Trend Micro Vulnerability Could’ve Helped Seize All of User’s Passwords

TrendMicro the anti-virus vendor recently issued one urgent product update which addresses a crucial security flaw. The flaw let cyber criminals to run malware as also see the matter inside 'Password Manager' incorporated into software for malware protection. It was when certain security researcher from Google criticized an official of TrendMicro in connection with the threat that the update was issued.

That researcher Tavis Ormandy of Google's Project Zero discovered Password Manager of TrendMicro created via utilizing node.js and JavaScript. Server for node.js belongs to the 'Password Manager' functionality and it is loaded using the vendor's AV solution. The server becomes active by default at every booting.

It also lets several ports exposed that could make visitors vulnerable when they access a website running malware and thus infect their systems via dispatching any JavaScript request. A cyber crook could without difficulty download code from the remote as also run it on the victimized user's system devoid of his knowledge.

With investigation on, Ormandy discovered a cyber criminal could clandestinely seize every password stacked inside TrendMicro's directory followed with decrypting them, the entire while leveraging the original weakness.

When Ormandy was conducting investigation, he managed towards seizing encrypted passwords set through the password tool, show up the domains pertaining to the encrypted passwords, as well as decrypt the passwords utilizing any Node.js API from among those exposed that enable decryption of passwords within Password Manager itself.

Basically, by creating one malevolent URL which would join all the exploits, a cyber-criminal need just dispatch this URL through electronic mail else embed it on any website that when any TrendMicro user clicks would enable the attacker grab all of the user's passwords that would first get sent onto a distant server under his control.

While information regarding which Password Manager and anti-virus editions of TrendMicro were flawed weren't provided, one fresh release, however, addresses these flaws. Therefore, it's advisable that users upgrade their TrendMicro anti-virus with one released. The update is automatic, according to the security vendor.

TrendMicro first knew about the problem 5th January following which it has released the emergency patch. Softpedia reported this, January 11, 2016.

» SPAMfighter News - 1/15/2016