T1. Malware/Viruses

An attacker may attempt to introduce malware or viruses into the computers with the aim of gaining unauthorized access to User data, or disruption of operations on that computer, or using that computer to attack additional systems.

Endangered Assets: User Files (Integrity, Confidentiality)

T2 - Information Disclosure

An attacker attempts to access the user files and discloses the information to unauthorized parties through vulnerabilities in ClamAV.

Endangered Assets: User Files (Confidentiality)

T3 - Fraudulent modification of user files

An attacker attempts to modify or delete the user files in the servers that are under the scope of TOE scan. The integrity of these files is important and needs to be taken care of. However, a malicious user attempts to disturb these files by deleting them completely or some part of it affecting the integrity and availability of files.

Endangered Assets: User Files (Integrity, Availability)

T4 - Fraudulent modification of configuration files

An attacker attempts to change the configuration files to set permissions of their choice. Attacker can also replace the source code files to make it work according to their own wish. This affects the integrity of the configuration files and the availability of TOE if an attacker removes or modifies the config files to an unintended setting.

Endangered Assets: Configuration Files (Integrity), ClamAV Daemon (Availability)

T5 - Fraudulent Modification of TOE source code

An attacker modifies the source code files to insert a malicious code or functionality of their own intention. This affects the integrity of the files and the availability of TOE if an attacker removes some files that are required for its working.

Endangered Assets: Source Code (Integrity)

T6 - Fraudulent modification of databases and signatures

Attackers can manipulate the signatures by either deleting or modifying the databases. To bypass the AV attacker can tamper with the signature in the signature database. When ClamAV scans the infected file, it does not find any match in the database and it shall mark the file as benign.

Endangered Assets: Signature Databases (Integrity, Availability)

T7 - Denial of service

Denial of service (DoS) is an attack that makes the service unavailable to use. Availability of ClamAV protection service is critical, otherwise some files may go unscanned and might contain malware. An attacker can craft some malicious file that when scanned by the ClamAV, occupies a significantly larger amount of resources than needed. As a result, the ClamAV becomes completely or partially unavailable. This affects the availability of the ClamAV.

Endangered Assets: ClamAV Daemon (Availability)

T8 - Local Privilege Escalation

An attacker may gain access to TOE and exploit system privileges to gain access to user files and TOE security functions.

Endangered Assets: User Files (Confidentiality, Integrity)

T9 - Fail to Detect

The TOE may analyze a file but fail to detect it as a malware or a virus if the signature of that virus is not in the database. This threat affects the overall system but the user files are the most affected asset that TOE is protecting.

Endangered Assets: User Files (Integrity)

F1 – Virus Scans:

The TOE’s main purpose is to run and scan for viruses. Manual on-demand scan and real time scan helps to detect millions of viruses, worms, trojans, ransomwares and other different types of malwares in the system. The ClamOnAcc client for the clamd scanning daemon provides on-access scanning on modern versions of Linux. This includes an optional capability to block file access until a file has been scanned (on-access prevention).

ClamAV can be configured for the actions it can take on the detection of any infected files. The files can either be moved to a separate location or removed. The detection of virus will be logged to TOE audit logs. This helps to protect the system and user files from unauthorized access, disclosures, fraudulent modification and deletion.

F2 – ClamAV Database Updates:

ClamAV databases are updated with the freshclam tool provided by ClamAV. It supports differential updates (instead of transferring the whole CVD file at each update it only transfers the differences between the latest and the current database via a special script), database version checks through DNS, proxy servers, digital signatures, and various error scenarios. These updates help TOE to detect latest vulnerabilties, viruses and malwares.

ClamAV signatures are stored in the form of the CVD file extension. The CVD file format provides a digitally signed container that encapsulates the signatures and ensures that they cannot be modified by a malicious third party. Even if it is modified and corrupted, freshclam will not be updated, instead, it will replace the database with a fresh download. The frequency of database updates and checks is set in the freshclam configuration file.

Moreover, clamscan and clamd will not run unsigned bytecode signatures by default. Users can enable this feature from the configuration file, but it is advised that users should never enable unsigned bytecode signatures in production when using signatures from third-party sources or a malicious bytecode signature author could gain control of your systems.

F3 – Clamconf, tool for checking configuration files:

Clamconf is a tool provided with TOE on installation. Clamconf is used for checking your entire TOE configuration. It displays values used when configuring ClamAV at compilation time, important OS details, the contents (and validity) of configuration files of both clamd and freshclam, along with other important engines, databases, platforms, and build information.

The tool can also be used to check and generate configuration files. In case of corruption or deletion of the configuration files, the user can use this tool to regenerate the configuration files.

F4 – ClamAV service user account (and group):

At the time of installation from Debian packages, ClamAV creates a new service account and group by the name of clam. If the user is installing from the source, it is advised that they should create a ClamAV account and lock access to that account.

Freshclam always runs as the service user account. The configuration file of freshclam is also owned by the clamav service account. So, normal users and root cannot modify or delete the configuration file of freshclam.

The local databases of ClamAV are also owned by the ClamAV service user account. As the access to the ClamAV service user account is locked, you cannot modify files as a normal user. Even if you modify it as the root user, the clamd daemon process will fail to start checking the integrity of the database, showing the error that “cannot load /var/lib/database, cannot verify database integrity, error loading database”.

F5 - Logging:

The TOE logs its actions in different log files inside /var/log/clamav/ directory by default. The TOE records database updates in /var/log/clamav/freshclam.log .The results of the scan can be logged as a report with —log option and the actions of Clamav can be monitored from the log files. The logging helps to detect any incidents or service failures in clamav, fraudulent modification in configuration files and databases and malware detection.

F6 – Use Git version control and security review:

As ClamAV is an open-source project, its code is available on GitHub and developers can contribute to the project. ClamAV uses a pull request (PR) workflow for contributions to the ClamAV Git repository. When the developer submits a pull request, some automated tests get run. Along with this, the ClamAV team reviews the code to ensure that the code is secure and that there is no malicious code added to it that can harm the user file.

ClamAV developer also takes into consideration the issues and emails from the developer. It is advised to developers that are contributing to the community to not release vulnerabilities in GitHub issues because that will affect everyone who has ClamAV installed before the release of the patch. ClamAV provides an email address and recommends developers send vulnerability issues to that email. In consideration of these contributions, ClamAV developers review the code and make considerable changes to eliminate those vulnerabilities in the next release.

F7 – Memory Limiting:

The clamd process uses a lot of memory because it loads the complete database of virus definitions into memory. Exceeded consumption of memory can be vulnerable to a denial of service attack on ClamAV. This process would always get killed when reloading the database after an update. This is because of the concurrent database reload strategy. To handle this issue, a feature is added in the clamd configuration file that will allow the user to enable or disable concurrent database reload according to their needs and system specifications.