Many popular pieces of antivirus software such as Microsoft, SentinelOne, TrendMicro, Avast, and AVG can be exploited for their data deletion capabilities, a top cybersecurity researcher has claimed.
In a Proof-of-Concept document (opens in new tab) dubbed “Aikido”, Or Yair, who works for cybersecurity firm SafeBreach, explained how the exploit works via what is known as a time-of-check to time-of-use (TOCTOU) vulnerability.
Notably, in martial arts, Aikido refers to a Japanese style where the practitioner looks to use the movement and force of the opponent against himself.
How does it work?
The vulnerability can be used to facilitate a variety of cyber-attacks known as “Wipers” according to Yair, which are commonly used in offensive war situations.
In cybersecurity, a wiper is a class of malware aimed at erasing the hard drive of the computer it infects, maliciously deleting data and programs.
According to the slide deck, the exploit redirects the “superpower” of endpoint detection software to “delete any file no matter the privileges”.
The complete process outlined involved creating a malicious file in “C:tempWindowsSystem32driversndis.sys”.
This is followed by holding its handle and forcing the “AV/EDR to postpone the deletion until after the next reboot”.
This is followed by then deleting the “C:temp directory” and “creating a junction in C:temp –> C:”, followed by then rebooting the machine.
Only some of the most popular antivirus brands were impacted, around 50% according to Yair.
According to a slide deck prepared by the researcher, Microsoft Defender, Defender for Endpoint, SentinelOne EDR, TrendMicro Apex One, Avast Antivirus, and AVG Antivirus were some of those affected by the vulnerability.
Luckily for some, products such as Palo Alto, XDR, Cylance, CrowdStrike, McAfee, and BitDefender were unscathed.
- Interested in updating your cybersecurity tools? Check out our guide to the best malware removal tools
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba