One security researcher believes the software we use to protect our PCs from viruses, spyware and other malware is becoming a major liability.
For the past two years, Thierry Zoller , a security engineer at N.runs AG, has taken a close look at the way antivirus software inspects email traffic, and he thinks companies that try to improve security by checking data with more than one antivirus engine may actually be making things worse. Why? Because bugs in the 'parser' software used to examine different file formats can easily be exploited by attackers, so increasing your use of antivirus software increases the chances that you could be successfully attacked.
Antivirus software must open and inspect data in hundreds, if not thousands, of file formats. One bug in the software that does this can lead to a serious security breach.
Zoller and his colleague Sergio Alvarez have been looking into this issue for the past two years and they've found more than 80 parser bugs in antivirus software, most of which have not yet been patched.
The flaws they've found affect every major antivirus vendor, and many of them could allow attackers to run unauthorised code on a victim's system, Zoller said.
"People think that putting one AV engine after another is somehow defence in depth. They think that if one engine doesn't catch the worm, the other will catch it," he said. "You haven't decreased your attack surface; you've increased it, because every AV engine has bugs"
Although attackers have exploited parsing bugs in browsers for years, with some success, Zoller believes that because antivirus software runs everywhere, and often with greater administrative rights than the browser, these flaws could lead to even greater problems in the future.
The bottom line, he says, is that antivirus software is broken. "One email and boom, you're gone," he said.
Research into parsing bugs has been spurred by a heightened focus in recent years on 'fuzzing' software, which is used by researchers to flood software with a barrage of invalid data in order to see if the product can be made to crash. This is often the first step toward discovering a way of running unauthorised software on a victim's machine.
A parsing bug in the way the Safari browser processed Tiff graphic files was used recently to circumvent Apple's strict controls over what software may be installed on the iPhone.
Zoller says he has been criticised by his peers in the security industry for "questioning the very glue that holds IT security all together", but he believes that by bringing this issue to the forefront, the industry will be forced to address a very real security problem.