English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Anti-malware agents typically communicate with their remote services to shareinformation about suspicious files. These remote services use their up-to-dateinformation and global context (view) to help classify the files and instructtheir agents to take a predetermined action (e.g., delete or quarantine). Inthis study, we provide a security analysis of a specific form of communicationbetween anti-malware agents and their services, which takes place entirely overthe insecure DNS protocol. These services, which we denote DNS anti-malwarelist (DNSAML) services, affect the classification of files scanned byanti-malware agents, therefore potentially putting their consumers at risk dueto known integrity and confidentiality flaws of the DNS protocol. By analyzinga large-scale DNS traffic dataset made available to the authors by a well-knownCDN provider, we identify anti-malware solutions that seem to make use ofDNSAML services. We found that these solutions, deployed on almost threemillion machines worldwide, exchange hundreds of millions of DNS requestsdaily. These requests are carrying sensitive file scan information, oftentimes- as we demonstrate - without any additional safeguards to compensate for theinsecurities of the DNS protocol. As a result, these anti-malware solutionsthat use DNSAML are made vulnerable to DNS attacks. For instance, an attackercapable of tampering with DNS queries, gains the ability to alter theclassification of scanned files, without presence on the scanning machine. Weshowcase three attacks applicable to at least three anti-malware solutions thatcould result in the disclosure of sensitive information and improper behaviorof the anti-malware agent, such as ignoring detected threats. Finally, wepropose and review a set of countermeasures for anti-malware solution providersto prevent the attacks stemming from the use of DNSAML services.

On The Vulnerability of Anti-Malware Solutions to DNS Attacks