Menu
Malwarebytes still fixing flaws in antivirus software

Malwarebytes still fixing flaws in antivirus software

The company apologized, saying vulnerabilities are a reality of software development

Malwarebytes said it could take three of four weeks to fix flaws in its consumer product that were found by a Google security researcher.

The company has fixed several server-side vulnerabilities but is still testing a new version of its Anti-Malware product to fix client-side problems, CEO Marcin Kleczynski said in a blog post.

In the meantime, customers can implement a workaround: those using the premium version of Anti-Malware "should enable self-protection under settings to mitigate all of the reported vulnerabilities," he wrote.

Kleczynski apologized, saying vulnerabilities are a reality that come with software development. "While these things happen, they shouldn’t happen to our users," he wrote.

Google researcher Tavis Ormandy uncovered several issues with the Anti-Malware product, including that it doesn't use encryption when downloading fresh signatures.

That opens the possibility for a man-in-the-middle attack, Ormandy said in an advisory. An attacker could potentially replace the signature file.

Ormandy also found three other issues, including a privilege escalation flaw.

He reported the flaws to Malwarebytes in November and gave the company 90 days to fix them before going public.

Ormandy has been analyzing quite a few security products lately and finding alarming problems. Last month, he found a problem in Trend Micro's antivirus software that could be used to steal stored passwords.

Vulnerabilities in security products are especially dangerous since they often have deep access to a computer's operating system.

Dozens of serious vulnerabilities were found last year in antivirus products from vendors including Kaspersky Lab, ESET, Avast, AVG Technologies and Intel Security (formerly McAfee). Security experts have warned for years that flaws in endpoint protection products pose a big risk.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags trend microflawskaspersky labesetAvastAVG TechnologiesMalwarebytesIntel Security (formerly McAfee)

Brand Post

How to become the best IT MSP

This article provides guidance for managed service providers (MSPs) that want to grow their business. It is also useful for any IT service provider looking to move from the break-fix model to managed IT services.

Featured

Slideshows

Reseller News Innovation Awards 2019: meet the winners

Reseller News Innovation Awards 2019: meet the winners

Reseller News honoured the standout players of the New Zealand channel in front of more than 480 technology leaders in Auckland on 23 October, recognising the achievements of top partners, emerging entrants and innovative start-ups.

Reseller News Innovation Awards 2019: meet the winners
Malwarebytes shoots the breeze with channel, prospects

Malwarebytes shoots the breeze with channel, prospects

A Kumeu, Auckland, winery was the venue for a Malwarebytes event for partner and prospect MSPs - with some straight shooting on the side. The half-day getaway, which featured an archery competition, lunch and wine-tasting aimed at bringing Malwarebytes' local New Zealand and top and prospective MSP partners together to celebrate recent local successes, and discuss the current state of malware in New Zealand. This was also a unique opportunity for local MSPs to learn about how they can get the most out of Malwarebytes' MSP program and offering, as more Kiwi businesses are targeted by malware.

Malwarebytes shoots the breeze with channel, prospects
Show Comments