SoylentNews is people
SoylentNews
Avast pulls plug on insecure JavaScript engine in its security software suite:
Avast has disabled a component in its Windows anti-malware suite that posed, ironically enough, a significant security risk.
The software maker switched off the JavaScript interpreter in its toolkit after Google Project Zero's Tavis Ormandy, and his colleagues, alerted the developer to design flaws in the code.
According to Avast, Ormandy potentially found a remote-code execution vulnerability in the software, the details of which were not publicly shared. Five days later, the Googler released a shell for poking around in Avast's JavaScript engine for anyone interested in assessing the antivirus suite. He also revealed that if miscreants were able to exploit any holes in Avast's JS engine on a victim's computer, they would be able to run malware on that PC with system-admin-level privileges.
[...]"Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage," Ormandy explained earlier this week. It should be noted Ormandy did not disclose any specific bugs.
A couple days after the analysis tool was released, the vendor opted to do away with the emulator entirely. It does not believe the removal will significantly impact the suite's ability to detect malware. The swift action was applauded by Ormandy.
(Score: 2) by bzipitidoo on Monday March 16 2020, @01:25PM
It's one of the most common ironies that security measures so often lessen security.
In this case, though, these "security" peddlers have additional items on their agenda. Also a very common and ironic feature of security. Who watches the watchers, and all that.
MS is, of course, very guilty of twisting the meaning of security into "security for them against their own users", and trying to convince the users it's the other way around. And the lizard-brained scared-stupid-of-computers among users accept that obvious misinterpretation, because they want security so very badly. Please, Big Daddy, keep me safe! Please, please! It's okay if you have to trample upon my rights, my privacy, my CPU cycles, and, er, my safety, to keep me safe.