How to counteract a trojan horse when the horse is the anti-virus software?

Question

I have got caught behind the 'irresistible force meets immoveable rock' conundrum.

A predatory country has been making very long-term plans for building an empire.

This country, as part of a very long-term plan, created an apparently government-independent anti-virus company that has created the world's best anti-virus software. World's best, because a great deal of the virus and ransomware has been developed and released by sister organizations created by the government for this purpose, so of course their software knows how to eliminate these threats.

It is so good, it developed a word-wide reputation, and was adopted by many of the biggest firms for their firewalls. In fact, the developers of the BIOS and operating systems, and even the chip designers, worked with this company to implement 'hooks' directly into the very basic system boot software. Of course the software was rigorously scrutinized by the biggest security firms, and they all conclude it does exactly what it says it does - protects against threats - and nothing more. It contains no malicious code, in even the most thorough testing and software reverse engineering. Even though no one really trusted the government, the antivirus software company remained squeaky clean and apparently completely independent of government intervention, or so everyone assumed.

The problem is, it is so trusted and effective that it becomes generally accepted that it is necessary to be active from the very first steps of boot up, so as to not be vulnerable to any viral code. Since it is the first thing that is run, nothing can get in front of it. Hence, the tremendous thorough dissection of the code.

So, the malicious government decides to act. The Trojan is the action of the software itself. In the ongoing updates of viral signatures and 'threat identifications', the anti-virus software is directed to quarantine essential code in the operating system itself. The anti-virus software prevents the normal operating system from even booting. Since the system can not be booted, the operating system can not be updated. The system is blocked at boot, so not even a 'safe boot' can bypass the antivirus code. No matter what is tried, the antivirus software recognizes the operating system itself as the threat, and stops it. And since the hooks are in the hardware itself, there is no way around then except to completely replace the hardware. This, of course, takes considerable time and expense. The systems, hardware and software, have to be replaced completely. Unfortunately, the world economy does not have time to wait for hardware replacement, The solution has to be relatively immediate, in order to save the world financial system from chaos, not to mention the automated control systems of most of the manufacturing, power grid, and communications infrastructure.

Of course, the virus signatures were all loaded in an 'emergency update' after a 'vulnerability' was 'discovered' in a code library that almost every computer file system routine uses. Thus, essentially every computer in the world was updated in very short order. When the signature file was then downloaded in a regular security update, computers started to fail before anyone could get ahead of the problem.

So now my problem is, 'How can this anti-virus software be stopped?' The antivirus software itself prevents the systems from being updated.

Clarification Note: This is NOT our contemporary world. This is set in the future, when a single operating system has evolved, and all systems integrated, all based perhaps on a Unix-type system. Think of the 'trusted platform module' on steroids.

Automatic initialization of the TPM with Windows Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This means that in most cases, we recommend that you avoid configuring the TPM through the TPM management console, TPM.msc. There are a few exceptions, mostly related to resetting or performing a clean installation on a PC. For more information, see Clear all the keys from the TPM. We're no longer actively developing the TPM management console beginning with Windows Server 2019 and Windows 10, version 1809.

In certain specific enterprise scenarios limited to Windows 10, versions 1507 and 1511, Group Policy might be used to back up the TPM owner authorization value in Active Directory. Because the TPM state persists across operating system installations, this TPM information is stored in a location in Active Directory that is separate from computer objects.

The anti-virus software uses direct hooks to a similar TPM that happens right at boot. A failsafe system that was thought to be impregnable, and it turns out it is.

No references to Kaspersky or current anti-virus software will be considered. Current software, hardware, and operating systems are not relevant to the question.

For deep background and back story, consider Symantec, now owned by Broadcom, a company that has been sanctioned by the European Union for anti-competitive practices.

Broadcom provides a broad range of semiconductor and infrastructure software applications that serve the data center, networking, software, broadband, wireless, and storage and industrial markets. Common applications for its products include: data center networking, home connectivity, broadband access, telecommunications equipment, smartphones, base stations, data center servers and storage, factory automation, power generation and alternative energy systems, displays, and mainframe operations and management, and application software development.

Answer 1

Virtual machines

Most server software nowadays is virtualized in part because of [redacted] like this. If the system is so compromised, you are losing a virtual system, not an actual one.

Open source

As a project manager, I have a torturing hell of a time getting a dozen adults to agree on following procedures and standards when making software. I can't fathom them all together keeping even a small secret.

If people in your world are able to keep a secret like that, then it might also be true there that all Australians are actually actors trying to convince people the Earth is not flat.

Anyway, even in such a setup simply making the whole thing open source means at some point a 12-year-old will figure the Trojan and stealthily inject a Trojan into the Trojan that keeps computers safe. That 12-year-old doesn't even need to be a genius. Just a few days ago someone who is guaranteed to be mentally no older than 12 did manage to inject a fake READ.ME file into the Linux repository which impersonated Linus Torvalds for authorship, with a technique I've seen my nephews try on me before. The fake READ.ME file claimed that Linus was giving up on Linux and switching to Windows XP because that was a better OS. Imagine if the kid had put some actual Trojan there...

Answer 2

Go Offline

The program has to grab this new data from the web, disconnect the computer from the web and the issue is gone, on that computer.

The best part is that you don’t have to anything, because all the computers running the internet will also stop working. So there won’t be any way for the malicious info to spread.

So it might spread a bit, but would be stopped relatively quickly by the fact that it would quickly eliminate anything that could spread it.

Of course, this answer isn’t very satisfying and could also be countered by setting a timer on when the devices would die. It does however come with the challenge of trying to turn on the impacted things back on without causing more damage. Additionally depending on the timers length other challenges would arise for the antagonists. If it’s too short then they might shut down before they can send it, if it’s too long someone might find out and be able to stop it.

