• Uncategorised
  • 0

New exploit uses antivirus software to help spread malware

One of the most basic rules of safe web browsing is to use antivirus software in order to keep your computer safe. While it’s a good idea to make use of such software, but a recently discovered exploit[1] proves that even the best antivirus software is not fool proof. Nicknamed AVGater by Austria-based security consultant Florian Bogner, the exploit takes advantage of the “restore from quarantine” function[2] found on many antivirus programs.

The concept behind the exploit[3] is fairly simple one. It allows a user to move a piece of malware from the quarantined folder to somewhere else on the victim’s computer, allowing the malware to be executed. Bogner uploaded a video that provides more information on how the exploit works.

[embedded content]

Under normal circumstances, the restore from quarantine function would not allow a non-administrator to write a file to the computer’s C:Program Files or C:Windows folders, but this attack takes advantage of Windows’ NTFS function to grant the user access to these folders.

As impressive as this all sounds, there is one major flaw which will drastically limit the scope of this exploit. In order to do any of this, the hacker in question must physically be at the computer they wish to infect. Given that most malware is spread via the internet, it is unlikely that this exploit will cause major problems.

Enterprise computers could be the devices most at risk to this sort of attack. While we don’t see it being a widespread problem, it’s feasible that a disgruntled employee could decide to get a little revenge, though such cases are rather limited in nature; most people won’t risk their jobs or prison for such a stunt. That being said, Bogner offered a simple fix to this problem by simply disabling the remove from quarantine feature on enterprise computers.

In terms of antivirus programs, Bogner has notified the vendors of the various software which contain this flaw and many have already rolled out patches to fix this issue.

Exploits such as this are found from time-to-time, but that shouldn’t dissuade users from installing antivirus software[4] as it remains one of the best, though not unquestioned[5], ways to keep a computer safe from malware and other issues.

References

  1. ^ recently discovered exploit (www.techspot.com)
  2. ^ takes advantage of the “restore from quarantine” function (bogner.sh)
  3. ^ concept behind the exploit (arstechnica.com)
  4. ^ antivirus software (www.digitaltrends.com)
  5. ^ though not unquestioned (www.digitaltrends.com)

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *

       
Apps & Games Clothing Electronics & Photo Large Appliances
Baby Womens Apparel Garden Lighting
Beauty Mens Apparel Outdoors Luggage
Books Girls Apparel Health & Personal Care Pet Supplies
Car Boys Apparel Home Shoes & Bags
Motorbike Computers & Accessories Kitchen Equipment Sports & Outdoors
Fashion DIY & Tools Jewellery Toys & Games