trendmicro Google security researcher excoriates TrendMicro for critical AV defects

[steven36]

Antivirus provider TrendMicro has released an emergency product update that fixes critical defects that allow attackers to execute malicious code and to view contents of a password manager built in to the malware protection program. The release came after a Google security researcher publicly castigated a TrendMicro official for the threat.

 

 

 

Details of the flaws became public last week after Tavis Ormandy, a researcher with Google's Project Zero vulnerability research team, published a scathing critique disclosing the shortcomings. While the code execution vulnerabilities were contained in the password manager included with the antivirus package, they could be maliciously exploited even if end users never make use of the password feature. Those who did use it were also susceptible to hacks that allowed attackers to view hashed passwords and the plaintext Internet domains they belonged to.

 

"I don't even know what to say—how could you enable this thing *by default* on all your customer machines without getting an audit from a competent security consultant?" Ormandy wrote in an exchange with a TrendMicro official. "You need to come up with a plan for fixing this right now. Frankly, it also looks like you're exposing all the stored passwords to the internet, but let's worry about that screw up after you get the remote code execution under control."

 

Elsewhere in the exchange, Ormandy criticized company developers for failing to move faster to contain the threat and renewed his call for them to seek help from outside security professionals. He wrote:

Quote

 

So this means, anyone on the internet can steal all of your passwords completely silently, as well as execute arbitrary code with zero user interaction. I really hope the gravity of this is clear to you, because I'm astonished about this.

In my opinion, you should temporarily disable this feature for users and apologise for the temporary disruption, then hire an external consultancy to audit the code. In my experience dealing with security vendors, users are quite forgiving of mistakes if vendors act quickly to protect them once informed of a problem, I think the worst thing you can do is leave users exposed while you clean this thing up. The choice is yours, of course.

 

 

Ormandy said it took him only about 30 seconds to find one of many code-execution holes in the antivirus program. In the past few days, TrendMicro began testing an emergency fix it planned to push out to end users. Ormandy said the update resolves the issue but that he remained concerned that the password manager continues to expose more than 70 potentially dangerous programming interfaces to the open Internet. In the past few years, Ormandy has exposed critical vulnerabilities in a host of security products, including those from Sophos, Kaspersky Lab, AVG, and FireEye.

 

Source

[Holmes]

All of this because of a password manager lawls.  Thats what trend micro gets for adding useless features to there antivirus.  How many different password managers are there available on the internet plenty lastpass and keepass comes to mind.  Trend micro isnt the only antivirus company guilty of this avast developed there own password manager to theres is useless (IMHO) as well.  Thats what you get for developing new features when you could be making your antivirus real-time detection on-demand detection better and reducing the amount of false positives users are possibly getting.

[pc71520]

First AVG, now TrendMicro...