Released on: January 15, 2008, 4:47 am

Press Release Author: Mediablaster

Industry: Computers

Press Release Summary: For the past two years, the security engineers from n.runs AG
have taken a close look at AV software and found hundrets of Bugs that might
compromise your company. \"One E-mail is enough and boom\"

Press Release Body: Is the software we\'re using to protect ourselves from online
attacks becoming a liability?

That\'s what Thierry Zoller believes. For the past two years, the security engineer
for n.runs AG (FR:NNX) has taken a close look at the way antivirus software inspects
e-mail traffic, and he thinks companies that try to improve security by checking
data with more than one antivirus engine may actually be making things worse.

Why? Because bugs in the \"parser\" software used to examine different file formats
can easily be exploited by attackers, so increasing your use of antivirus software
increases the chances that you could be successfully attacked.

Antivirus software must open and inspect data in hundreds, if not thousands, of file
formats. One bug in the software that does this can lead to a serious security
breach.

Zoller and his colleague Sergio Alvarez have been looking into this issue for the
past two years and they\'ve found more than 80 parser bugs in antivirus software,
most of which have not yet been patched.

The flaws they\'ve found affect every major antivirus vendor, and many of them could
allow attackers to run unauthorized code on a victim\'s system, Zoller said.

\"People think that putting one AV engine after another is somehow defense in depth.
They think that if one engine doesn\'t catch the worm, the other will catch it,\" he
said. \"You haven\'t decreased your attack surface; you\'ve increased it, because every
AV engine has bugs\"

Although attackers have exploited parsing bugs in browsers for years now, with some
success, Zoller believes that because antivirus software runs everywhere, and often
with greater administrative rights than the browser, these flaws could lead to even
greater problems in the future.

The bottom line, he says, is that Antivirus software is broken. \"One e-mail and
boom, you\'re gone,\" he said.

Research into parsing bugs has been spurred by a heightened focus in recent years on
\"fuzzing\" software, which is used by researchers to flood software with a barrage of
invalid data in order to see if the product can be made to crash. This is often the
first step toward discovering a way of running unauthorized software on a victim\'s
machine.

A parsing bug in the way the Safari browser processed .tiff graphic files was used
recently to circumvent Apple\'s strict controls over what software may be installed
on the iPhone.

Between 2002 and 2005, nearly half of the vulnerabilities that were discovered in
antivirus software were remotely exploitable, meaning that attackers could launch
their attacks from anywhere on the Internet. Nowadays, that percentage is close to
80 percent, he said.

Zoller\'s company sees a business opportunity here. n.runs AG, based in Oberursel,
Germany, has invented solution to this problem, code-named \"ParsingSafe\", that will
help protect antivirus infrastructure and your company from the kind of parsing
attacks that n.runs AG has documented.

The company has given a security presentation about the findings at last years
Hack.lu conference. The slides may be found here :
http://www.nruns.com/ps/The_Death_of_AV_Defense_in_Depth-Revisiting_Anti-Virus_Software.pdf


Web Site: http://www.nruns.com

Contact Details: n.runs AG
Nassauer Straße 60
61440 Oberursel

Telephone: +49 (0) 6171/699-0
Fax: +49 (0) 6171/699-199
e-mail: contact@nruns.com