Google troublemaker Tavis Ormandy, whose credits include turning up security vuln in popular antivirus products, reckons he’s identified an active market in antivirus exploits. In June, the Google Project Zero security bod found trivial bugs in the ESET tool, and earlier this month, he served a similar dish to Kaspersky. In his latest post, Ormandy details more work on Kaspersky products (noting that the Russian outfit is already at work on patches). From the vuln side, he identifies bugs in various file parsing routines (“everything from Android DEX files and Microsoft CHM documents to unpacking UPX and Yoda’s Protector”, he writes). There’s also a now-patched bug in Thinstall container handling.
View full story