Answer 3

You don't fix this quick

The question is in itself quite ridiculous. It is like wanting a city to be rebuild in a month after a disaster leveled it, or an EMP fried every electricity wire and you want it fixed in a week. It is simply not done.

Essentially you brick each connected device in the world. Even if you somehow make software that unlocks the computers instantly the moment they get into contact with it, it won't work quick. There is no way to connect to the internet from the bricked conputer. Even if you unlocked your computwr it has no way to connect to the internet. Any server is bricked as well. There is nothing to communicate to. Even your router can be affected. You have to assume only data holders like USB sticks have small enough chips not to have the anti-virus on it.

To undo the effect you need to boot from such data holders. Even if the normal OS is held hostage, you can make an USB boot OS that isn't affected, possibly updating the normal OS so the files aren't affected. It will take a lot of time, but you can spread such solutions slowly. All datacenters, servers, personal and company computers need to get it. You need to copy it to many data solutions unaffected by the anti-virus and in a few months the whole of the world can be unlocked with perfect logistics.

But don't forget that basically everything is ran by computers nowadays. From mundane things like doors, traffic lights and street lights to even some fridges. To insanely vital things like virtually all transportation (cars, ships, trains, planes), powerplants, food processors, whole factories. Basically you've reduced the whole world that is used to modern comforts to a world they can barely operate. Within a day there will be looting, on day two major and many minor cities will run out if food for the majority.

In one swoop you have doomed humanity to be reduced to a fraction it was. You can't even start your computer as there is no power. The anti-virus isn't even in play any more.

Why lock up computers?

Seeing the above it wouldn't make sense for that government to do this. Even if they can fully maintain their own networks they are very likely dependent on the rest of the world.

In addition it doesn't make sense. They could gather priceless information. Even just using the anti-virus for information gathering means they can have far reaching control of economics, politics to even the culture. They have an insanely powerful tool placed on the lowest parts of the system, access to anything and they squander it for oblivion? It seems unlikely.

Answer 4

If taken at face value that every computer is using this anti-virus software in the way described: A physical attack on the company/country that controls this software and force them to undo this recent update. Whether that is a smallish "elite strike team" infiltrating the company's headquarter or an official message through diplomatic channels giving the country x hours to comply before the nukes come flying is up to you.

Other then this every computer (or at least every piece of storage medium) must be destroyed and replaced. Incidentally this means almost every piece of software must be rewritten from scratch. This would take a while, to put it mildly. The next question would be "could a global apocalypse be averted if suddenly every single computer stopped working?".

Answer 5

For such idea to work the anti-virus would need more access to the ROMs than simple hooks. Otherwise it could be worked around by booting from the USB an alternative system. When the alternative system is running, if the virus signatures were not written in the BIOS, the quick solution would be to replace the file/library with the signatures with an old version taken from a machine that was switched off for maintenance or other reasons. Next step would be re-booting the system offline and uninstall the anti-virus. What I said will work only for machines that did not disable the USB ports, many do it for security reasons, but they should be enough to bring the systems back online.

Another way to work around the problem would be to remove the drives from the infected machines, mount them as slave on uninfected machines (again the old ones switched off), boot and delete the signatures library. It is still a hardware solution that takes time, but less than what it takes to update the ROMs.

Things would be tougher to fix if the system were based on a kind of TPM that cannot be disabled by BIOS and allowed the anti-virus to play with the secure boot (or similar) keys. But a boot system that can be disabled so easily without possible workarounds via the BIOS console would require widespread complicity from the producers, the rogue anti-virus firm could not do all the damage alone.

Update: Answering the comment by @Justin Thyme the Second I'll try and clarify what I meant.

Tim Berners Lee said Nobody can spy or everybody can spy. He meant that if you put a backdoor in a software, even if you have a legitimate reason, you can be sure that sooner or later many malicious hackers would find ways to exploit that backdoor.

On the same line if hardware producers build in the hardware they sell remote switches that cannot be disabled, then the predatory country with their anti-virus company are just one of the many possible problems, any private big corporation with the backing of any more or less "democratic" government has the power to do a lot of harm.

In that case the only solution would be a hardware fix.

Answer 6

The question asks for a way to counter the effect of a trojan horse that is a result of anti-viral software loading an image that targets part of the kernel of the operating system, and shutting the computer down at the bootup level.

A real-life example of how this had to be managed has happened, and offers a real-life answer to this problem. The only solution in this real-life scenario was to re-boot the computers in safe mode from an external USB, and correct the problem. No software solution exists. No automated solution exists. It is a hands on hardware solution involving an alternative method of booting the computer manually. It does, however, demand that all passwords and security protocols of each computer be known that allows for local access to the computer hard drive.

So now we have the real life answer to a similar problem. As usual, reality turns out to be far more frightening than fiction. This, by any measure, has to be considered as a valid answer.

And it wasn't even caused by intentional or malicious action.

From CNN

The company’s engineers took action to address the problem, according to an advisory viewed by CNN, which told customers to reboot their computers and perform other actions if they were still having technical issues. The issue is specific to Falcon, one of CrowdStrike’s main software products, and is not impacting Mac or Linux operating systems, according to the advisory. Crowdstrike says Falcon is designed to protect files saved in the cloud.

CrowdStrike’s cybersecurity software — used by numerous Fortune 500 companies, including major global banks, healthcare and energy companies — detects and blocks hacking threats. Like other cybersecurity products, the software requires deep-level access to a computer’s operating system to scan for those threats. In this case, computers running Microsoft Windows appear to be crashing because of the faulty way a software code update issued by CrowdStrike is interacting with the Windows system.