Endpoint Protection

 View Only
  • 1.  Endpoint removal without any password

    Posted Apr 24, 2009 05:12 AM

    I saw this post recently.

    http://hehe2.net/thedarkside/microsoft/hacking-symantec-easy-peasy/

    I tried terminating misiexec.exe process when the uninstaller asked for the password on my system running Symantec endpoint 11.x latest and I was able to remove the protection easily.

    This is a serious flaw.Does anyone know of any way to patch this.



  • 2.  RE: Endpoint removal without any password

    Posted Apr 24, 2009 05:29 AM

    I don't have a SEP machine to try that on right now but probably the bug has been inherited from Sygate where it did exist.

    Couple a things everyone should know

    1) If you are an administrator, Then are more ways and much more easier than this to get across the uinstall routine. When you can edit the registry there is nothing that you cannot do.

    2) If you are a limited user, Then whatever you do, You would not be allowed to unistall the program.

    I really don't see anything amazing in this, Good for school kids. There is no exploit in it.
     



  • 3.  RE: Endpoint removal without any password

    Posted Apr 24, 2009 02:52 PM
    Can you let us know in which version of SEP this is happening? 


  • 4.  RE: Endpoint removal without any password
    Best Answer

    Posted Apr 24, 2009 03:37 PM
    I checked with our folks and this is a known issue. This has been fixed in upcoming verions.  Pls. let us know if you have any further concerns.


  • 5.  RE: Endpoint removal without any password

    Posted Apr 24, 2009 05:15 PM
    Although Yes, this does have the potential to be "some what" problematic, it really depends on how tight your security is in your Network.

    Any person that has elevated priviledges or a "not properly" locked down system can much more to "hurt" your network with malicious intentions.

    Also, someone would have to know specifically, what they were looking in terms of "process" for in order to do this.

    -> Of course you could remove access to the "Task Manager" and would be a "semi workaround" to not allow this to happen.  But than you have the command line, where a TASKKILL /pid:[ID] could be used to terminate the process...  This should most likely pop up an "Error 5: access denied" because the users should not have the rights to do this.

    Furthermore, as Sandeep indicated above, there are ways around it in the registry, which in my opinion, should be locked down from users and they should not have access to play there. 

    The same goes for the ADD/REMOVE programs (appwiz.cpl) applet.  No end-user should have access to this and should be locked down via GPO.

    So if, they don't have access to the Add/remove applet, and cannot edit the registry, there is no way to begin the uninstall process without being "savvy". 

    I mean, a motivated person could figure out the "product ID" and from a command line, start the MSIEXEC.exe [productID] /uninstall   and when prompted for a password, would run the taskkill command and from there "successfully remove the AV" from their system.  A log should be generated from this and you should have your reports configured to notify of such events.  Auditing of the workstation will tell you who was logged in at the time, and "tampering with a Workstation" that much and with that much motivation to remove the AV/NTP should be a clear indication of malicious intent and grounds for termination. 

    Honestly, yes it is a "bug" in the system, but should also be an indication to an administrator of the holes/flaws in their internal security