Trend Micro has patched a flaw in its antivirus software that potentially put PCs at risk of being hijacked by criminals.
A vulnerability uncovered by Google security researcher Tavis Ormandy, who found that the Password Manager tool bundled with the software was installed with a major JavaScript flaw included.
This could allow hackers to access the software and take control of it in a matter of seconds, giving them the ability to execute commands and launch programs on unsuspecting users’ PC, as well as potentially giving access to all saved passwords stored with Password Manager on the machine.
This was displayed by one user hacking into the Calculator program bundled with Windows to take over a user’s PC (pictured below).
“I don’t even know what to say – how could you enable this thing *by default* on all your customer machines without getting an audit from a competent security consultant?”
Following the publication of his blog on Google’s security research site, Ormandy confirmed he had been contacted by Trend Micro, which thanked him for pointing out the flaw.
The company says it has now fixed the problem, and is has updated Password Manager in a patch to remove ShellExecute as part of the software.
“The most important thing to know is that the critical vulnerabilities in the public report have been fixed for all Trend Micro Password Manager customers,” a Trend Micro statement said. “As part of our standard investigation we checked and verified that the only product affected by these issues is our consumer Trend Micro Password Manager and no commercial or enterprise products are affected.”
“We responded quickly to the initial report and worked with Tavis throughout the process to understand the issue and address them. Thanks to his responsible work with us, we were able to address the most critical issues he brought us in less than one week. We are not aware of any active attacks against these vulnerabilities in that time.”
Are you a security pro? Try our quiz!
Swedish telecoms giant Ericsson blamed “challenging mobile networks market” and “further volume contraction” for job…
Dramatic downfall. Sam Bankman-Fried sentenced to 25 years in prison for masterminding $8bn fraud that…
Fallout avoidance? Tesla buyers in the US must be shown how to use the FSD…
Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…
While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…
Shares in Donald Trump’s social media company rose about 16 percent after first day of…