Menu
Malwarebytes still fixing flaws in antivirus software

Malwarebytes still fixing flaws in antivirus software

The company apologized, saying vulnerabilities are a reality of software development

Malwarebytes said it could take three of four weeks to fix flaws in its consumer product that were found by a Google security researcher.

The company has fixed several server-side vulnerabilities but is still testing a new version of its Anti-Malware product to fix client-side problems, CEO Marcin Kleczynski said in a blog post.

In the meantime, customers can implement a workaround: those using the premium version of Anti-Malware "should enable self-protection under settings to mitigate all of the reported vulnerabilities," he wrote.

Kleczynski apologized, saying vulnerabilities are a reality that come with software development. "While these things happen, they shouldn’t happen to our users," he wrote.

Google researcher Tavis Ormandy uncovered several issues with the Anti-Malware product, including that it doesn't use encryption when downloading fresh signatures.

That opens the possibility for a man-in-the-middle attack, Ormandy said in an advisory. An attacker could potentially replace the signature file.

Ormandy also found three other issues, including a privilege escalation flaw.

He reported the flaws to Malwarebytes in November and gave the company 90 days to fix them before going public.

Ormandy has been analyzing quite a few security products lately and finding alarming problems. Last month, he found a problem in Trend Micro's antivirus software that could be used to steal stored passwords.

Vulnerabilities in security products are especially dangerous since they often have deep access to a computer's operating system.

Dozens of serious vulnerabilities were found last year in antivirus products from vendors including Kaspersky Lab, ESET, Avast, AVG Technologies and Intel Security (formerly McAfee). Security experts have warned for years that flaws in endpoint protection products pose a big risk.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags AVG Technologiestrend microsecurityIntel Security (formerly McAfee)AvastflawsMalwarebytesesetkaspersky lab

Featured

Slideshows

Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News honoured the industry’s finest on a standout evening for the New Zealand channel, recognising the achievements of established and emerging partners on a memorable night in Auckland.

Reseller News ICT Industry Awards 2017 - Meet the winners...
Show Comments