working. However, this got me thinking... since this is a relatively short string of ASCII printable characters, this could be easily inserted into many forms of user-input. So depending on how the Anti-Virus software handles this, you may be able to use this to force a deletion of a file if you are able to append this to it. For example, let's say a Web server logs all the requests you send it, and you insert this EICAR virus signature into a request and it gets logged into a file, and the file then gets deleted. I tried searching google for malicious use of the EICAR virus test but wasn't able to find any examples of misuse of this in the wild. Anyone know if this has been done before? It's an interesting idea that an Anti-Virus software ironically could be a threat to what would otherwise be non-threatining. Thoughts?

[EDIT]

In conclusion, if implemented correctly in the AV software, the EICAR Test appended to a log file would not be detected (which is good). However, I found out that this is not always implemented correctly. Therefore, some anti-virus software may wrongfully take action if this were to be appended to a log file. See my analysis done below:

Anti-Virus software that accurately detects the EICAR Test signature by itself in a file: https://www.virustotal.com/en/file/56606ad869484ccbb4d012f46c9c73ea9b20f9863351741aab96763345209564/analysis/1409779284/

Anti-Virus software that detects the EICAR test signature even if it's been appended to a file (this violates the EICAR Test rule, and thus was not implemented in the AV software according to Protocol): https://www.virustotal.com/en/file/f5b88459f4b2c6425bdfc5c8f4f17027e0bfcc65a4c39dbb48f96c81ce17369c/analysis/1409779665/

[/EDIT]

  • 1
    It seems like EICAR and the "beginning of file" requirement is beside the point: if your AV software deletes all "infected" files on sight, then a malicious user could simply insert a real virus signature into a log file. The delete-on-sight policy seems fraught with all sorts of unintended potential consequences, and I think it may be the real issue here. Am I missing something? – Nate Eldredge Sep 4 '14 at 3:39
  • The fact that the EICAR test signature is all just printable ASCII characters makes it easier to inject into things. – ansichart Sep 6 '14 at 2:46
11

No, it won't work this way.

Reading the documentation from EICAR we can see why:

The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters.

So, the file must start with the said string, and must not be larger than 128 bytes. All of your logs will probably start with a timestamp, and have more than 128 bytes on it.

  • 3
    Interesting. Trend Micro's ServerProtect still deletes the text file even if the string does not start with it. I prefixed the string with "blah " and dumped it into a file and it was deleted instantly. They must not have implemented this EICAR Virus Test according to protocol. – ansichart Sep 3 '14 at 19:58
  • I will mark this as the correct answer. In conclusion this will not work to delete log files, assuming it was implemented correctly. Turns out not all Anti-Virus software implements this test correctly. – ansichart Sep 3 '14 at 20:07
  • 2
    You can try this yourself. Make a copy of one of your logs, and add the string to it. If the file gets deleted, call your AV vendor immediately. It would be very easy to someone use the antivirus to clean up logs, logging in as the signature string on ssh, or accessing the signature string on Apache, or anything that he needs to cover up. – ThoriumBR Sep 3 '14 at 20:10
  • There are lots of people (and vendors) which just search for the string anywhere. I've once had a hard time to explain an auditor that its perfectly ok for the EICAR string to occur inside the subject of a mail. – Steffen Ullrich Sep 3 '14 at 20:26
  • ~/tmp/test $ echo 'Padded to 102 characters........ X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' | wc -c 102 ~/tmp/test $ echo 'Padded to 102 characters........ X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > x ~/tmp/test $ ls -l x ls: x: No such file or directory ~/tmp/test $ echo 'Padded to 103 characters......... X5O!P%@AP[4/PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > x ~/tmp/test $ ls -l x -rw-r--r-- 1 ben staff 103 Sep 3 15:36 x – ansichart Sep 3 '14 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.