Re: Possible Mail server compromise ?

[Jon Oberheide <jon () oberheide org>]

Bob,

On Tue, 2008-02-19 at 12:35 -0500, Bob Toxen wrote:
> On Mon, Feb 18, 2008 at 08:19:41PM +0100, Faas M. Mathiasen wrote:
> > Dear All,
> > Since I got a storm of e-mail to my last post, I'd like to summarise
> > some of them
> > and have something more structured:
>
> > Jon Oberheide send me some impressive statistics with regards of
> > vulnerabilities within AV Software, interesting enough most of them
> > are remotely exploitable :O
> Most?  I would expect most to offer patches quickly.

In the context of Faas' mail server, most are remotely exploitable as
they can be triggered by the attachments of remote unsolicited emails.

> > "Protects your company from malware threats (Worms, Virus, Trojans..),
> > aps-AV reuses your existing Anti-Virus software and supports multiple
> > Anti-Virus engines. aps-AV increases the malware detection rate
> > through the diversity and heuristics of these multiple engines.
> > However unlike the competition,  aps-AV does not increase the remotely
> > exploitable attack surface."
> That sounds like "snake oil".  The more code (i.e., adding their
> product) the greater the "remotely exploitable attack surface".

False, it's simple privilege separation.  By separating the acquisition
of candidate files from the actual analysis of them, you significantly
reduce the attack surface as you've introduced an isolation barrier
between the host requesting analysis of a file and the host that is
actually performing the analysis.

I'm not sure how n.runs implements their system, but our system uses Xen
VMs for the detection engines.  When it is determined that a piece of
malware has exploited the AV software (through non-whitelisted process
spawning, any network activity, or other unexpected system behavior),
the VM is simply trashed and restored from a clean snapshot.  This
isolation and disposal mechanism effectively eliminates the risk of
using vulnerability-ridden antivirus engines.

> > Is anybody using that system ?
> I hope not.

Hmm?

Regards,
Jon Oberheide

-- 
Jon Oberheide <jon () oberheide org>
GnuPG Key: 1024D/F47C17FE
Fingerprint: B716 DA66 8173 6EDD 28F6  F184 5842 1C89 F47C 17FE

Attachment: signature.asc
Description: This is a digitally signed message part