AV software make your system more insecure

tlu · Jul 29, 2014

http://www.syscan360.org/slides/2014_EN_BreakingAVSoftware_JoxeanKoret.pdf

AV engines makes your computer more vulnerable with a varying degree of performance penalty.
The AV engine is as vulnerable to zero day attacks as the applications it tries to protect from.
...
Most (if not all...) antivirus engines run with the highest privileges: root or local system.
If one can find a bug and write an exploit for the AV engine, (s)he just won root or system privileges.

Most antivirus engines updates via HTTP only protocols:
If one can MITM the connection (for example, in a LAN) one can install new files and/or replace existing installation files.
It often translates in completely owning the machine with the AV engine installed as updates are not commonly signed. Yes. They aren't.
...
Found remote and local vulnerabilities in 14 AV engines or AV products.
Most of them in the first 2 months.
I tested ~17 engines
...
Exploiting an AV engine is like exploiting any other client-side application.
Is not like exploiting a browser or a PDF reader.
Is more like exploiting an Office file format.
Click to expand...

FleischmannTV · Jul 29, 2014

We've already had a discussion about Joxean Koret's findings almost four months ago here.

https://www.wilderssecurity.com/threads/breaking-av-software.362274/

tlu · Jul 29, 2014

FleischmannTV said: ↑

We've already had a discussion about Joxean Koret's findings almost four months ago here.

https://www.wilderssecurity.com/threads/breaking-av-software.362274/
Click to expand...

Sorry - I hadn't noticed that.

Log in or Sign up

AV software make your system more insecure

tlu Guest

FleischmannTV Registered Member

tlu Guest

Log in or Sign up

AV software make your system more insecure

tlu Guest

FleischmannTV Registered Member

tlu Guest

Useful Searches