Tavis Ormandy vs. Antivirus - Discussion

Was reading about the blog Tavis found in malwarebytes and mbae updating over http, and the possibility of hijacking that update mechanism. The blog post I read was from 2016, but I remembered reading something earlier form another security researcher saying something similar but two years earlier.

this is the malwarebytes blog post: https://blog.malwarebytes.com/malwa...ebytes-anti-malware-vulnerability-disclosure/
this is the link indicating a similar bug two years earlier: http://blog.0x3a.com/post/104954032239/cve-2014-4936-malwarebytes-anti-malware-and

I'm not sure if they are strictly the same bug, but it'd be a little scary if they let a bug like that go for two years without patching it until google called them out.

 

That was for the free version yes but not the paid version, where you can enable self protection.

 

Link: https://twitter.com/taviso/status/793354114751082497

 

Yet another scandal from Kapsersky, and yet another evidence why security software shouldn't touch SSL.

 

What other products are known to do this? Anyone know? Just curious.

Does Webroot do this?

 

No, Webroot does not do this.
You can find here below a recent discussion:
https://www.wilderssecurity.com/thre...-client-end-tls-interception-software.385640/

 

All AVs which has an option for SSL scan, but the degree of terribleness differ.
Avast is relatively better (still far from perfect tho), Bitdefender was bad (worse than Kaspersky in that time; I don't know current state), and Comodo's PrivDog was the worst. IDK about ESET but they have the option too. In all of those AVs except for Avast this feature is turened off by default.

 

It's turned on by default in Eset ver. 10.

 

I still don't know what Travis is referring to by "32 bit." Is it symmetric algorithm key length? That would be a fiasco if Kaspersky used that key length for their self-signed certs.

 

Some Kaspersky filesystem ACL and also SSL bugs. Bug reports within the quoted tweets below.

Source: https://twitter.com/taviso/status/816372419619266560

Source: https://twitter.com/taviso/status/816373947109228546

 

I think SSL filtering by AV's is a bad idea.

 

Link: https://twitter.com/taviso/status/867134496935563264

Github: https://github.com/taviso/loadlibrary

Tavis' about to tear this Windows Defender down...

 

https://github.com/taviso/loadlibrary/blob/master/README.md

Let it rip, Travis! Pretty much know how this one is going to end up.

 

So basically he ported MsMpEng to Linux to be able to fuzz it more easily, so he can test his PoC in a more efficient way.

 

Good for him, hopefully the end result is more fixes for millions of Windows users.