Google security researcher reveals vulnerability in Trend Micro security software
Trend Micro has patched a flaw in its antivirus software that potentially put PCs at risk of being hijacked by criminals.
This could allow hackers to access the software and take control of it in a matter of seconds, giving them the ability to execute commands and launch programs on unsuspecting users’ PC, as well as potentially giving access to all saved passwords stored with Password Manager on the machine.
This was displayed by one user hacking into the Calculator program bundled with Windows to take over a user’s PC (pictured below).
“I don’t even know what to say – how could you enable this thing *by default* on all your customer machines without getting an audit from a competent security consultant?”
Following the publication of his blog on Google’s security research site, Ormandy confirmed he had been contacted by Trend Micro, which thanked him for pointing out the flaw.
The company says it has now fixed the problem, and is has updated Password Manager in a patch to remove ShellExecute as part of the software.
“The most important thing to know is that the critical vulnerabilities in the public report have been fixed for all Trend Micro Password Manager customers,” a Trend Micro statement said. “As part of our standard investigation we checked and verified that the only product affected by these issues is our consumer Trend Micro Password Manager and no commercial or enterprise products are affected.”
“We responded quickly to the initial report and worked with Tavis throughout the process to understand the issue and address them. Thanks to his responsible work with us, we were able to address the most critical issues he brought us in less than one week. We are not aware of any active attacks against these vulnerabilities in that time.”
Are you a security pro? Try our quiz!