The Adventures of AV and the Leaky Sandbox
Cloud-based AV sandboxes can facilitate data exfiltration from high-security enterprise networks.
Summary
High-Security Enterprise Challenge
Enterprises use cloud-enhanced antivirus for protection. Strict egress filtering prevents direct exfiltration, with endpoints having no direct Internet connection or only restricted connectivity.
Counterintuitive Risk
If malware already runs with full privileges on an endpoint, one might assume AV cannot degrade security. This assumption is completely wrong. Cloud-enhanced AV actually creates new exfiltration opportunities.
Sandbox Vulnerability
When cloud-enhanced AV employs an Internet-connected sandbox, it facilitates data exfiltration. Malware can leverage this sandbox to send data outside the enterprise, bypassing egress filtering controls.
Proof of Concept
The researchers demonstrate the technique with results from several prominent AV products. A tool implementing the exfiltration technique is released. Insights on AV in-the-cloud sandboxes and methods to enhance attacks are provided, along with possible mitigations for defenders.
Related talks
Main Track 1·22 min
Dimitry Snezhkov
Establishing covert command and control through HTTP webhooks on approved business websites.
Black Hat·33 min
Gareth Heyes
Security researchers examine technical aspects of Portable Data exFiltration: XSS for PDFs.
Black Hat·26 min
Analysts investigate attack surfaces and defenses concerning How the Security Features in TLS Inspection Solutions can be Exploited for Covert Data Exfiltration.