Trend Micro Rootkit Buster app banned after cheating on Microsoft’s driver certification test

guest · May 28, 2020

Trend Micro Rootkit Buster scanner app banned after cheating on Microsoft’s driver certification test
May 28, 2020
https://mspoweruser.com/trend-micro...ting-on-microsofts-driver-certification-test/

In a case of asking who watches the watchers, security company Trend Micro has been discovered cheating on Microsoft’s kernel driver security test suite.

The kernel driver in question, tmcomm.sys, appears to detect Microsoft’s WHQL test suite, and change its behaviour to be more compliant, in particular only accessing Windows 10’s non-executable non-paged pool of available RAM.
[...] in Trend Micro’s case the main consequence was that Microsoft added it to the banned list on their Driver Compatibility Database, which means the driver is now blocked from installing on Windows 10.

Trend Micro has already withdrawn Rootkit Buster from their website, and claims they have actually asked Microsoft to block the driver, saying:

While investigating claims in [Demirkapi’s] blog, our development teams identified a potential medium-level security issue and are working to ensure it is properly and quickly resolved. Out of an abundance of caution, we have taken down the current version of the tool from our site while we evaluate and remediate. [...]
Click to expand...

via The Register
Click to expand...

Bill_Bright · May 28, 2020

Wow! I sure hope some heads roll at TM.

guest · Jun 12, 2020

mood said: ↑

via The Register
Click to expand...

Updated:

Updated to add
Trend's PR people have stressed once again that "Trend Micro is not cheating any tests," although declined to explain why the driver code was detecting the presence of the Windows certification suite.

They also said Trend asked Microsoft to block the driver in the latest version of Windows 10, aka the May 2020 update or 20H1, due to "compatibility testing."

"Microsoft’s actions were per request from Trend Micro and in no way negatively affiliated," a spokesperson told us. "Trend Micro made the request for this block because of internal compatibility testing for the next major Windows 10 update."
Click to expand...

We've asked Microsoft to confirm Trend's assertions.
We also note that Trend and Microsoft share the same PR mega-agency: Waggener Edstrom Communications. No doubt they'd remind us the teams working on Trend Micro and Microsoft are completely separate.
Click to expand...

plat · Jun 12, 2020

According to the Register article, the discoverer of the Trend Micro dubious code is 18 years old.

Log in or Sign up

Trend Micro Rootkit Buster app banned after cheating on Microsoft’s driver certification test

guest Guest

Bill_Bright Registered Member

guest Guest

plat Registered Member

Log in or Sign up

Trend Micro Rootkit Buster app banned after cheating on Microsoft’s driver certification test

guest Guest

Bill_Bright Registered Member

guest Guest

plat Registered Member

Useful Searches