
The Internet just got more dangerous, in terms of malware, if this study is correct. Researchers have discovered a method of bypassing security software, one that they said tested successfully against all 34 of the products tested.
matousec.com said the exploit is usable even if the account does not possess administrative privileges. Among the big names vulnerable according to the report are Symantec (Norton), McAfee, Kaspersky, NOD32, and ZoneAlarm.
All that's required, the researchers said, is for the security software use System Service Descriptor Table (SSDT) hooks to modify parts of the OS kernel. The researchers have named the exploit KHOBE.
If a product uses SSDT hooks or other kind of kernel mode hooks on similar level to implement security features it is vulnerable. In other words, 100 % of the tested products were found vulnerable. The only reason there are not more products in the following table is our time limitation. Otherwise, the list would be endless.
Not good. Those who might notice that Microsoft's free Security Essentials software is not listed as vulnerable shouldn't take heart, based on the above paragraph. The full list of tested products is below. It should be noted, however, that the researchers said the attack code itself has to be running on the system in order to perform the actual attack.

Additionally, the study was done using Windows XP Service Pack 3 and Windows Vista Service Pack 1 on 32-bit hardware. Researches believe that the vulnerability also exists in Windows 7, and that 64-bit systems will be vulnerable as well.
Of course, despite the fact that this vulnerability has been found, that doesn't mean you should be going around with your system unsecured. It just means that you should remain cautious, which you should be anyway.
- 3D EQSecure Professional Edition 4.2
- avast! Internet Security 5.0.462
- AVG Internet Security 9.0.791
- Avira Premium Security Suite 10.0.0.536
- BitDefender Total Security 2010 13.0.20.347
- Blink Professional 4.6.1
- CA Internet Security Suite Plus 2010 6.0.0.272
- Comodo Internet Security Free 4.0.138377.779
- DefenseWall Personal Firewall 3.00
- Dr.Web Security Space Pro 6.0.0.03100
- ESET Smart Security 4.2.35.3
- F-Secure Internet Security 2010 10.00 build 246
- G DATA TotalCare 2010
- Kaspersky Internet Security 2010 9.0.0.736
- KingSoft Personal Firewall 9 Plus 2009.05.07.70
- Malware Defender 2.6.0
- McAfee Total Protection 2010 10.0.580
- Norman Security Suite PRO 8.0
- Norton Internet Security 2010 17.5.0.127
- Online Armor Premium 4.0.0.35
- Online Solutions Security Suite 1.5.14905.0
- Outpost Security Suite Pro 6.7.3.3063.452.0726
- Outpost Security Suite Pro 7.0.3330.505.1221 BETA VERSION
- Panda Internet Security 2010 15.01.00
- PC Tools Firewall Plus 6.0.0.88
- PrivateFirewall 7.0.20.37
- Security Shield 2010 13.0.16.313
- Sophos Endpoint Security and Control 9.0.5
- ThreatFire 4.7.0.17
- Trend Micro Internet Security Pro 2010 17.50.1647.0000
- Vba32 Personal 3.12.12.4
- VIPRE Antivirus Premium 4.0.3272
- VirusBuster Internet Security Suite 3.2
- Webroot Internet Security Essentials 6.1.0.145
- ZoneAlarm Extreme Security 9.1.507.000

Recent Comments