Research shows antivirus products vulnerable to attack

[Brink]

A Google researcher has been reporting severe vulnerabilities in security suites from Kaspersky, Trend Micro, MalwareBytes, FireEye, AVG, ESET and now Comodo.

Google security researcher Tavis Ormandy has long been a pain to vendors of commercial software with significant bugs, which is to say all vendors of all commercial software.

Lately he has been on a tear finding truly shocking vulnerabilities in commercial Windows security suites, what most people call antivirus. The latest: "Comodo Internet Security installs and starts a VNC server by default," and does not restrict access to it. VNC is an open source remote control tool.

In fact, Ormandy is not claiming to have found this particular feature, which has been reported many times before. The VNC server is part of Comodo GeekBuddy, a tech support tool which Ormandy accuses of "...a number of questionable and shady tactics to encourage users to pay for online tech support." The server allows for local privilege escalation...

Read more: Research shows antivirus products vulnerable to attack | ZDNet

 

[ThrashZone]

Ormandy has a history of disclosing severe vulnerabilities and even releasing exploits in other companies' products, Microsoft in particular, with little or no warning to the vendor. In 2010 he released a zero-day exploit in Windows a few days after reporting it to Microsoft, one of many developments that led to Microsoft developing their Coordinated Vulnerability Disclosure program.

I don't have an issue with publishing exploits often it is only way to get a fix otherwise the company just says there's no issue in the wild exploiting it and it's not a priority.
Once it's public there's a priority to fix it

 

[whs]

I think I was saying that for a long time - AV programs cannot protect you. At least not the way they are being implemented today. I use Linux for internet work. That is not 100% safe either but a lot better than Windows plus AV.

 

[Callender]

I use Comodo AV but not GeekBuddy. The way to avoid it is to select custom install options.

 

[Sky Ranch]

So, he finds product vulnerabilities and gives vendors x amount of time to fix it, and if they fail to do so in a timely manner he discloses the vulnerability to those who might have malicious intent thereby putting anyone using those products at risk.

Sounds like a nice guy.

 

[Barman58]

I use Comodo AV but not GeekBuddy. The way to avoid it is to select custom install options.

If you forget to do correctly and use a custom install Geek buddy is actually treated as a separate program, It has it's own Uninstall that allows removal without affecting the whole CIS suite

 

[ThrashZone]

So, he finds product vulnerabilities and gives vendors x amount of time to fix it, and if they fail to do so in a timely manner he discloses the vulnerability to those who might have malicious intent thereby putting anyone using those products at risk.

Sounds like a nice guy.

They could of been exploiting the vulnerability so yes using talents for good of the public using the product is a good thing in my book

Beside another story said they now give 90 days and that is way too long.
mbam got that advanced info and there still is no fix so how long is not long enough to alert the public

 

[Barman58]

The way I look at it the only ethical way to treat this type of information is to privately inform those other parties that can use such information to better protect their users, and not go spouting it all over the web for personal gain.

He works for google so he could not have any ulterior motive for these publicity stunts could he :sarc:

 

[ThrashZone]

Unless you think he's pushing Android phones ? = No.

Granted waiting only a couple days before going public is self serving in that respect = yes

Who's to say they were the first to find the exploit
If they found it why is it outrageous to think someone wouldn't.

 

[Layback Bear]

Because of my lack of knowledge I'm not understanding the timing of things.
How long does it take to verify the reported problem does exist and then creating a cure. I have no idea how long the verification and cure should take.

Another thought would be; could Google be trying to direct people to particular security program of their choosing by posting so called security problems in this or that security programs.

Security problems have been reported in Kaspersky, Trend Micro, MalwareBytes, FireEye, AVG, ESET and now Comodo.

That might be factual but what is missing that is confusing to me.
They are basically stating that all other security programs are okay.
It's hard for me to believe that IObits security programs are okay. But they must be because they are not on the list. Right?

Then again IObits doesn't have a large market share so it might not of been tested.

How about Avast? Was it tested and what were the results?
I believe Avast is used by many happy users.

Not telling us all the security programs that were tested and the results leads me to believe that Google is not telling the whole story.

 

[ThrashZone]

Trend Micro is a IOBit product

 

[Barman58]

Ormandi is as far as I can see someone who posts alleged exploits in various software packages in order to raise his personal publicity - the fact that the news of the latest supposed exploit was published in The Enquirer provides me with a lot of information on his motives and target audience.

In fact the latest "exploit is actually nullified on my system by the stealth mode of Comodo firewall which closes the port used by Geek Budy If I ever installed it

 

[Layback Bear]

Trend Micro is a IOBit product

Could by chance show me where this information comes from?

 

[ThrashZone]

Oops I guess it's not :/
IObit Products Free Download - IObit

 

[Barman58]

I just clicked on the IOBit link

Where is the image of a bottle?

There must be a picture of a bottle

All snake oil comes in bottles

 

[ThrashZone]

:roflmao: