Menu
Malwarebytes still fixing flaws in antivirus software

Malwarebytes still fixing flaws in antivirus software

The company apologized, saying vulnerabilities are a reality of software development

Malwarebytes said it could take three of four weeks to fix flaws in its consumer product that were found by a Google security researcher.

The company has fixed several server-side vulnerabilities but is still testing a new version of its Anti-Malware product to fix client-side problems, CEO Marcin Kleczynski said in a blog post.

In the meantime, customers can implement a workaround: those using the premium version of Anti-Malware "should enable self-protection under settings to mitigate all of the reported vulnerabilities," he wrote.

Kleczynski apologized, saying vulnerabilities are a reality that come with software development. "While these things happen, they shouldn’t happen to our users," he wrote.

Google researcher Tavis Ormandy uncovered several issues with the Anti-Malware product, including that it doesn't use encryption when downloading fresh signatures.

That opens the possibility for a man-in-the-middle attack, Ormandy said in an advisory. An attacker could potentially replace the signature file.

Ormandy also found three other issues, including a privilege escalation flaw.

He reported the flaws to Malwarebytes in November and gave the company 90 days to fix them before going public.

Ormandy has been analyzing quite a few security products lately and finding alarming problems. Last month, he found a problem in Trend Micro's antivirus software that could be used to steal stored passwords.

Vulnerabilities in security products are especially dangerous since they often have deep access to a computer's operating system.

Dozens of serious vulnerabilities were found last year in antivirus products from vendors including Kaspersky Lab, ESET, Avast, AVG Technologies and Intel Security (formerly McAfee). Security experts have warned for years that flaws in endpoint protection products pose a big risk.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags securitytrend microflawskaspersky labesetAvastAVG TechnologiesMalwarebytesIntel Security (formerly McAfee)

Featured

Slideshows

Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
Show Comments