Many popular pieces of antivirus software such as Microsoft, SentinelOne, TrendMicro, Avast, and AVG can be exploited for their data deletion capabilities, a top cybersecurity researcher has claimed.
In a Proof-of-Concept document dubbed "Aikido", Or Yair, who works for cybersecurity firm SafeBreach, explained how the exploit works via what is known as a time-of-check to time-of-use (TOCTOU) vulnerability.
Notably, in martial arts, Aikido refers to a Japanese style where the practitioner looks to use the movement and force of the opponent against himself.
The vulnerability can be used to facilitate a variety of cyber-attacks known as "Wipers" according to Yair, which are commonly used in offensive war situations.
In cybersecurity, a wiper is a class of malware aimed at erasing the hard drive of the computer it infects, maliciously deleting data and programs.
According to the slide deck, the exploit redirects the "superpower" of endpoint detection software to "delete any file no matter the privileges".
The complete process outlined involved creating a malicious file in "C:tempWindowsSystem32driversndis.sys".
This is followed by holding its handle and forcing the "AV/EDR to postpone the deletion until after the next reboot".
This is followed by then deleting the "C:temp directory" and "creating a junction in C:temp --> C:", followed by then rebooting the machine.
Only some of the most popular antivirus brands were impacted, around 50% according to Yair.
According to a slide deck prepared by the researcher, Microsoft Defender, Defender for Endpoint, SentinelOne EDR, TrendMicro Apex One, Avast Antivirus, and AVG Antivirus were some of those affected by the vulnerability.
Luckily for some, products such as Palo Alto, XDR, Cylance, CrowdStrike, McAfee, and BitDefender were unscathed.
We engaged The Computer Geeks in mid-2023 as they have a reputation for API integration within the T . . . [MORE].
We all have been VERY pleased with Adrian's vigilance in monitoring the website and his quick and su . . . [MORE].
FIVE STARS + It's true, this is the place to go for your web site needs. In my case, Justin fixed my . . . [MORE].
We reached out to Rich and his team at Computer Geek in July 2021. We were in desperate need of help . . . [MORE].
Just to say thank you for all the hard work. I can't express enough how great it's been to send proj . . . [MORE].