IE9 beta: malware bypassing webshield and sandbox

[system]

I’ll refer to this other thread where I didn’t get any feedback from Avast…yet. And I think the issue is important enough to justify an own thread.

@Logos post:5

I get two alerts on that site, one from the web shield, and another one from the file system shield. Wondering how come that the web shield didn’t block everything ??? (apparently there’s an archive involved that complicated the task somehow…)

@Logos post:7

okay the first test with two alerts was in IE9, I just retried with Firefox 4 and there’s only the web shield alert (with JS allowed to run on the site)… so there’s an issue between IE9 and the web shield it seems….

@Logos post:10

okay, same in Chrome like in Firefox, just a web shield alert, meaning that there’s a flaw somewhere allowing malware to partially bypass the web shield in IE9.

@Logos post:14

lol forgot to mention something important >>> my first test in IE9 generating a file shield alert was done with IE9 sandboxed >>> see my screen shot above with malware detected in the IE temp folder ;D

C:\Users\*****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D0BU9CEB\top_1286364087[1].js [L] JS:Downloader-AFY [Trj] (0)

[Lisandro]

Am I understanding correctly that when you run IE9 sandboxed the Web Shield does not detect the .js file but only the File Shield?

[system]

@Tech post:2

Am I understanding correctly that when you run IE9 sandboxed the Web Shield does not detect the .js file but only the File Shield?

no it’s not that: in IE9, sandboxed or not, both shields interfere, as opposed to other browsers where only the web shield does, meaning that in IE9 the webshield is triggered but that’s not enough, there’s still malware going through and intercepted by the file shield.

Now to the sandbox issue: when launching the same link in IE9, sandboxed this time, the alerts are the same >>> noticing that the trojan file, as reported by the alert, was located in C:\user…temp internet files, although IE9 is sandboxed ??? thing is that I’m not sure at all in fact if the trojan was in the sandbox when intercepted at disk level by the file shield or not. Avast reported it was where it should have been if IE wasn’t sandboxed. Could also be a “junction point like effect”…

[Lisandro]

Thanks. Looking forward an explanation for Lukas.

[pk]

When you executed IE9 sandboxed, the .js file already existed at the location “C:\Users.…” so that’s why file system shield found that file. I’m sure IE9 virtualized .js file into the sandbox (in fact, I retested it to be sure).

Webshield operates in two scanning modes. Some packed files aren’t scanned during downloading, but they’re scanned when downloading is almost finished. You may download some Gbs of data and it must be stored somewhere - that’s why IE saves it to the temp folder. If the file is infected, internet connection is aborted immediately.

[system]

@pk post:5

When you executed IE9 sandboxed, the .js file already existed at the location “C:\Users.…” so that’s why file system shield found that file. I’m sure IE9 virtualized .js file into the sandbox (in fact, I retested it to be sure).

just about this part: the sanboxed try on this infected site was the first try. Subsequent tries were then done with IE, FF and Chrome un-sandboxed.