Anti-Virus is new weapon for cyber attacks: Researcher
By Prempal Singh
Attacks based on the ability of antivirus signatures to detect malware programs.
A team of researchers from two universities in Germany has developed a method to turn the scanning engine antivirus program into a tool for cyber attacks.
Attacks based on the antivirus ability to detect malware based on signatures. This antivirus solutions work method involves the examination of a file or a package according to the dictionary of known malicious programs drawn up by the anti-virus authors. If any portion of the code corresponds to the program you are watching the famous signature in the dictionary, antivirus or delete the file, or send to quarantine.
According to the researchers, an attacker can withdraw signature from sanitizing engine or understand how they work and use anti-virus to destroy stored on the target file system. If you introduce a copy of malware signatures in the legitimate file, the antivirus program will accept it for malware and remove (at best put in quarantine). Thus, an attacker could sabotage the work of the whole enterprise.
Researchers were able to get malware signatures of five scanning engines. One of them – the engine open source ClamAV, and the remaining four developed unnamed businesses. Experts used the signatures for the three types of attacks: a cover of guessing the password by removing the application logs, deleting emails of users and simplify the attacks by removing the browser cookie files.