Trend Micro Patches Password Manager Vulnerabilities Reported by Google Researcher
Trend Micro has rolled out updates to patch easy-to-exploit vulnerabilities found by a Google Project Zero researcher in one of the security firm’s products.
On January 5, Google researcher Tavis Ormandy informed Trend Micro that he had identified a critical flaw in Password Manager, a component installed by default with Trend Micro’s Premium Security and Maximum Security home products.
Ormandy found that Password Manager, which is primarily written in JavaScript with Node.js, opens multiple HTTP RPC ports for handling API requests.
The experts said it only took him 30 seconds to identify an API that could be leveraged for remote code execution (RCE). An attacker simply needed to get the victim to visit a malicious website in order to execute commands on the host with the user’s privileges.
The Google researcher also noted that it was possible to bypass Internet Explorer’s Mark of the Web (MOTW) security feature and execute commands without the victim getting any prompts.
The proof-of-concept (PoC) submitted to Trend Micro abused the openUrlInDefaultBrowser API, but the expert raised concerns over the fact that Password Manager exposed nearly 70 APIs to the Internet. Ormandy hasn’t checked all the APIs, but he did notice nearly a dozen that were potentially dangerous.
The researcher also discovered that one of the APIs, exportBrowserPasswords, could have been leveraged by an attacker to force users to export their browser passwords to the password manager, and a different API allowed access to passwords stored in the Trend Micro product.
Ormandy said a malicious actor might have been able to steal user passwords silently and without any interaction from the victim, but Trend Micro argued that it would not have been easy to decrypt the encrypted passwords.
Trend Micro pushed out a patch to address the vulnerabilities on Monday and Ormandy has confirmed that the fix resolves the issues. The researcher has advised the security firm to hire external security consultants to audit the password manager’s code.
Trend Micro representatives told the Google expert that their product team has been reviewing the source code of the exposed APIs to ensure that no remote action is allowed.
Ormandy has analyzed the products of several security companies over the past period. He identified serious vulnerabilities in software from Kaspersky Lab, AVG, FireEye, Avast and others.
In September, the expert warned that flaws in security products can considerably increase exposure to targeted attacks.
“We have strong evidence that an active black market trade in antivirus exploits exists. Research shows that it’s an easily accessible attack surface that dramatically increases exposure to targeted attacks,” Ormandy said at the time. “For this reason, the vendors of security products have a responsibility to uphold the highest secure development standards possible to minimise the potential for harm caused by their software.”
Related Reading: Critical Flaw Found in AVG, McAfee, Kaspersky Products
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
Latest News
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- 900 US Schools Impacted by MOVEit Hack at National Student Clearinghouse
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
