Menu
Malwarebytes still fixing flaws in antivirus software

Malwarebytes still fixing flaws in antivirus software

The company apologized, saying vulnerabilities are a reality of software development

Malwarebytes said it could take three of four weeks to fix flaws in its consumer product that were found by a Google security researcher.

The company has fixed several server-side vulnerabilities but is still testing a new version of its Anti-Malware product to fix client-side problems, CEO Marcin Kleczynski said in a blog post.

In the meantime, customers can implement a workaround: those using the premium version of Anti-Malware "should enable self-protection under settings to mitigate all of the reported vulnerabilities," he wrote.

Kleczynski apologized, saying vulnerabilities are a reality that come with software development. "While these things happen, they shouldn’t happen to our users," he wrote.

Google researcher Tavis Ormandy uncovered several issues with the Anti-Malware product, including that it doesn't use encryption when downloading fresh signatures.

That opens the possibility for a man-in-the-middle attack, Ormandy said in an advisory. An attacker could potentially replace the signature file.

Ormandy also found three other issues, including a privilege escalation flaw.

He reported the flaws to Malwarebytes in November and gave the company 90 days to fix them before going public.

Ormandy has been analyzing quite a few security products lately and finding alarming problems. Last month, he found a problem in Trend Micro's antivirus software that could be used to steal stored passwords.

Vulnerabilities in security products are especially dangerous since they often have deep access to a computer's operating system.

Dozens of serious vulnerabilities were found last year in antivirus products from vendors including Kaspersky Lab, ESET, Avast, AVG Technologies and Intel Security (formerly McAfee). Security experts have warned for years that flaws in endpoint protection products pose a big risk.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags trend microflawskaspersky labesetAvastAVG TechnologiesMalwarebytesIntel Security (formerly McAfee)

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments