Google security researcher excoriates TrendMicro for critical AV defects
http://arstechnica.com/security/2016/01/google-security-researcher-excoriates-trendmicro-for-critical-av-defects/
Antivirus provider TrendMicro has released an emergency product
update that fixes critical defects that allow attackers to
execute malicious code and to view contents of a password
manager built in to the malware protection program. The release
came after a Google security researcher publicly castigated a
TrendMicro official for the threat. Details of the flaws became
public last week after Tavis Ormandy, a researcher with Google's
Project Zero vulnerability research team, published a scathing
critique disclosing the shortcomings. While the code execution
vulnerabilities were contained in the password manager included
with the antivirus package, they could be maliciously exploited
even if end users never make use of the password feature. Those
who did use it were also susceptible to hacks that allowed
attackers to view hashed passwords and the plaintext Internet
domains they belonged to.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
