“A zero-day attack called Double Agent can take over antivirus software on Windows machines,” Network World reported Wednesday. wiredmikey writes:
The attack involves the Microsoft Application Verifier, a runtime verification tool for unmanaged code that helps developers find subtle programming errors in their applications… [The exploit] allows a piece of malware executed by a privileged user to register a malicious DLL for a process associated with an antivirus or other endpoint security product, and hijack its agent.
Patches were released by Malwarebytes, AVG, and Trend Micro, the security researchers told BleepingComputer earlier this week. Kaspersky Lab told ZDNet “that measures to detect and block the malicious scenario have now been added to all its products,” while Norton downplayed the exploit, saying the attack “would require physical access to the machine and admin privileges to be successful,” with their spokesperson “adding that it has deployed additional detection and blocking protections in the unlikely event users are targeted.”
BetaNews reports that the researchers “say that it is very easy for antivirus producers to implement a method of protection against this zero-day, but it is simply not being done. ‘Microsoft has provided a new design concept for antivirus vendors called Protected Processes…specially designed for antivirus services…the protected process infrastructure only allows trusted, signed code to load and has built-in defense against code injection attacks.'”
Read more of this story at Slashdot.
https://slashdot.org/slashdot-it.pl?op=discuss&id=10407817&smallembed=1