This one’s a head scratcher, but a thread on Google Code has revealed that Trend Micro exposed its antivirus customers to attack, after it installed a wide-open Node.js server by default on its customers’ computers.
The Node.js server is part of Trend Micro’s ‘Password Manager’ utility and installed with the company’s antivirus software, as well as being set to open at startup, by default.
It leaves a number of ports open to the world, which could expose users to any website executing a malicious application on their machine by sending a JavaScript request. That means an attacker could easily remotely download code and execute it on a victim’s machine without their knowledge.
If you thought it couldn’t get any worse, it does.
Trend Micro also adds a self-signed security certificate to the user’s certificate store, so the user won’t see any HTTPS errors.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
Tavis Ormandy, a researcher at Google’s Project Zero vulnerability team, wrote in the thread that “this thing is ridiculous.”
As research into the flaw continued, Ormandy found that an attacker could silently steal the passwords stored in Trend Micro’s safe and decrypt them, all using the original flaw, telling the company that “I really hope the gravity of this is clear to you, because I’m astonished about this.”
He then recommends that the company disable the feature, to protect users:
In my opinion, you should temporarily disable this feature for users and apologise for the temporary disruption, then hire an external consultancy to audit the code. In my experience dealing with security vendors, users are quite forgiving of mistakes if vendors act quickly to protect them once informed of a problem, I think the worst thing you can do is leave users exposed while you clean this thing up. The choice is yours, of course.
Ultimately, Trend Micro chose not to disable the tool, instead issuing an emergency fix to disable the first vulnerability two days ago.
The issue was first disclosed to Trend Micro on January 5, but wasn’t resolved until today — even now it’s only partially fixed, with the company issuing an emergency patch.
In response to Trend Micro dragging its heels, Ormandy said that he “[doesn’t] even know what to say – how could you enable this thing *by default* on all your customer machines without getting an audit from a competent security consultant?”
The thread is now public and it’s an incredible insight into how enterprise-grade antivirus software, which is supposed to protect users against threats, actually left them wide open to attack.
Get the TNW newsletter
Get the most important tech news in your inbox each week.