For decades, we have entrusted the protection of our computers to various security solutions. First came antivirus software, then the concept of antimalware, and today you can find complete broad-spectrum packages. However, an antivirus is still a piece of software, and if a vulnerability exists in its code, the right exploit could turn it into an extremely dangerous attack vector.
The AVG Incident: A Cautionary Tale
I remember very well when AVG Antivirus misinterpreted a file from the Windows XP operating system due to a corrupted database, taking down computers around the world like dominoes. That incident gave us a chilling example of what an antivirus could cause in the wrong hands. The problem is none other than the development structure adopted by companies. The vast majority of antivirus and antimalware programs are proprietary, meaning we cannot see their code nor conduct audits to try to detect vulnerabilities. In other words, why would anyone waste resources attacking a browser and the sandbox for its plugins, when a bug in an antivirus would be more than enough?
New Findings from Project Zero's Tavis Ormandy
The news comes through Tavis Ormandy, a member of Google's famous Project Zero, a group known for having some clashes with Microsoft. Ormandy's work focuses on fuzzing techniques, which in simple terms bombard a program with digital garbage, hoping to trigger erratic behavior such as memory leaks or crashes (partial and total). One of his first "victims," so to speak, was Kaspersky Labs solution, and according to the published material, he had a real feast. The Kaspersky team responded almost immediately to the reports, correcting and updating their builds, but the point was exposed: a bug that allows remote code execution through an antivirus with elevated privileges can cause a real disaster.
As if that weren't enough, there are indications pointing to the commercialization of exploits for antivirus solutions on the black market, and unfortunately, Kaspersky isn't alone in this maze. Ormandy also found similar vulnerabilities in software from companies like Sophos and ESET. While Ormandy highlighted the speed of response from Kaspersky, it would be a mistake to expect the same from other developers. The researcher's recommendation is simple: a sandbox for antivirus, and he suggested Chromium's sandbox, which is open source. At the end of the day, we're not too surprised. More software means a larger attack surface, and the idea of "security through simplicity" is gaining more and more strength. Now, does this imply giving up your antivirus? The answer is no. Its benefits still far outweigh the risks.
