5 ms·

Except that all the others do similar and much worse things.

by statictype 9y ago

zamalek 9y ago
> all the others That's a very broad generalization. Care to provide a citation of all AVs getting up to no good?
- tetromino_ 9y ago
  Symantec: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... ESET NOD32: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html https://googleprojectzero.blogspot.com/2015/06/analysis-and-... Comodo: code execution vulns in virus scanner https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76... and installs an insecure web browser and sets it as the default https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70... Avast: remote code execution in network traffic filter https://bugs.chromium.org/p/project-zero/issues/detail?id=546 https://bugs.chromium.org/p/project-zero/issues/detail?id=54... AVG: installs Chrome extension that leaks your browsing history to anyone who cares to read it https://www.theregister.co.uk/2015/12/29/avg_google_chrome_extension/ https://www.theregister.co.uk/2015/12/29/avg_google_chrome_e... TrendMicro: remote file access with SYSTEM privilege https://bugs.chromium.org/p/project-zero/issues/detail?id=775 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... Kaspersky: a diverse range vulnerabilities over the years, ranging from remote root vulns (https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-unpackers-mo-problems.html https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-...) to "merely" making all SSL traffic man-in-the-middleable (https://bugs.chromium.org/p/project-zero/issues/detail?id=978 https://bugs.chromium.org/p/project-zero/issues/detail?id=97...) Etc, etc.
- orf 9y ago
  Project Zero. Obviously not all the vendors, but a wide selection of the largest ones. These are the ones that employ lots of people and should know better than to do some of the ridiculous stuff they are/where doing. From this it's safe to draw a broad generalisation about the state of security in the AV market.
  - deleted 9y ago
    [deleted]
  - zamalek 9y ago
    I got distracted by the non-sequitur. Defender was touted as the AV above all of this and, yet, it turns out that it isn't. Whether or not other AVs also have vulnerabilities (which all complex software has) is ancillary.
    - lmz 9y ago
      At least with defender you're not paying for the additional vulns.
      - zamalek 9y ago
        It depends how you argue that. I'm forced to use Defender at work and the worker process frequently pegs multiple cores at 80% - this costs time and patience. I don't have similar issues with NOD32 at home (which is precisely why I hand money over to ESET).

Except that all the others do similar and much worse things.

zamalek 9y ago

> all the others That's a very broad generalization. Care to provide a citation of all AVs getting up to no good?

tetromino_ 9y ago
Symantec: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html https://googleprojectzero.blogspot.com/2016/06/how-to-compro... ESET NOD32: remote root via vulnerable kernel-mode filter drivers https://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-eset.html https://googleprojectzero.blogspot.com/2015/06/analysis-and-... Comodo: code execution vulns in virus scanner https://bugs.chromium.org/p/project-zero/issues/detail?id=769 https://bugs.chromium.org/p/project-zero/issues/detail?id=76... and installs an insecure web browser and sets it as the default https://bugs.chromium.org/p/project-zero/issues/detail?id=704 https://bugs.chromium.org/p/project-zero/issues/detail?id=70... Avast: remote code execution in network traffic filter https://bugs.chromium.org/p/project-zero/issues/detail?id=546 https://bugs.chromium.org/p/project-zero/issues/detail?id=54... AVG: installs Chrome extension that leaks your browsing history to anyone who cares to read it https://www.theregister.co.uk/2015/12/29/avg_google_chrome_extension/ https://www.theregister.co.uk/2015/12/29/avg_google_chrome_e... TrendMicro: remote file access with SYSTEM privilege https://bugs.chromium.org/p/project-zero/issues/detail?id=775 https://bugs.chromium.org/p/project-zero/issues/detail?id=77... Kaspersky: a diverse range vulnerabilities over the years, ranging from remote root vulns (https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-unpackers-mo-problems.html https://googleprojectzero.blogspot.com/2015/09/kaspersky-mo-...) to "merely" making all SSL traffic man-in-the-middleable (https://bugs.chromium.org/p/project-zero/issues/detail?id=978 https://bugs.chromium.org/p/project-zero/issues/detail?id=97...) Etc, etc.
orf 9y ago
Project Zero. Obviously not all the vendors, but a wide selection of the largest ones. These are the ones that employ lots of people and should know better than to do some of the ridiculous stuff they are/where doing. From this it's safe to draw a broad generalisation about the state of security in the AV market.
- deleted 9y ago
  [deleted]
- zamalek 9y ago
  I got distracted by the non-sequitur. Defender was touted as the AV above all of this and, yet, it turns out that it isn't. Whether or not other AVs also have vulnerabilities (which all complex software has) is ancillary.
  - lmz 9y ago
    At least with defender you're not paying for the additional vulns.
    - zamalek 9y ago
      It depends how you argue that. I'm forced to use Defender at work and the worker process frequently pegs multiple cores at 80% - this costs time and patience. I don't have similar issues with NOD32 at home (which is precisely why I hand money over to ESET).