Slashdot Mirror
Trend Micro Flaw Could Have Allowed Attacker To Steal All Passwords (csoonline.com)
itwbennett writes: Trend Micro has released an automatic update fixing the problems in its antivirus product that Google security engineer Tavis Ormandy discovered could allow "anyone on the internet [to] steal all of your passwords completely silently, as well as execute arbitrary code with zero user interaction." The password manager in Trend's antivirus product is written in JavaScript and opens up multiple HTTP remote procedure call ports to handle API requests, Ormandy wrote. Ormandy says it took him 30 seconds to find one that would accept remote code. He also found an API that allowed him to access passwords stored in the manager. This is just the latest in a string of serious vulnerabilities that have been found in antivirus products in the last seven months.
Honestly who uses Trend Micro? every single company I have been to uses Eset NOD32 or the less IT educated companies use the McAfee corporate garbage.
Do not look at laser with remaining good eye.
The stupidity of this is epic.
So you've got a security product, and users can be idiots and give you all their passwords ... and then using unsuitable technology you're going to reveal them.
Jesus fucking Christ on a flaming pogo stick ... a password manager written in javascript??? It opens multiple HTTP RPC ports????
Are Trend that lazy and incompetent and just pushing crap out the door so they can claim to have one??? And we're supposed to trust you to have a security product???
This is beyond belief. It sounds like they're just phoning it in, and people should be loudly told to stay away from this pile of crap.
Lost at C:>. Found at C.
The NSA probably helped add this "flaw" and promised to pay the TrendMicro CEO $5M per year hush money. Now that it is fixed, he will have to give up all that easy money.
Enough said
>> The password manager in Trend's antivirus product is written in JavaScript
You're letting your web app developers write security software now? How is Trend still even in business?
the more software you have installed the slower and more vulnerable your system becomes.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
The you understand about their code in this case, the more stupid you see. Most flaws I can understand, someone overlooked something. These people at Trend Micro were beyond incompetent, utterly clueless.
Security professionals do exist who have been securing (and breaking) systems since the early days of the web. If you're a security company, hire a few of those people. Not only will they help you write software that doesn't stupidly open all of your customers to remote code execution, but by understanding how to write software that doesn't break when someone is trying to break it, we can also help you how to write software that doesn't break accidentally - reliable software.
If you're not a security company, but write web-enabled software, at least get someone qualified to spend an hour or two with you at key points in your design and implementation process. Suppose you have me come by for an hour meeting to go over the high-level architecture of your project, a meeting or two to address the lynch pin function(s) (encryption, authentication), and I spend an hour or two looking over the final product. Suppose you got someone who charges $200 /hour ($300 in California). You only need them for about 4 hours to get 80% of the benefit, so that's about $800 to make your software much more reliable while avoiding the $100 million fuck ups.
I know this is trend micro ,but it could have happened to anyone. Many years ago a few users scoffed when I said I didn't trust password managers. And here this is.
But as always, this is only the known vulnerability. How many are not widely known but being used?
Trend Micro already outsourced their QA to Taiwan, so I don't expect they're looking to increase payroll much.
"First they came for the slanderers and i said nothing."
This happened because the LUDDITES at Trend Micro used an appy app language like AppScript to manage LUDDITE passwords instead of apping apps!
Apps!
http://i.imgur.com/1nyVayo.jpg
Troll is not a replacement for I disagree.
Their support is all right and their product is probably middle front of the pack. But what I cannot fathom is their policy on submitting malware samples. You have to have a customer key which is not even obviously accessible from the management console.
I spent 10 minutes trying to explain to the technician that if you're running an antivirus company, you want to use a big net. You want to make it as quick and easy as possible for your customers to submit samples.
Frankly, antivirus as a product is a lose-lose. It doesn't catch the malware that's really going to screw you over, the 0-days. But there is enough known crap floating around that the old stuff can still bite every now and then if it gets through. So you have to have it (definitely if you're audited) but it doesn't protect you from the biggest threats.
.
Un - friggin' - believable.
Trend Micro's business model has for some years been to acquire companies and technologies in the security space from the US and Canada, then move the ongoing development and maintenance to Taiwan and China and support to the Philippines. So if you're working for a company that gets bought by Trend Micro, take the money and get out, because your job function will be outsourced to someone less expensive, probably a half dozen someones who are less expensive.
even this is relevant... how sad
Two weeks ago, my boss had us all download and install a few files described as 'APK'. She assured me it would protect our desktop machines from any and all potential malware threats. So far, I can't say she's wrong.
The weird thing is that when I try to search for reviews of this product, everything that turns up in Bing seems to be written by people with mental disorders. I guess it's probably anti-astroturfing by commercial competitors.
$5 / month hosted VPS on linux = awesome!
Security panda software places a dancing panda on your screen to let you see him defending you from virus. AS long as you see panda dancing, you are not affected by virus. Get Security Panda right away!
we know it's you, sexconker
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
So much for that... https://archive.is/jdOHs