In focus: extensions

03.03.2009. | Updated: 13.06.2009.

Certain antivirus protection systems are said to restrict the range of files to be checked, and can, therefore, operate faster. One such simple method is by checking only files with certain extensions. But does this result in a security risk?

The fact which files a security system checks and which ones it does not is in reality a secondary problem. As long as the protection can provide maximum security, it does not matter how its operation is influenced by the management of extensions. The reason for the present testing was that, in our experience, certain antivirus softwares check only files with certain extensions during their operation. Therefore, they can operate much more quickly, which is then exploited in the marketing of virus security systems. Several antivirus protection systems use slogans referring to their speed. The question is to what extent it results in compromising security and to what extent this reduces the range of malware that it is capable of detecting.

Speed test

In the course of testing, the on-access protection of antivirus softwares was measured. Windows XP Home + SP3 operating system was used. The speed of the system was measured with virus-free files. Three groups of files with a total size of approx. 20 Gbyte was used, with the number of files approaching one hundred thousand. The first group contained unzipped, executable files; the second zipped, executable files; while the third group contained non-executable files (documents, html files, multimedia files, etc.). "On-access" antivirus protection was inspected by reading the files (every byte from the beginning to the end) with a small shell while the protection was installed/switched on. Taking the fact that the operating system itself also carries out background activities into consideration, the test was performed 30 times. The table displaying the results of on-access tests contains the minimum, maximum and average values, too.

Important note: The file packages used during testing were aimed at sampling the sets of files found on average, Windows-based computers. It is possible, however, that in some cases different speed rates might occur. The test results, however, display the speed of each virus search engine. The table containing the results displays all speed vales in minute:second format. Furthermore, it is important to note that in order to calculate the slow-down effect of antivirus protection, the value without antivirus protection has to be deducted from the time given for each antivirus protection system.

Checking of extensions

The continuous on-access protection of antivirus protection systems was checked by examining what extensions they check. Copies of a well-known malicious code were prepared in which the up to 3 character long extensions of the files were set to all possible values (nearly 57.198 copies), and 1000 pcs. 4 character extension copies were also made with random extensions. The checking was done by updating the newly installed operating system, then the appropriate protection system was also installed and updated. Then we tried to read the infected samples with a batch program (by copying on the so-called nul device). At the end of the procedure, the messages and log files of the protection systems and the changes in the infected samples were analysed. The table below shows how many extensions the protection system examined and how many it did not. It is interesting to see that the protection system of Sunbelt VIPRE only recognised malicious codes in files with 49 (!) extensions and it was successful in none of the extensions with 4 characters. There were some files in the case of the other protection systems, too in which these did not make a search. These meant extensions which contained special characters (e.g. #, $).

Risks of extensions

In the case of on-access protections, the “knowledge” or “lack of knowledge” of extensions does not in itself result in a problem. If the protection system is able to identify each malicious code, it does not matter files of what extensions it checks. However, examining the unrecognised extensions in the case of Sunbelt VIPRE, there were extensions used by certain malicious codes. When examining the risks of extensions, MP3, SWF and WMA extensions were tested, not by copying but with actual malicious codes that really spread in these extensions.

This examination of this test was originally not planed. It was indicated by the recognition of the previously mentioned problem related to the Sunbelt VIPRE program. The purpose of this examination was not the comparison of the detection capability related to these types of malware. The purpose was only to answer the following question: Does the mentioned problem related to extensions cause real security problem?

For the sake of adequate information, more detailed examinations were carried out related to different exploits (including malware spreading in MP3, SWF and WMA files). More