Trend Micro Anti-Threat Toolkit 'will run malware – if its filename is cmd.exe or regedit.exe'

mood · Oct 21, 2019

Trend Micro Anti-Threat Toolkit 'will run malware – if its filename is cmd.exe or regedit.exe'
Try not to save files to your Windows PC called cmd.exe or regedit.exe
October 21, 2019
https://www.theregister.co.uk/2019/10/21/flaw_trend_micro/

A flaw in the Trend Micro Anti-Threat Toolkit can be exploited by hackers to run malware on victims' Windows computers.

Bug-hunter John "hyp3rlinx" Page took credit for uncovering CVE-2019-9491, an arbitrary code execution flaw in the security tool.
In short, the Trend software can be tricked into executing any old piece of software under the sun, including malware, when it is scanned, provided the filename is cmd.exe or regedit.exe. No, really.

In other words, your Trend antivirus software can be tricked into running a virus.

"Since the ATTK is signed by verified publisher and therefore assumed trusted any MOTW security warnings are bypassed if the malware was internet downloaded, also it can become a persistence mechanism as each time the Anti-Threat Toolkit is run so can an attackers malware," the flaw-finder added.
The bug is no secret, either. According to hyp3rlinx, Trend was warned of the flaw back on September 9, and confirmed the bug on the 25th of that month.
Click to expand...

mood · Oct 23, 2019

mood said: ↑

Trend Micro Anti-Threat Toolkit 'will run malware – if its filename is cmd.exe or regedit.exe'
Try not to save files to your Windows PC called cmd.exe or regedit.exe
October 21, 2019
https://www.theregister.co.uk/2019/10/21/flaw_trend_micro/
Click to expand...

Updated article:

Updated to add
Trend's software was patched on Friday. Make sure you're running version 1.62.0.1223 or higher.
Click to expand...

Trend Micro: Security Bulletin: Trend Micro Anti-Threat Toolkit (ATTK) RCE Vulnerability

CVE Identifier(s): CVE-2019-9491
CVSS 3.0 Score(s): 7.5 - AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Vulnerability Details
This update resolves the following vulnerability in Trend Micro ATTK:
1. Vulnerable versions of ATTK may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
Mitigating Factors
Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.
Click to expand...

mood · Feb 3, 2020

Trend Micro Patches More Vulnerabilities in Anti-Threat Toolkit
February 3, 2020
https://www.securityweek.com/trend-micro-patches-more-vulnerabilities-anti-threat-toolkit

The vulnerability, tracked as CVE-2019-9491, was patched in mid-October with the release of version 1.62.0.1223.

Researcher Stefan Kanthak has also analyzed the vulnerability and discovered that Trend Micro has failed to patch it completely. Kanthak has identified three other similar attack methods that can be launched against ATTK to execute arbitrary code by planting specially crafted files in specific locations.
He informed Trend Micro of his findings on October 23 and the cybersecurity firm last week released another update, version 1.62.0.1228, to patch the new flaws.

Trend Micro has updated its advisory for CVE-2019-20358 and assigned a second CVE identifier, CVE-2019-20358, to the related vulnerabilities discovered by Kanthak.
Click to expand...

“The Trend Micro Anti-Threat Toolkit inspected in October 2019 was built from scrap: the developers used VisualStudio 2008 (end-of-life since two years), linked against an outdated and vulnerable LIBCMT, shipped an outdated and vulnerable cURL 7.48 plus an outdated and vulnerable libeay32.dll 1.0.1.17 (OpenSSL 1.0.1 is end-of-life since more than 3 years; the last version was 1.0.1.20),” he said in an advisory published on the Full Disclosure mailing list. “This POOR (really: TOTAL lack of proper) software engineering alone disqualifies this vendor and its ‘security’ products!”
Click to expand...

Log in or Sign up

Trend Micro Anti-Threat Toolkit 'will run malware – if its filename is cmd.exe or regedit.exe'

mood Updates Team

mood Updates Team

mood Updates Team

The Enemy Within: How Insider Threats Are Changing

EINSTEIN Data Trends – 30-day Lookback

Understanding cyber threats to APIs

Vermont Updates its Data Breach Notification Law

Denuvo says its new kernel-level anti-cheat driver is minimally invasive

Log in or Sign up

Trend Micro Anti-Threat Toolkit 'will run malware – if its filename is cmd.exe or regedit.exe'

mood Updates Team

mood Updates Team

mood Updates Team

The Enemy Within: How Insider Threats Are Changing

EINSTEIN Data Trends – 30-day Lookback

Understanding cyber threats to APIs

Vermont Updates its Data Breach Notification Law

Denuvo says its new kernel-level anti-cheat driver is minimally invasive

Useful Searches